Litigation Trending - Is the Cookie Jar still open?

On 10 November 2021, the Supreme Court published its much-anticipated judgment in the landmark data breach litigation case, Lloyd v Google.

The headlines

• As predicted in our 10 predictions for 2021, the Supreme Court has decided that "loss of control" damages are not a form of damages recognised in law and victims of a data breach need to have suffered financial loss or mental distress in order to bring a claim.
• The Supreme Court's judgment on the representative procedure pursuant to CPR r 19.6 does, however, highlight an alternative approach for bringing representative actions, albeit one that may not be economically viable for mass claims.

The claim

Lloyd v Google concerned a representative action brought by Richard Lloyd, on behalf of more than four million users of iPhones whose data was processed by Google between April 2011 and February 2012. It was alleged that Google used the data, which was generated from the iPhone users' browsers, to categorise the users into various groups based on their interests, before selling that data to advertisers who were looking to target those groups of people. There was no claim for distress or financial loss. The essence of the action was that Google was obliged to pay a fixed per sum to affected data subjects simply because they had suffered a "loss of control" of their data. Mr Lloyd's claim was brought under CPR r 19.6 as a "representative action", which requires the person bringing the claim to have the "same interest" as the other claimants that the lead claimant represents.  Mr Lloyd argued this was satisfied on the basis that all the claimants had suffered the same "loss of control" and no claim was advanced for financial damages or distress by any claimant.

Lower courts

Having been denied permission to bring his claim by the High Court, the Court of Appeal reversed the High Court's decision and found that:

(i) damages could be awarded for "loss of control" without a claimant having suffered financial loss and distress; and

(ii) a claim could be brought as a representative action under CPR r 19.6 because the iPhone users were (a) identifiable and (b) had the same interest.

In doing so, the Court of Appeal also exercised its discretion in allowing Mr Lloyd to bring a representative action.

The Supreme Court

The Supreme Court was therefore faced with three questions:

(i) Can damages be awarded for "loss of control" of data even if there is no financial loss or distress?

(ii) Did Mr Lloyd and the iPhone users have the "same interest" necessary to bring a representative action? 

(iii) Should the Court's discretion be exercised to allow a representative action to proceed?

Judgment

In a unanimous decision, the Supreme Court found that Mr Lloyd's claim should not be allowed to proceed, and restored the High Court's order refusing permission to serve proceedings on Google outside the jurisdiction . We set out below our analysis of the Court's determination on questions (i) and (ii) - the Court did not consider it necessary to rule on question (iii).

(i) Can damages be awarded for "loss of control" of data even if nobody suffers financial loss or distress?

The Court ruled that Mr Lloyd was unable to bring a claim for "loss of control" damages.

Section 13(1) of the Data Protection Act 1998, which Mr Lloyd alleged Google to have breached, provides that an individual who suffers damage "by reason of any contravention by a data controller of any of the requirements of this Act" has a right to compensation from the data controller for that damage. 

However, the Court found that section 13 of the DPA "cannot reasonably be interpreted as conferring on a data subject a right to compensation for any (non-trivial) contravention by a data controller of any of the requirements of the Act without the need to prove that the contravention has caused material damage or distress to the individual involved." 

Put differently, an individual cannot claim compensation under section 13 of the DPA merely for contravention of the Act itself – rather, it must be established that the individual has suffered financial loss or distress as a result of that contravention.

(ii) Did Mr Lloyd and the iPhone users have the same interest necessary to bring a representative action?

Putting to one side the need to show financial loss or mental distress, the Supreme Court ruled that an individual assessment of Google's liability in respect of each claimant would have been required. As a result, a representative action was not the appropriate vehicle for the claim – the individual claimants did not have the same interest because the nature of the breach differed for each claimant.

An alternative approach to representative actions

As well as confirming that damages or other monetary remedies could be claimed in a representative action if the entitlement was common to all members of a class (such as payment of a fixed fee), the Court did consider that CPR r 19.6 should be treated as a flexible tool to achieve justice.  

At its heart, the Court held that the premise of the "same interest" test is about ensuring that the representative can be relied upon to conduct the litigation in such a way as to promote the interests of the members of the represented class. In other words, what was really important was ensuring that there were no conflicts of interest among class members. The Court noted, in a modern context, the reality that proceedings brought to seek collective redress are typically driven and funded by lawyers or commercial litigation funders with the representative party merely acting as a figurehead. In these circumstances, there should be no reason why a representative party cannot properly represent the interests of all class members, provided that there is no true conflict between them.

The Court also considered the scope for claiming damages pursuant to the representative action procedure, confirming the established position that the limiting factor is the compensatory principle on which damages for a civil wrong are awarded, with the object of putting the claimant - as an individual - in the same position, as best as money can do it, as if the wrong had not occurred. In the ordinary course, as the Court explained, this necessitates an individualised assessment which raises no common issue, and cannot fairly or effectively be carried out without the participation in the proceedings of the individuals concerned. A representative action is therefore not a suitable vehicle for such an exercise.  

The Court held, however, that where damages would require individual assessment there may still be scope for representative action on a "bifurcated" basis, with the Court suggesting this was, in theory, a potential route by which Mr Lloyd could have brought a representative action:

1. A representative action is brought to decide common issues of law or fact, for example, whether a data breach has occurred, resulting in a declaration of legal rights;
2. Once the representative action is decided, matters requiring individual determination, such as the amount of loss suffered, can be dealt with at a second stage – and on a non-representative basis in a manner comparable to follow-on damages.

What next?

What that means in practice is difficult to say. With a significant number of representative actions brought with the support of litigation funding, it is unclear whether litigation funders will be willing to fund actions to obtain legal declarations on a representative basis. Tellingly, however, the Court assumed that Mr Lloyd had not proposed a bifurcated process because the first stage of the process would not have generated a financial return for the litigation funders. The Court also noted the reality that the second stage would effectively be an "opt-in" process, and highlighted the real limitations with opt-in procedures and the associated issues with take-up and low participation rates. So while the Supreme Court is effectively opening the door for a bifurcated process to be pursued, it would seem that it recognises the practical and commercial issues that this approach may bring.

Separately, the outcome in Lloyd v Google may nevertheless strengthen calls for legislative reform and the introduction of a statutory opt-out procedure along the lines used in competition proceedings. Whether there is appetite for such broader reform – in government or in industry – remains to be seen. 

We will also be discussing the judgment (amongst other topics) on Wednesday 24 November in our Data Protection 2021 Roundup webinar. Register here. 

Authors: Jon Gale (Partner), Rhiannon Webster (Partner), Tim West (Senior Associate), Aaron Marchant (Solicitor), Katy Walters (Solicitor)