The Supreme Court (Lords Wilson, Briggs and Kitchin) has today granted Google LLC permission to appeal against the order of the Court of Appeal in the case of Lloyd v Google LLC ( EWCA Civ 1599) granting the representative claimant permission serve a representative claim out of the jurisdiction.
The appeal covers all the issues decided by the Court of Appeal. There were, in substance, three points which were decided in Google’s favour by Warby J ( EWHC 2599 (QB)) and on which his judgment was overturned by the Court of Appeal (Dame Victoria Sharp P, Sir Geoffrey Vos C and Davis LJ), namely
- Whether a “uniform per capita” amount of compensation can be awarded for “loss of control” for a non-trivial breach of the DPA even if the breach causes no material damage or distress? The Court of Appeal’s answer to this was “yes”.
- Whether, under the “same interest” requirement in CPR 19.6(1) it has to be be possible in practice to identify the members of the class in order to pursue a representative action? The Court of Appeal’s answer to this was “no”.
- Whether the Court of Appeal was wrong to interfere with Warby J’s discretion in ruling that the claim should not be permitted to proceed under CPR 19.6 as a representative action? The Court of Appeal did interfere with Warby J’s exercise of his discretion.
The action is brought on behalf of an estimated 4.4 million iPhone users and concerns Google’s gathering and exploitation of browser generated information (“BGI”) on Apple’s Safari browser.
As Aidan Wills pointed out in his case comment on the Court of Appeal decision, this case is of profound importance for data protection law and practice. First, there the Court of Appeal’s acceptance that compensation may be awarded for breaches of data protection legislation, leading to a loss of control of personal data, without proof of distress or any material damage has the potential to widen significantly the circumstances in which data protection claims may be brought. Second, the Court’s acceptance that a representative action may be an appropriate means by which a large number of alleged victims of data misuse can seek redress opened the way for a large number of claims in respect of data breaches.
The case is not expected to be heard by the Supreme Court until late 2020 or early 2021.