The Supreme Court today handed down its long awaited judgment in the case of Lloyd v Google [2021] UKSC 50.  The Court unanimously allowed Google’s appeal and restored the Judge’s order refusing the representative claimant permission to serve the claim out of the jurisdiction.

The only judgment is given by Lord Leggatt.  He begins by analysing the history and scope of the representative procedure and endorses the view, found in the old case law, that it is a “flexible tool of convenience in the administration of justice”. This broad and adaptable approach has been adopted by the highest courts of Australia, Canada and New Zealand. It is even more appropriate now in modern conditions including the development of digital technologies which have greatly increased the potential for mass harm for which legal redress may be sought [33]-[68].

Lord Leggatt considers that the “same interest” requirement must be interpreted purposively and pragmatically in light of its rationale and the overriding objective of the CPR of dealing with cases justly [69]-[75]. It is not a bar to a representative claim that each represented person has in law a separate cause of action nor that the relief claimed consists of or includes damages. Damages may be claimed in a representative action if they can be calculated on a basis common to all persons represented. Alternatively, issues of liability may be decided in a representative action which can then form the basis for individual claims for compensation [80]-[83].

As a result, a representative claim could have been brought to establish whether Google was in breach of the DPA 1998 as a basis for pursuing individual claims for compensation. However, the claimant did not propose such a two–stage procedure, doubtless because the proceedings would not be economic if it is necessary to prove loss on an individual basis. Instead, the claimant argues that a uniform sum of damages can be awarded to each member of the represented class without the need to prove any facts particular to that individual [84]-[89].

In particular, the claimant argued, supported by the Information Commissioner, that compensation can be awarded under the DPA 1998 for “loss of control” of personal data constituted by any non–trivial contravention by a data controller of any of the requirements of the Act.

Lord Leggatt rejected these arguments and concludes that the claim advanced cannot succeed for two reasons. First, the claim is founded solely on section 13 of the DPA 1998, which provides that “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”. On the proper interpretation of this section the term “damage” refers to material damage (such as financial loss) or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself [90]-[143]. Second, it is on any view necessary, in order to recover compensation under section 13, to prove what unlawful processing by Google of personal data relating to a given individual occurred.

The attempt to recover damages without proving either what, if any, unlawful processing of personal data occurred in the case of any individual or that the individual suffered material damage or mental distress as a result of such unlawful processing is therefore unsustainable [144]-[157]. In these circumstances the claim could not succeed and permission to serve the proceedings on Google outside the jurisdiction was rightly refused by the judge [158]-[159].

We hope to be able to post an Inforrm case comment shortly.