Share it
In this post, Kenny Henderson, Temi Orekunrin and Megan O’Neill of CMS summarise the second day of submissions in the appeal of Lloyd v Google LLC.
Day 2 continued with Lord Reed, Lady Arden, Lord Sales, Lord Leggatt, Lord Burrows sitting (remotely) and Counsel for Mr Lloyd (“Lloyd”) continuing his submissions. Lloyd was asked numerous detailed questions by the Justices, both on the legal theory supporting his claim and also on practicalities arising from the class action he was bringing against Google. Following Lloyd, the Information Commissioner’s Office (“ICO”), one of the interveners, presented its submissions and Google then delivered its Reply Submissions.
Lloyd continued his submissions on the first ground of appeal, on whether a uniform per capita amount of compensation can be awarded for “loss of control” of data under the DPA:
De minimis threshold
Lloyd submitted that the court should have regard to the character of a breach and not only the damage caused. Lloyd relied Halford v. United Kingdom (20605/92) [1997] ECHR 32 in submitting that the court can make an award based on the seriousness of a breach alone. In Gulati v. MGN Ltd [2015] EWHC 1482 the court considered damages for loss of control which is particularly relevant to data breaches.
In response to questions from Lord Leggatt, Lloyd submitted that loss of control was sufficient to attract damages. In response to comments from Lord Leggatt comparing the position with a personal injury claim in which harm was a necessity, Lloyd stated that given the breach of the rules, an exposure of the data subjects to the risk of harm is sufficient to attract damages. Lord Reed pointed out that there was an alternative to bringing claims using the CPR 19.6 Representative Action mechanism, and that a claim was being brought against British Airways using a Group Litigation Order, following its data breach in 2018.
Lowest Common Denominator
The Court of Appeal permitted the “lowest common denominator” of class members’ claims to proceed, and so there were detailed submissions on this point.
Lloyd submitted that the “lowest common denominator” cannot be known at this early stage of proceedings including because no disclosure has been given. Lloyd contended that there are many cases where damages have been awarded for infringement of a right. At Lord Burrow’s questioning, Lloyd accepted that the lowest common denominator may be a trivial loss of control and that compensation in that event would be trivial.
Lloyd submitted that privacy/data protection cases have a special status as regards conventional awards, as an individual assessment is not possible. Lord Leggatt noted that it was possible, though inconvenient, for the law to take an individual approach to the harm. Lloyd responded that the rules devised by the common law for determining the scale of damages could be flexible in situations where it is in the interests of justice.
User damages
Lloyd, referring to Morris Garner and another v One Step (Support) Ltd [2018] UKSC 20, submitted that user damages arise where something for which payment can be required has been taken for nothing. In this case, the claimants had been deprived of their right to have their data dealt with lawfully. Lord Leggatt, noted that the value of the deprivation had to be known and he queried how value would be negotiated. Lloyd responded that the court could apply a hypothetical wherein users would be asked by Google to consent to their data being used in exchange for small amounts of money.
On the basis that this was to be done on a class basis, Lord Burrows asked how this aggregate would be divided between class members. Lloyd responded that there would be a standard sum per person, as an alternative to the lowest common denominator approach. In response to further questioning, Lloyd conceded that some people would be under/over compensated highlighting the fact that it would otherwise be unworkable.
Lloyd then turned to the second ground of appeal, concerning the meaning of the “same interest” requirement under the representative action mechanisms at Rule 19.6 of the CPR:
Same interest requirement
Lloyd submitted that class has the same interest in holding Google to account – the wrong, the loss claimed and therefore the interest is the same. Duke of Bedford v Ellis [1901] AC 1 held that the damage did not need to be exactly the same – the rule should be flexible in order to do justice. The bench asked about the destination of any unclaimed damages and Lloyd confirmed that the balance could be returned to Google, in the absence of legislation allowing otherwise and stated that a funder was necessary to obtain damages.
The bench also asked the basis upon which the funder was entitled to payment of a share of damages where there was no privity of contract between class members and the funder. Lloyd sated that there was an analogue in trust law whereby the trustee can charge costs of getting the fund property, and in this scenario that would include the costs of litigation funding.
Lloyd addressed the court on the influential case of Markt & Co Ltd V Knight Steamship Co Ltd [1910] 2 KB 1021 (CA) which Google submitted restricted the scope of the representative action mechanism and prevented Lloyd’s case from proceeding. Lloyd contended that the Court of Appeal had previously deviated from Markt. In particular Prudential Assurance Co Ltd v Newman Industries Ltd (No 2) [1982] Ch 204 found that representative actions can be brought by a plaintiff on behalf of himself and other members of the class in instances where each member of the class has a separate cause of action subject to 3 conditions: (1) such actions cannot be used to infer a cause of action that you would not otherwise have, (2) there must be an interest shared by all members and (3) the court must be satisfied that it is in the interest of all members of the class. Lady Arden noted that representative actions are a well-established chancery practice.
Lloyd then pointed to a number of Australian, Canadian and New Zealand cases where representative actions had been permitted absent a statutory framework, including Carnie v Esanda Finance Corporation, Canada Western Canadian Shopping Centres Inc. v. Dutton and Southern Response Earthquake Services Ltd v Ross.
The Same interest criteria
Lloyd made the following submissions with respect to the same interest criteria regarding of loss of control:
- Claiming uniform sums in respect of loss of control satisfies the same interest criteria. Class members may individually be entitled to greater sums, but they are entitled to limit their claims to avail themselves of particular procedures. Google’s contention that this is a mere tactic is irrelevant.
- While the representative (not the class) has chosen this course of action, any member of the class can exclude itself from the class.
- The lowest common denominator is not a fiction, but an analytical tool devised to meet the common interest criteria. How it works is a matter of fact.
- The cases referenced by Google do not support its claim that it is contrary to public policy to artificiality limit claims. Google’s argument ignores the policy benefit of the procedure.
- Whether or not representative actions are contrary to the intention of Government is irrelevant. There is no evidence that it is contrary to parliamentary intentions, which is a more pertinent issue. There has been no proposal of collective consumer actions put before parliament. In any event, it is in the province of the court as it concerns access to justice.
- The risk that actions claiming large amounts may be used as threats and blackmail litigation is not confined to group actions.
Identifying members of a class.
Lloyd submitted that there are two elements to identifying members of the class: the correct legal test to be applied and the actual identifiability of the members of the class. As regards the legal test, Lloyd made submissions based on the Court of Appeal’s findings – a class must be conceptually clear which means it must be possible to say of any particular person that they have the same interest as Mr Lloyd at all stages of the proceeding as confirmed by Emerald Supplies Ltd v British Airways plc [2011] Ch 345 . Regarding the second point – identifiability, Lloyd submitted that there are many cases where class boundaries are unclear and that Duke of Bedford was precedent to show that those issues are surmountable.
Lloyd’s submissions on the third ground of appeal were as follows:
The Court of Appeal held, rightly in the opinion of Lloyd, that the judge had exercised his discretion on an erroneous basis. The Court of Appeal held that it would be hard for the detached observer to find that the decision of the first two issues didn’t affected the court’s exercise of discretion. Lloyd also submitted that in exercising its discretion, the court wrongly took into account the assertion that the claimants had not complained which was not accurate and the fact that the claimants did not authorise the claim, a factor that would prevent all representative actions. Finally, Lloyd contended that the court ought not to have exercise its discretion to prevent a meritorious case providing remedies to many claimants as this was an extraordinary exercise of discretion especially given the early stage of the litigation.
SUBMISSIONS OF THE INFORMATION COMMISSIONER’S OFFICE (“ICO”)
The ICO’s arguments broadly supported Lloyd’s claim. The ICO submitted that the right to control personal data and have autonomy over it is a right with intrinsic value separate from the economic value of the data. Having robust data protections is necessary to preserve human rights. The ICO submitted that loss of control causes harm whether or not there is further specific damage as the data controller has failed in its obligations to data subjects resulting in an injury to their right.
The ICO submitted that the UK GDPR provides for administrative remedies by the regulator as well as judicial remedies. The right of individuals to recover compensation for breaches is expressly the function of the court. Therefore, it is not an answer to say that the breaches can be dealt with by regulatory action. The ICO also submitted that a narrow construction of concept of damages may have an impact beyond s. 13 of the DPA and private law matters. E.g. under s.150 DPA 2018, in deciding whether to give an enforcement notice the commission must consider whether there has been damage or distress. Therefore, a narrow construction may constrain the scope of the ICOs ability to take regulatory action.
The ICO highlighted a point raised in the fourth intervener’s written submissions: if damage is held to exclude loss of control then the law may discriminate against children or people with learning disabilities who are too young or unable to experience distress and therefore be left without a remedy.
The Justices challenged the ICO suggesting that the point about the impact of a narrow construction had been overstated given that the ICO ought to contemplate numerous considerations in deciding whether to take regulatory action. The ICO was also challenged about its decision to not take regulatory action against Google concerning the underlying facts of this claim. The ICO stated the view was taken that the breach didn’t reach criteria for enforcement action stressing that the incident took place 10 years ago under a different regime. Lady Arden asked the ICO to look into whether the transitional provisions allow the ICO to take action under the old regime.
APPELLANT’S REPLY
In its Reply, Google made a number of points including the following:
- Lloyd’s suggestion that class members may be able to opt-out of the claim is unrealistic given lack of awareness amongst class members and the unwieldiness and complexity of the procedure.
- Google did not accept that data protection law discriminates against children, noting that other harmful impacts beyond distress can be awarded in damages.
- Google submitted that this case could have been brought under a Group Litigation Order, albeit it is unlikely that 4 million people would have elected to join the claim.
In response to the ICO Google stated that there is little between the it and the ICO as the ICO recognises that not all losses of control are equally serious though loss of control may have harmful consequences, only some meriting compensation. In concluding, Google stated that if the court is attracted to the position that loss of control can of itself be harm, no two members would have suffered the same loss of control.
The hearing then came to an end and the Court adjourned to consider judgment.
