Share it

In this post, Kenny Henderson and Alex Askew of CMS comment on the Supreme Court’s decision in Lloyd v Google LLC [2021] UKSC 50, which concerned whether a representative data protection action seeking damages for loss of control of personal data could be brought on behalf of large numbers of unidentifiable class members.

On 10 November 2021, the Supreme Court reversed the decision of the Court of Appeal in Lloyd v Google LLC [2021] UKSC 50, and unanimously dismissed Lloyd’s representative action brought against Google. The Supreme Court confirmed that a claim for damages for the unlawful processing of data under the Data Protection Act 1998 (“DPA 1998”) can only be made if the data subject has suffered some form of material damage (such as financial loss) or mental distress. The damage could not be the unlawful processing itself. This avoids a floodgates situation, where data controllers could have faced opt-out class actions for breaches of data protection law where the claimant had suffered a “loss of control” of data but no actual loss.

The Supreme Court also found that, in order to advance such a claim, it would be necessary to assess the extent of the unlawful processing in each individual case and damages could not be sought on a “uniform per capita” basis, without proof of individual circumstances. However, in certain respects the judgment expands the circumstances in which the representative action device can be used. Claimants and litigation funders will continue to explore the use of the representative action mechanism, particularly in circumstances where the homogeneity of individual losses can be sufficiently demonstrated across the class.

Factual background

Mr Lloyd, a former director of Which?, brought a representative action against Google using the procedure set out in Civil Procedure Rule (“CPR”) 19.6. Mr Lloyd’s claim was funded by third-party litigation funder, Therium. The claim alleged that between August 2011 and February 2012, Google breached its duties as a data controller to over 4 million Apple iPhone users resident in England and Wales. Mr Lloyd claimed that Google used a browser cookie which could be activated on certain mobile phones without users’ knowledge or consent when they visited certain websites (described as the ‘Safari Workaround’). Google allegedly used the cookie to collect information about customers’ browser activity, which in turn enabled Google to distribute targeted advertising to those users, generating significant profits for the company.

Mr Lloyd relied on s 13(1) of the DPA 1998 in bringing his claim, which provides a right of compensation where an individual suffers damage or distress by reason of any contravention by a data controller of the DPA 1998.

The representative action procedure in CPR 19.6 allows an action to proceed on an “opt-out” basis, meaning that individual class members do not need to elect to join the claim.  Thus, this is a very powerful procedural group claim mechanism.  The class members and representative must share the “same interest” in the claim. If that test is satisfied, then the court will use its discretion in deciding whether a claim that meets the test should be permitted to proceed. A judgment will bind all class members unless the court orders otherwise.

Mr Lloyd argued that the “same interest” requirement was satisfied as all members of the class could claim damages for “loss of control” and no proof of any further damage or distress was required. Damages were framed on the basis of an equal, standard “tariff” award, without the need for the individual assessment of loss. Mr Lloyd put forward a figure of £750 in compensation for each individual, which could have resulted in an award of damages of up to £3 billion. Assessment of whether the claim was suitable for the representative action procedure was performed in the context of Mr Lloyd’s application for permission to serve the claim outside of the jurisdiction.

Decisions of the lower courts

In October 2018, the High Court refused permission to serve the claim form out of the jurisdiction, finding that:

  • Mr Lloyd had failed to identify any harm caused by the alleged breach, which was required in a claim for compensation under the DPA 1998. Compensation could not be awarded merely for the reason of the infringement itself and associated loss of control over the personal data.
  • Even if Mr Lloyd could establish the requisite level of harm, the “same interest” test was not met because the impact was not uniform across the class.
  • Regardless, in exercising his discretion, the Judge would have refused to allow the claim, taking into account a number of different factors (which included likely costs, the inability to identify class members and the fact that class members had not authorised the claim).

Mr Lloyd appealed the decision. On 2 October 2019, the Court of Appeal allowed the appeal in an unanimous judgment. The Court of Appeal found that damages were in principle capable of being awarded for loss of control of data and that claimants were not required to show pecuniary loss or distress. It was found that the High Court had applied the “same interest” test too stringently. The members of the class were all victim of the same alleged wrong, in the same circumstances and in the same period. As a factor in coming to that conclusion, the judges noted that it would be impossible to imagine that a defence could apply to one of the represented claimants that did not apply to all of them. As a result, all represented parties could be said to have the “same interest” and in this situation, damages could be reduced to the “lowest common denominator”. In exercising its discretion, the Court of Appeal saw no reason why each class member could not be identified, and considered it irrelevant that members of the class had not authorised the claim.

The Court of Appeal’s decision opened the door to large opt-out class actions for non-de-minimis data protection breaches without the need to show loss.

The Supreme Court decision

The Supreme Court was tasked with deciding three issues, namely:

  1. Are damages recoverable under the DPA 1998 for loss of control of data, without needing to identify pecuniary loss or distress?
  2. Did the members of the class satisfy the “same interest” test required for a representative action to proceed?
  3. If the “same interest” test is satisfied, should the court exercise its discretion to disallow the representative action from proceeding?

In a unanimous judgment, the Supreme Court unanimously reversed the decision of the Court of Appeal.

The representative action process

Lord Leggatt gave the leading judgment and began by considering the history and scope of the representative action procedure under CPR 19.6, whilst briefly comparing it to other methods of collective redress:

  • GLOs: Lord Leggatt noted these can be an effective way of bringing individual claims together where there are common or related issues of fact or law. However, Lord Leggatt explained that as this is an “opt-in” regime GLOs often suffer from low participation rates. There is also a need to prove quantum of loss in each case, which may make GLOs impractical where individual losses are small.
  • Collective Proceedings Order (CPO) regime: Lord Leggatt highlighted ‘significant’ features of the regime, which allow competition claims to be brought in the Competition Appeal Tribunal on an opt-out basis.

Lord Leggatt observed that the representative action mechanism is a “flexible tool of convenience in the administration of justice” and that it should be “applied to the exigencies of modern life as occasion requires.”

As noted by Lord Leggatt, English courts have traditionally applied the “same interest” test rigorously, particularly in light of the Court of Appeal’s key ruling in Markt & Co v Knight Steamship [1910] 2 KB 1021. Professor Rachael Mulheron, a leading commentator on this topic, has described the Markt judgment in her 2004 book The Class Action in Common Law Legal Systems as requiring “class members to show that issues of fact and law were identical between them.” Given the natural reading of the requirement that there be the “same interest”, it is unsurprising that it has been applied restrictively. This can be contrasted with the commonality test in the CPO regime for competition damages claims. Under that regime, the language of the commonality test is broader, referring to the “same, similar or related issues of fact or law”.

The Supreme Court found that the “same interest” requirement should be interpreted purposively in light of the CPR overriding objective. Put differently, the CPR requires that the “same interest” test be revaluated in a different context to its historical origins. In its judgment, the Supreme Court noted:

“The purpose of requiring the representative to have the “same interest” in the claim as the persons represented is to ensure that the representative can be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all members of the represented class. That plainly is not possible where there is a conflict of interest between class members”.

On this point, the judgment states,

“So long as advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person.”

This is a re-evaluation of the “same interest” test, where the focus is on advancing the interests of class members and avoiding conflicts with less focus on class members and the representative having identical interests. The court should not consider whether the class members meet an abstract threshold of commonality; rather, the test is met by the absence of a conflict of interests (with the Supreme Court noting that the cases Markt and Emerald Supplies Limited v British Airways [2010] EWCA Civ. 1284 are examples of this conflict).

The Supreme Court also considered “cases where there are merely divergent interests”, i.e., where “an issue arises or may well arise in relation to the claims of (or against) some class members but not others.”  Divergent interests are not, “in principle”, a bar to the claim going ahead as a representative action with a single representative claimant. The judgment does not contain any guidance on the dividing line between same interests and diverging interests, but it states that if divergent interests were to present difficulties in meeting the “same interest” test or to render it “otherwise inappropriate” for a single representative to represent the entire class, then provided there was no conflict of interest, “any procedural objection could be overcome by bringing two (or more) representative claims, each with a separate representative claimant or defendant, and combining them in the same action.” Put differently, where there are challenges with meeting the “same interest” test, the court will be open to pragmatic case management solutions.

The judgment noted the following further features of representative actions:

  • No requirement of consent: There is no need for a member of the class to take any positive step to be bound by the result. Although the rule does not confer a right to opt out of the proceedings, a judge managing the case has the option to require the representative to “notify members of the class… and establish a simple procedure for option out of representation”.
  • Class definition: The adequacy of the definition is a matter which goes to the court’s discretion in deciding whether the claim should be allowed to continue, rather than being a precondition for the application of the rule. Nevertheless, it is plainly desirable that the class of persons should be clearly defined.
  • Liability for costs: Class members will not normally be liable to pay any legal costs incurred by the representative. However, that does not prevent the court from ordering a class member to pay or contribute to costs. Nevertheless, Lord Leggatt does point out that it is difficult to envisage circumstances in which that would be just where the class member did not authorise the costs. On the other hand, a commercial litigation funder in unsuccessful proceedings is likely to be ordered to pay the successful party’s costs (at least to the extent of the funding).

Mr Lloyd’s claim

Lord Leggatt saw no legitimate objection to a representative claim establishing whether Google was in breach of the DPA 1998 and by doing so, seeking a declaration that any class member who suffered damage by reason of the breach is entitled to compensation. The claims in this case clearly raise common issues and it is not suggested that there a conflict of interest among class members. It was confirmed that all class members would therefore be considered to have the same interest. However, Mr Lloyd’s claim did not merely seek a declaration on liability (a bifurcated approach, allowing persons to opt-in to subsequent claims seeking damages in reliance on the finding of liability).  Rather, Mr Lloyd brought a claim that sought damages, and this is where it foundered.

To avoid the need for individualised assessment of damages Mr Lloyd argued that damages could be claimed for each class member on a “uniform per capita” basis, by establishing that an individual was entitled to compensation for “loss of control” of data, without the need to prove financial loss or stress. Alternatively, Mr Lloyd argued that class members were entitled to “user damages” in the amount they could reasonably have charged for releasing Google from the duties it had breached.

Mr Lloyd contended the following in his claim for damages:

  1. The word “damage” in s 13(1) of the DPA 1998 not only extends beyond material damage to include distress (which principle was established in Vidal-Hall v Google Inc [2016] QB 1003), but also includes non-trivial breaches of the DPA 1998, namely for “loss of control” of data.
  2. The principles in the case Gulati v MGN [2015] EWHC 1482 (CH), which were applicable to the assessment of damages in the tort of misuse of private information should also apply to s 13(1) of the DPA 1998, as both claims have a “common source” (in seeking to protect the right to privacy guaranteed by Article 8 of the ECHR). Gulati established that claimants could be compensated for misuse of their private information itself because they were deprived of “their right to control [its] use”.

Lord Leggatt rejected these arguments.  In respect of Mr Lloyd’s first argument, the Supreme Court found that it is not enough to simply prove a breach in order to recover compensation under s 13 of the DPA 1998. On a proper interpretation, the term “damage” in s 13 refers to material damage (such as financial loss) or mental distress. This damage must be distinct from, and caused by, unlawful processing of personal data in contravention of the DPA 1998. It cannot be the unlawful processing itself. This conclusion also precluded a claim for “user damages” based on a reasonable release fee for contravention of the right.  The claimant’s “common source” argument also failed, as the Supreme Court found there were significant differences in the scope of the common law tort of misuse of private information and data protection legislation (including the fact that the data protection legislation applied to all “personal data”, with no requirement that the date be of a confidential or private nature, or that there is a reasonable expectation of privacy).

Thus, as a matter of substantive law, damages are not available under s13(1) of the DPA 1998.

Assessing damages

The Supreme Court confirmed that even if Mr Lloyd could pursue a claim for damages based on “loss of control”, his proposed lowest common denominator approach could not be used as it would still be necessary to establish the extent of the unlawful processing in each individual case to ensure that a “de minimis” threshold was met. Google also objected to the lowest common denominator approach, noting that Mr Lloyd did not have authority from class members to waive parts of their damages claims. The Supreme Court opted not to decide this issue, but stated:

“We are prepared to assume… that as a matter of discretion the court could – if satisfied that the persons represented would not be prejudiced and with suitable arrangements in place enabling them to opt out of the proceedings if they chose – allow a representative claim to be pursued for only a part of the compensation that could potentially be claimed by any given individual.”

As a result, Lord Leggatt took the view that, even if the legal foundation for the claim made was sound, he should exercise his discretion conferred by CPR 19.6(2) and refuse to allow the claim to continue. The Court ultimately allowed the appeal and restored the order made by the High Court refusing the claimant’s application for permission to serve outside the jurisdiction.

Comment

The Court of Appeal decision prompted several large claims to be filed, each on behalf of millions of people. The ability to bring representative actions for “loss of control” of data posed a risk to a huge number of businesses across a range of sectors and to public sector bodies. That risk has reduced significantly following the Supreme Court’s ruling.

That said, this is not the end of the representative action mechanism. The judgment has broadened the “same interest” test by endorsing a more flexible approach.   The judgment also confirms that the mechanism can be used to award damages. But that brings challenges; the Court noted that what “limits the scope for claiming damages in representative proceedings is the compensatory principle on which damages for a civil wrong are awarded.”  Significantly, the judgment stated that “there is no reason why damages or other monetary remedies cannot be claimed in a representative action if the elements can be calculated on a basis that is common to all members of the class.”  This means the representative must put forward a class definition and methodology that enables assessment of losses on a compensatory basis. Mr Lloyd was unable to meet this test in the circumstances of his claim, but other claims will attempt to meet this test.

The Court has also indicated that, where the “same interest” test is met, the factors that bear on the court’s discretion as to whether to allow a claim to proceed as a representative action are “likely to militate in favour of allowing a claim, where practicable, to be continued as a representative action”. Together with the Supreme Court’s decision in Merricks v Mastercard [2020] UKSC 51 – which held that the “suitability” requirement for a CPO imposes a low-bar test for whether a collective action would be more appropriate than a collection of individual claims – we now have a clear indication that English courts will be slow to exercise their discretion to preclude opt-out class actions going ahead where they fall within the terms of the relevant procedural mechanism.

Lloyd v Google has been decided against a backdrop of increasing interest from the UK government in introducing further mechanisms for opt-out class actions. The Department for Business, Energy & Industrial Strategy ran (closed October 2021) a consultation titled “Reforming competition and consumer policy” which proposed a new class action device for consumers. The government has yet to state whether it intends to implement such a device. While the Supreme Court judgment avoids the spectre of opt-out class actions for “loss of control” for claims under the DPA 1998 it broadens class action risk in other areas.

 

CMS acted for the 3rd Intervener.