Share it

In this post, Kenny Henderson and Zainab Hodgson of CMS summarise the first day of submissions in the appeal of Lloyd v Google LLC, which concerns a claim alleging that the appellant (‘Google’) breached its duties as a data controller to over 4m Apple iPhone users during a period of some months in 2011- 2012, when Google was able to collect and use their browser generated information.

The first day of the Supreme Court hearing in Google LLC v Lloyd commenced yesterday, with 5 justices of the Supreme Court sitting (remotely).  On day one, counsel for Google LLC (“Google”) gave his submission and counsel for Mr Lloyd (“Lloyd”) began his submissions.  He will complete his submission on day two and the court will also hear oral submission from the Information Commissioner’s Office (“ICO”), one of the interveners.  Google will then deliver its reply.

Google’s submissions: introductory remarks

Antony White QC, on behalf of Google, introduced his submissions by stating that the case concerned important questions of law relating to damages under the Data Protection Act (“DPA”) regime and, further, the availability of the class action procedure under CPR 19.6.  His introduction covered three key points:

  1. Under general law, a claim for breach of a statutory duty is not actionable per se and requires proof of harm.
  1. Lloyd had alleged damage on three bases: (i) the infringement of their data protection rights; (ii) the commission of the wrong; and (iii) the loss of control over personal data. Notably, the Court of Appeal had focused on the third basis of damage.  Google contended that loss of control of personal data does not carry any additional harm and, rather, it is an alternative description  of the infringement of data protection rights.  Google argued that the law of damages does not award damages for a bare infringement of a statutory duty.
  1. Google submitted that the High Court (Warby J), which had dismissed Lloyd’s claim, did not conclude that loss of control could never lead to an award of damages. Instead, Warby J focused on whether the loss of control had harmful consequences for the individual, which Google asserted was the correct focus. Where loss of control results in harmful consequences, Google argued that is when compensation could be awarded.

Following his introduction, Google’s counsel turned to the grounds of appeal.

Google’s submissions on the first ground of appeal

This ground considered whether a uniform per capita amount of compensation can be awarded for “loss of control” for a non-trivial breach of the DPA even if the breach causes no pecuniary loss or distress (the “First Issue”).

The Court of Appeal had ruled that damages could be recovered on this basis and that members of a group could seek to recover the “lowest common denominator” of their harm.  In an early question from the bench, Lord Burrows queried what was meant by the “lowest common denominator”.  Google agreed that there was a triviality (or de minimis) threshold in claims of this type, as did Lloyd, but Google did not accept that the person least affected crosses that threshold. Google queried whether the notion of the lowest common denominator made sense where “loss of control” could have infinite variability amongst the persons affected according to the facts of each case.

Google submitted that the approach of Warby J on the First Issue was preferred for a number of reasons. Firstly, it is consistent with the general rule that breach of a statutory duty is not actionable per se and that proof of harm is required. Secondly, it reflects the clear language of Directive 95/46/EC (the “Directive”) (and its successor the General Data Protection Regulation), which s.13, DPA was designed to implement.  The DPA expressly requires suffering of damage in order for an individual to be entitled to compensation, as reflected in section 13.1 DPA.  The wording of that section requires that an individual “suffers damage” before they are entitled to compensation for that damage. Google submitted that the judge’s construction of section 13.1, DPA was “orthodox and correct”. It was submitted that if all contraventions of the DPA gave rise to an entitlement to compensation, then the words “suffers damage” would be tautologous.

Google contended that the Court of Appeal’s judgment accepted that a domestic approach to statutory construction would support the judge’s conclusion (para 45), but the Court of Appeal suggested that EU law required a different approach to construction without identifying the relevant EU law principle that required such a different construction.  Google argued that the EU law principles of equivalence and effectiveness were mentioned by the Court of Appeal, but those principles are not concerned with interpretation. Google advanced a “mild” complaint that Lloyd had not referred in either court below to those EU law principles, however, arguments relating to those principles came fully formed in the judgment of the Court of Appeal.

Google argued that the remedy of compensation would be disproportionate where no consequential harm results from an infringement. Lady Justice Arden commented that it may not be possible to pull at one strand of the principle of proportionality and she remarked that all the circumstances should be considered, including whether the actions of the data controller were deliberate. Notably, this approach considered the conduct of the defendant rather than the effect on data subjects. Google asserted that the correct response to a deliberate and serious breach, where no harm is suffered, is regulatory action.  Further, the usual remedies where there has been an infringement of rights is a declaration of infringement or an award of nominal damages.

Google submitted that the correct focus must surely be on the seriousness of the harm, as opposed to the seriousness of the breach. By way of analogy, Google observed that in the tort of negligence there is a de minimis threshold or a threshold of seriousness.  Lord Leggatt’s response to that analogy is noteworthy and he highlighted that negligence requires proof of damage and the need to show a certain level of actual damage.

Google’s submissions on the second ground of appeal

The second issue in dispute was the meaning of the “same interest” requirement under CPR 19.6(1) including the test for identification of the class (the “Second Issue”).

Google reviewed the relevant case law on CPR 19.6(1), arguing that the authorities (in particular, Emerald Supplies Ltd v British Airways plc [2011] Ch 345 and Rendlesham Estates plc. v Barr Ltd [2015] 1 WLR 3663) supported its position.  Google submitted that the High Court was right to hold that the action cannot proceed as a representative claim for two reasons.  Firstly, the members of the class do not have the same interest and they have not suffered the same damage.  Secondly, Google may have separate defences as to quantum in respect of the individual claims.  In response to Lord Leggatt’s question as to the policy underling those arguments, Google highlighted that it is important to look at the history of the rule – that the relief must be common to the represented class.

Google observed that the Court of Appeal held that each member of the class had the same interests once the group disavowed individual elements of their claim and reduced the value of their claim to the lowest common denominator. Google raised numerous objections to this part of the Court of Appeal’s  judgment, as follows:

  1. The tactical disavowal of reliance of each individuals’ circumstance does not alter what those circumstances are. The class remains a disparate group ranging from those where breach of the statutory duty had no consequence to where the breach did produce consequences.
  2. The disavowal does not alter the legal nature of the claim advanced by each member of the class, they remain separate claims for damages for breach of statutory duty arising out of their personal situations. Google contended that the “loss of control” was quantitatively and qualitatively different across the class.
  3. It was argued that it is one thing to limit one’s own claim to damages, but altogether another thing to limit claims brought by other people without their consent or knowledge.
  4. The disavowal of individual circumstances could prejudice claimants who have larger claims than those of the lowest common denominator.

Google submitted that the representative action is a new form of an opt out class action which should not be developed by the courts, but rather the development of this type of action should be left to Parliament. Google noted that both EU and domestic legislature are actively considering the appropriate way forward in this connection.

Google’s submissions on the third ground of appeal

 The third issue considered was whether the Court of Appeal was wrong to interfere with the High Court’s exercise of discretion that the claim should not be permitted to proceed.

Google recounted that Warby J had made two findings, first, that the legal approach to the identification of the members of the class must be conceptually sound and workable. Secondly, the judge made an evaluative finding of fact that it was not possible to identify and exclude unaffected members of the class.  Those findings were both overturned by the Court of Appeal, and Google asserted that it was wrong, unjustified and impermissible for the Court of Appeal to interfere with those exercises of discretion by a first instance judge.

Lloyd’s submissions

Hugh Tomlinson QC appeared on behalf of Lloyd.

Lloyd agreed with the Court of Appeal’s decision that the rules were sufficiently adaptable to enable these claims to be brought.  Lloyd submitted that the courts have competence and expertise to make provision for rules that govern collective redress mechanisms and provide access to justice, particularly in circumstances where it would otherwise not be available.

There was some discussion as to whether the class action mechanism could prevent members of the class from claiming above the lowest common denominator award.  Lloyd emphasised that the case concerns mass consumer claims for very modest sums of money and, therefore, the practical likelihood of an individual wanting more than the lowest common denominator award is likely to be rare. Lloyd submitted that the collective redress procedure is one of convenience and was devised to avoid numerous litigants litigating over their separate rights.

Further, Lloyd submitted that a member can apply to be removed from the class.  There was some debate as to whether it would be acceptable to burden an individual’s ordinary rights in that way, and to require individuals to take themselves out of an action of which they want no part.  Moreover, there was some concern as to whether individuals would know of the existence of their rights while the class action was proceeding. Lloyd submitted that it remains possible for individuals to apply to be removed from the class after judgment under CPR 19.6.

Lloyd argued that it is important for all individuals and data subjects to be certain that their personal data is processed in accordance with the rules and not in a manner that is potentially detrimental.  Placing reliance on the arguments of the fourth intervener, Liberty, Coram Children’s Legal Centre & Inclusion London, Lloyd said that this point applies to young children and others who lack the capacity to feel distress from a breach of their personal data. Lloyd also asserted that Google’s construction of section 13, DPA limits the other statutory remedies available including those contained in section 14, DPA.

Later today, the Court will hear the remainder of Lloyd’s submissions and from Counsel for the ICO.