The Supreme Court has today allowed Google's appeal against a Court of Appeal's decision ( EWCA Civ 1599) to permit the former CEO of Which? to bring a class action worth an estimated £3 billion against Google on behalf of four million iPhone users whose phones were tracked without their knowledge in late 2011 and early 2012 in breach of s4(4) of the Data Protection Act 1998.
For several months in late 2011 and early 2012, Google secretly tracked the internet activity of millions of Apple iPhone users without their knowledge or consent and used the data for commercial purposes. The search engine giant paid a penalty of $22.5 million to the US Federal Trade Commission in 2012 and a class action settlement of $17million to US based iPhone users in 2013. In the UK case of Vidal-Hall v Google Inc  EWCA Civ 311, three litigants received an undisclosed sum of damages by way of settlement.
Mr Richard Llloyd, who was formerly the CEO of the consumer magazine Which?, decided to bring a class action suit in respect of Google's tracking activity on behalf of UK iphone users. Mr Lloyd obtained financial backing from Therium Litigation Funding IC and commenced a claim against Google LLC alleging breach of its duties as a data controller under s4(4) of the Data Protection Act 1998 ("DPA 1998"). In his letter of claim Mr Lloyd proposed damages of £750 per iPhone user totalling £3 billion. As Google is a Delaware, USA based corporation, Mr Lloyd needed permission of the court to serve proceedings on Google outside of the jurisidiction. Google sought to resist this application on two grounds:
- Damages cannot be awarded under DPA 1998 for loss of control of data without proof of financial damage or distress; and
- The event is not suitable to proceed as a representative action.
Google were successful in the High Court  EWHC 2599 (QB), where Warby J refused permission to serve proceedings outside the jurisdiction. The Court of Appeal then unanimously overturned the High Court decision  EWCA Civ 1599. Google then appealed to the Supreme Court, who upheld their appeal.
Although lengthy, the Supreme Court decision essentially turns on two points:
- the limited basis upon which a class action can be brought within England and Wales; and
- the necessity of showing unlawful use of personal data and that an individual suffered damage as a result.
As Lord Leggatt held:
In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result. The claimant’s attempt to recover compensation under the Act without proving either matter in any individual case is therefore doomed to fail."
KEVIN HOLDER © 2021
33@ 33 BEDFORD ROW
NOTICE: This article is provided free of charge for information purposes only; it does not constitute legal advice and should not be relied on as such. No responsibility for the accuracy and/or correctness of the information and commentary set out in the article, or for any consequences of relying on it, is assumed or accepted by any member of Chambers or by Chambers as a whole.