The UK’s Supreme Court has blocked a mass legal action against Google over claims that it secretly tracked millions of iPhone users’ web browsing activity while telling them that it did not.
Richard Lloyd, a former director of the consumer group Which?, wanted to bring a US-style class action lawsuit against the search engine on behalf of about 4.4 million people in England and Wales.
He claimed that Google illegally misused the data of millions of iPhone users by tracking and collating their internet usage on their handsets’ Safari browser in 2011 and 2012, even when users were assured they would be opted out of such tracking by default.
The high court initially ruled that Lloyd could not serve the claim on Google outside the jurisdiction of England and Wales in October 2018 – because Lloyd needed permission to serve it in the US state of Delaware where Google is incorporated – but that decision was overturned by the court of appeal in October 2019.
However, on 10 November a panel of five supreme court justices, in Lloyd v Google, allowed an appeal by Google against that decision.
Giving the lead ruling, Lord Leggatt said Lloyd’s intention that affected iPhone users could be awarded a uniform sum, without having to prove financial loss or mental distress, was “unsustainable”.
Leggatt said the section of the Data Protection Act on which the claim was based referred to material damage and mental distress caused by unlawful processing of data – and not the unlawful processing itself.
A catch-all lawsuit that did not detail each individual’s suffering of material damage or mental distress was therefore unsustainable.
The ruling could have a ‘very significant impact’ for UK firms that handle customer data, say lawyers
Commenting on the judgment, international law firm RPC Partner and head of IP and Tech David Cran said:
“The Supreme Court’s judgment will be warmly welcomed by the insurance market, which following the Court of Appeal’s judgment, was exposed to very significant potential liability arising from data claims, even if no specific damage was shown to have been suffered by any individual.”
“The Supreme Court’s judgment has firmly rejected the basis of this class action and many others that were waiting in the wings: it is likely to have a very significant impact on UK industry across many different sectors that handle customer data, as well as the UK legal market, including claimant firms, litigation funders and After the Event (ATE) insurers.”
RPC Data Disputes partner Rupert Cowper-Coles added:
“Although the Supreme Court has left the door open for representative actions to proceed in relation to claims for breaches of data protection legislation, the rejection of the concept of ‘loss of control’ damages and the requirement that individuals must prove they have suffered damage means that a representative action is unlikely to be a financially viable option for legal advisers and funders in most cases.”
RPC supported its client, techUK, who was an intervening party in the Supreme Court hearing.
In a statement Google said: “This claim was related to events that took place a decade ago and that we addressed at the time. People want to know that they are safe and secure online, which is why for years we’ve focused on building products and infrastructure that respect and protect people’s privacy.”