Supreme Court finds claim for compensation under data protection legislation cannot proceed on "opt-out basis" in high profile Lloyd v Google case

In its judgment this morning the Supreme Court has overturned the Court of Appeal's decision in the high profile Lloyd v Google case, which would have opened the floodgates for class actions for compensation for loss of control of personal data to be brought on behalf of very large numbers of individuals without identifying class members: Lloyd v Google LLC [2021] UKSC 50.

In its unanimous judgment, the Supreme Court found that:

• A claim for damages for the unlawful processing of data under the Data Protection Act 1998 (DPA) required proof of damage in the form of either material damage (such as financial loss) or mental distress. Such damage must be distinct from, and caused by, the unlawful processing. It could not be the unlawful processing itself.
• In any event, to determine the quantum of any damages, the court would need to consider the extent of the unlawful processing in the individual case, including for example the relevant time period and the quantity and nature of the data processed. Without evidence as to individual circumstances, it would be impossible to conclude that the damage was more than trivial, and therefore there would be no right to compensation.

For these reasons, the current attempt to bring an action for compensation on behalf of all those whose data was processed, without reliance on any individual circumstances of class members, was doomed to fail.

The lack of reliance on individual circumstances was because of the claimant's desire to bring the claim using the representative action procedure under CPR 19.6. This allows an action to proceed on an "opt-out" basis, meaning that individual class members do not need to be identified, but those represented must share the "same interest" in the claim. The Supreme Court's decision shows that it will not be possible to use this procedure to bring a data breach class action under section 13 DPA and obtain damages for the class as a whole on a uniform or tariff basis, without proof of individual circumstances.

Importantly, however, the decision suggests that such claims could be brought using a "bifurcated process" in which the representative action procedure is used to determine common issues (such as whether there has been an actionable breach), leaving any individual issues to be dealt with subsequently. That could, in effect, introduce a half-way house between a fully "opt-out" claim and an "opt-in" procedure such as the Group Litigation Order, since individual claimants would (presumably) only have to be identified once the common issues had been determined. (Indeed the Supreme Court went so far as to comment that the initial "opt-out" representative claim would be sufficient to stop the limitation period running for subsequent members of the class bringing individual or group damages claims.) The question for claimants, and their funders, will be whether it is economically viable for claims to be brought on that basis.

The potential significance of a contrary finding by the Supreme Court, allowing such claims to proceed on a fully opt-out basis, is demonstrated by the facts of this case. The Supreme Court noted that, while the amount of damages recoverable per person would have been a matter for argument, the figure of £750 advanced by the claimant would have produced a damages award in the order of £3 billion, based on the purported represented class of 4 million people. Clearly, even a much lower damages figure would have resulted in a significant overall award.

The present case was brought under the Data Protection Act 1998 (DPA), rather than the GDPR which superseded it (and which has been incorporated into UK law post-Brexit). Whilst there may be read across to the current UK GDPR regime, Lord Leggatt specifically stated that he was not considering the later legislation (ie the GDPR) and this could potentially leave the door open for future loss of control claims under the GDPR. The compensation regime under that legislation expressly refers to compensation being available in relation not only to material damages but also "non-material damages". Further, the recitals specifically reference loss of control over personal data as an example of possible damage resulting from a personal data breach. As this language was not considered in the Supreme Court's judgment, this could be a battle ground for future claims.

Clients and contacts of Herbert Smith Freehills are invited to join us for two webinars in which our experts on privacy, data security, litigation, class actions and insurance will discuss the judgment and what it means for commercial parties: the first at 4pm this afternoon (10 November) to give a first response to the decision and take questions; and the second at 9am next Wednesday (17 November) to pick up on the broader impacts of the judgment.

Background

The claim was brought by Richard Lloyd, a former executive director of the UK Consumers’ Association, purportedly using the representative action procedure under CPR 19.6. This allows a claim to be brought by (or against) one or more persons as representatives of any others who have the “same interest” in the claim.

The claimant sought to bring the claim on behalf of a class of more than four million UK-resident iPhone users, alleging that some of their internet activity was secretly tracked by the defendant, for commercial purposes, in 2011/2012.

The claim relied on section 13(1) of the DPA, which provides a right of compensation where an individual "suffers damage by reason of any contravention by a data controller of any of the requirements of this Act” and was the law applicable at the time of the alleged breach (having since been replaced by the GDPR and the Data Protection Act 2018).

In bringing the action, the claimant disavowed any reliance on the individual circumstances of class members, arguing instead that damages could be awarded on the basis of an equal, standard “tariff” award for each class member, to reflect the infringement of their rights and their loss of control over their personal data. In the alternative, there was a claim for user damages, based on the hypothetical fee class members could have charged for allowing the use of their data.

High Court judgment

The High Court (Warby J) refused to allow the action to proceed as a representative action under CPR 19.6, finding that:

1. A claim for compensation under the DPA requires proof of damage and, in the present case, the claimant had failed to identify any harm caused as a result of the alleged breach. Compensation could not be awarded merely for the fact of the infringement and associated loss of control over the personal data, and the alternative claim for user damages was barred by authority.
2. The “same interest” requirement under CPR 19.6 was not met as, even if the judge was wrong about what amounted to damage for the purposes of section 13(1), the amount of compensation would still depend on the facts, as neither the breach of duty nor the impact of it would be uniform across the entire class membership.
3. In any event, the judge would have exercised his discretion to refuse to allow the claim to proceed under CPR 19.6, taking into account various factors including: the likely costs; the fact that the compensation recoverable by each class member would be “modest at best”; that the main beneficiaries of any award would be the funders and lawyers; the inability to identify class members (because, in his view, the class definition was not workable); and the fact that class members had not authorised the claim.

Court of Appeal judgment

The Court of Appeal overturned the High Court’s decision (the Chancellor, Sir Geoffrey Vos, giving the leading judgment, with which Davis LJ and The President of the Queen’s Bench Division agreed). See our blog post on that decision here.

It found that damages are in principle capable of being awarded for loss of control of data, even if there is no pecuniary loss and no distress - subject to a threshold for a trivial or de minimis infringement.

It further held that the judge had applied too stringent a test of “same interest” for the purposes of CPR 19.6, partly because of his determination of the meaning of damage under section 13. The represented class were all victims of the same alleged wrong, and had all sustained the same loss, namely loss of control over their personal data, and they were not seeking to rely on any individual personal circumstances. While this meant that any damages would be reduced to “what may be described as the lowest common denominator”, the result was that it was impossible to imagine that a defence could apply to one represented claimant that did not apply to all others. In the Court of Appeal's judgment, therefore, the represented parties did have the same interest in the relevant sense.

As for the judge's exercise of discretion, the Court of Appeal considered that the judge had taken into account two irrelevant factors: (i) the inability to identify the members of the class (whereas the Court of Appeal saw no reason why each class member could not be identified) and (ii) the fact that the members of the class had not authorised the claim. It was therefore open to the court to exercise the discretion afresh. It concluded that the representative action should be allowed to proceed, including because it was in practice the only way in which the claims could be pursued.

The defendant appealed to the Supreme Court.

Decision

The Supreme Court has unanimously allowed the appeal (Lord Leggatt giving the judgment with which Lord Reed, Lady Arden, Lord Sales and Lord Burrows agreed).

The representative action procedure

In giving his judgment, Lord Leggatt analysed the history and scope of the representative procedure under CPR 19.6, briefly comparing it to the two other methods of claiming collective redress currently available in English procedural law:

• First, the Group Litigation Order, or GLO, which he said can be an effective way of enabling large numbers of claims to be litigated and managed together, where they are of sufficiently high value. However, he noted that the fact it is an "opt-in" regime, where claimants must take active steps to join the group, means that it is not economic for claims "which individually are only worth a few hundred pounds", as the initial costs may easily exceed the potential value of the claim and because such actions often suffer from low participation rates.
• Second, the collective proceedings regime for competition claims in the Competition Appeal Tribunal (CAT), subject to certification by the CAT as satisfying relevant criteria set out in statute. He noted that this procedure offers significant advantages for claimants, particularly where many people have been affected but the value of individual claims is small. This is because proceedings may be brought on an "opt-out" basis in appropriate cases, and the regime enables liability to be established and damages recovered on an aggregate basis, without proving individual losses by class members.

Lord Leggatt noted that the representative action procedure is of very long standing, having its origins in the procedure of the Court of Chancery before the Judicature Act of 1873. Having considered the relevant case law in detail, Lord Leggatt noted that Lord Macnaghten’s classic statement in Duke of Bedford v Ellis [1901] AC 1, that a representative suit was in order where there was a "common interest and a common grievance" and relief "beneficial to all", had sometimes been treated as if it imposed a tripartite test. Such a rigid approach was, he said, misguided. Lord Leggatt highlighted cases from the past in which representative claims had been successfully brought in relation to issues of liability only, which he said was important in demonstrating the potential for a bifurcated process, with individual (or presumably group) claims for redress following the initial representative claim (as referred to below).

The "same interest” requirement should, instead, be interpreted purposively in light of the overriding objective of the civil procedure rules and the rationale for the representative procedure, namely to ensure that the representative can be relied on to bring the litigation which will effectively promote and protect the interests of all class members, since they all have the "same interest".

Lord Leggatt noted four further features of the representative action procedure:

1. No requirement of consent: There is ordinarily no need for class members to take any positive step, or even to be aware of the existence of the action, in order to be bound by the result. It is, however, always open to the judge managing the case to impose a requirement to notify class members of the proceedings and establish a simple procedure for opting out, or even to limit the represented class to those who have positively opted into the litigation.
2. The class definition: While it is plainly desirable that the class of persons represented should be clearly defined, and membership of the class should not depend on the outcome of the litigation, the adequacy of the definition goes to the court’s discretion in deciding whether to allow the claim to be continued on a representative basis. It is not a precondition for the application of the rule.
3. Liability for costs: Class members are not ordinarily liable to pay any costs incurred by the representative in pursuing (or defending) the claim. That does not prevent the court making an order requiring class members to make such a contribution but, Lord Leggatt said, it is difficult to envisage circumstances in which that would be just where the represented person did not authorise the costs. In contrast, a commercial litigation funder who finances unsuccessful proceedings is likely to be ordered to pay the successful party’s costs, at least to the extent of the funding, just as in other types of proceedings.
4. The scope for claiming damages: The fact that the relief claimed includes damages is not a bar to a representative claim. However, the aim of damages is to put the claimant - as an individual - in the same position as if the wrong had not occurred. This ordinarily requires an individualised assessment, which cannot fairly or effectively be carried out without their presence in the proceedings, and so a representative action would not be suitable in such cases. (While it was not an approach adopted by the claimant in this case, Lord Leggatt noted that where loss suffered by the class as a whole can be calculated on a global basis - known as a "top down" approach - no individualised loss assessment would be required.) Lord Leggatt commented that there may be advantages, where individualised assessment is needed, in adopting a "bifurcated process" in which common issues of law or fact are decided through a representative claim, leaving any issues which require individual determination - whether they relate to liability or the amount of damages - to be dealt with subsequently.

In the present case, Lord Leggatt said that a representative claim could have been brought to establish whether the defendant was in breach of the DPA, as a basis for pursuing individual claims for compensation. However, the claimant had not proposed such a bifurcated process, doubtless (Lord Leggatt said) because the first, representative stage would not generate any financial return for the claimant's funder, and pursuing separate damages claims on behalf of individual class members would not be economically viable.

The claim for damages on a uniform basis / compensation for loss of control under the DPA

As noted above, the claimant argued that a uniform sum of damages could be awarded to each class member, on a tariff basis, without the need to prove any facts particular to that individual. This was on the basis that compensation could be awarded under the DPA for “loss of control” of personal data constituted by any non-trivial contravention of any of the requirements of the DPA. Alternatively, the claimant argued that class members were entitled to "user damages" in the amount they could reasonably have charged for releasing the defendant from the duties it had breached.

Lord Leggatt concluded that these claims could not succeed:

1. To recover compensation under section 13 of the DPA, it is not enough to prove a breach. There must be some "damage" suffered as a consequence of that breach. On a proper interpretation (compatibly with article 23 of the Data Protection Directive), the term "damage" in section 13 refers to material damage (such as financial loss) or mental distress. This damage must be distinct from, and caused by, unlawful processing of personal data in contravention of the DPA. It cannot be the unlawful processing itself. This conclusion also precluded a claim for "user damages" based on a reasonable release fee for contravention of the right.
2. In any event, even if (contrary to Lord Leggatt's conclusion) it were unnecessary to show that an individual had suffered material damage or distress as a result of the unlawful processing, it would still be necessary to establish the extent of the unlawful processing in the individual case. In deciding what amount of damages, if any, should be awarded, relevant factors would include: over what period of time the browsing history was tracked; what quantity of data was unlawfully processed; whether any of the information was of a sensitive or private nature; what use was made of the information; and what commercial benefit, if any, obtained from such use. The generic facts alleged by the claimant in this case could not establish that any individual class member was entitled to compensation, given that (as the claimant accepted) there is a threshold of seriousness that must be crossed before there is an entitlement to compensation under the DPA. In other words, if limited to the "lowest common denominator", it was impossible to characterise the damage as more than trivial.

The attempt to recover damages without proving either of the above was therefore unsustainable.