Google defeats Lloyd’s claim - but Supreme Court breathes new life into class action mechanism

Summary

In a highly anticipated judgment, the UK Supreme Court today put an end to a class action against Google seeking damages allegedly in the region of £3 billion.

The judgment has wide significance. Importantly, it provides that damages cannot be sought for “loss of control” of data following breaches of the Data Protection Act 1998 (DPA 1998). This avoids a “floodgates” situation, where data controllers could face opt-out class actions for breaches of data protection law without proof of loss. That said, the judgment expands the circumstances in which the representative action device in rule 19.6 of the Civil Procedure Rules (CPR) can be used. Claimants and litigation funders will continue to explore the use of the representative action mechanism, particularly in circumstances where there is a method to demonstrate sufficient homogeneity of individual losses amongst class members.

The full judgment is available here.

Background

Lloyd sought damages for “loss of control” of data without proof of financial loss or distress pursuant to section 13 of the DPA. He alleged that Google breached its duties as a data controller during a period of several months in late 2011 to early 2012. He sued on his own behalf and on behalf of over 4 million mobile phone users resident in England and Wales at the relevant time using the representative action mechanism.

Lloyd alleged that Google used a browser cookie which could be activated on certain mobile phones without users’ knowledge or consent when they visited certain websites. Google allegedly used the cookie to collect information about users’ internet activity for use when selling advertising, so that subscribing advertisers could target their advertisements to particular demographics.

Google resisted the claim in the context of Lloyd’s application for permission to serve the claim on Google in the United States. At first instance, the High Court held in favour of Google (see our previous Law-Now). The Court of Appeal ruled in favour of Lloyd in October 2019 (see our further Law-Now). Google appealed to the Supreme Court, and the appeal was heard over two days in April 2021. Five parties intervened, including the Information Commissioner. The Supreme Court’s judgment was unanimous.

Below we discuss the key data protection law issues before analysing the Supreme Court’s findings on the use of the representative action device. The court’s judgment concerns the DPA 1998, but much of the analysis would similarly apply in relation to claims brought under the Data Protection Act 2018 (DPA 2018), which implements the General Data Protection Regulation (GDPR).

Compensation under the DPA 1998

Lloyd sought compensation on behalf of himself and the class members pursuant to section 13 of the DPA 1998, which provided (emphasis added):

“(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if -

(a) the individual also suffers damage by reason of the contravention, or

(b) the contravention relates to the processing of personal data for the special purposes.”

Lloyd contended that data subjects are entitled to damages for “loss of control” of their data where there has been a non-trivial breach of the DPA 1998. He said this was the case on the wording of the DPA 1998 and also because it is established law that damages are available for “loss of control” under the common law tort of misuse of personal information (MPI) (Gulati v MGN Limited [2015] EWCA Civ 1291). He argued that, because the DPA 1998 and the tort of MPI both had a “common source” –the right to the protection of personal data under Article 8 of the EU Charter – there must also be a right to damages for “loss of control” in claims for breach of the DPA 1998. The Information Commissioner also contended that damages should be available for “loss of control” of data.

In setting the context for its analysis that followed, the Supreme Court noted that “none of the requirements of the DPA 1998 are predicated on ‘control’ over personal data by the data subject.” The court went on to reject each of Lloyd’s arguments. On the language of section 13 of the DPA 1998, the judgment notes that the DPA 1998 makes a “distinction between ‘damage’ suffered by an individual and a ‘contravention’ of the DPA 1998 by a data controller, and provides a right to compensation ‘for that damage’ only if the ‘damage’ occurs ‘by reason of’ the contravention.” Lloyd’s interpretation that “damage and the contravention are one and the same” was rejected. The court also rejected Lloyd’s common source argument, noting that MPI was an English domestic tort, and there was no reason why the law on damages recoverable for that tort should inform the “proper interpretation of the term ‘damage’ in a statutory provision intended to implement a European directive.”

The judgment also considered the availability of “user damages”. These are compensatory damages awarded where one party has made wrongful use of another party’s property and where losses are assessed on the basis of what a reasonable person would have paid for the right of use via a hypothetical negotiation. User damages are available for the tort of MPI, but the Supreme Court noted that section 13 of the DPA only permitted compensation for non-trivial damage and for distress.

Representative actions: the “same interest” test

The finding that damages were not available for “loss of control” was fatal to Lloyd’s case, but the judgment makes a number of important findings on the representative action mechanism and the circumstances in which its use is permitted. Those sections of the judgment deserve close scrutiny.

An opt-out mechanism

CPR 19.6 allows a representative to sue on behalf of a class of others where they have the “same interest” in the claim. The “same interest” (a commonality requirement) is the only test that must be met for a class action using the representative action mechanism, although the court will also exercise its discretion in deciding whether a claim that meets the test should be permitted to proceed. A judgment in a representative action binds all class members unless the court orders otherwise. The rule does not explicitly include an option for class members to “opt out” of the claim and so avoid being bound by a judgment, but in its ruling, the Supreme Court confirmed that as part of its case management powers the court can require the representative to “notify members of the class… and establish a simple procedure for opting out of representation”.

A re-evaluation of the “same interest” rule

English courts have traditionally applied the “same interest” test rigorously, particularly in light of the Court of Appeal’s ruling in Markt & Co v Knight Steamship [1910] 2 KB 1021. Professor Rachael Mulheron, a leading commentator on this topic, has described the Markt judgment in her 2004 book The Class Action in Common Law Legal Systems as requiring “class members to show that issues of fact and law were identical between them.” Given the natural reading of the requirement that there be the “same interest”, it is unsurprising that it has been applied restrictively. This can be contrasted with the commonality test in the UK’s Collective Proceedings Order regime for competition damages claims. Under that regime, the language of the commonality test is broader, referring to the “same, similar or related issues of fact or law”.

In its judgment in Lloyd v Google, the Supreme Court noted:

“The purpose of requiring the representative to have the “same interest” in the claim as the persons represented is to ensure that the representative can be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all members of the represented class. That plainly is not possible where there is a conflict of interest between class members”.

On this point, the judgment states,

“So long as advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person.”

This is a re-evaluation of the “same interest” test such that it does not require that class members and the representative have identical interests. The court should not consider whether the class members meet an abstract threshold of commonality; rather, the test is met by the absence of a conflict of interests.

The judgment also considered “cases where there are merely divergent interests”, i.e., where “an issue arises or may well arise in relation to the claims of (or against) some class members but not others.” Divergent interests are not, “in principle”, a bar to the claim going ahead as a representative action with a single representative claimant. The judgment does not contain any guidance on the dividing line between same interests and diverging interests, but it states that if divergent interests were to present difficulties in meeting the “same interest” test or to render it “otherwise inappropriate” for a single representative to represent the entire class, then provided there was no conflict of interest, “any procedural objection could be overcome by bringing two (or more) representative claims, each with a separate representative claimant or defendant, and combining them in the same action.”

Claims for damages

It has long been recognised that the representative action mechanism can be used to resolve issues of liability. The judgment confirms that it can be used to award damages. But that brings challenges; the court noted that what “limits the scope for claiming damages in representative proceedings is the compensatory principle on which damages for a civil wrong are awarded.”

The UK’s Collective Proceedings Order regime specifically permits awards of aggregate damages, i.e. “damages made by the Tribunal in collective proceedings without undertaking an assessment of the amount of damages recoverable in respect of each represented person” (Competition Appeal Tribunal Rules 2015, Rule 73). Indeed, in Merricks v Mastercard [2020] UKSC 51, the Supreme Court stated that “a central purpose of the power to award aggregate damages in collective proceedings is to avoid the need for individual assessment of loss.”

By contrast, in Lloyd v Google, the court confirmed that aggregate damages are not available for claims brought using the representative action mechanism, but “there is no reason why damages or other monetary remedies cannot be claimed in a representative action if the elements can be calculated on a basis that is common to all members of the class.” This means the representative must put forward a class definition and methodology that enables assessment of losses on a compensatory basis.

Lloyd anticipated these challenges and sought to address them, first, by claiming damages for “loss of control” of data and, second, by disavowing any damages above a “lowest common denominator” such that a uniform (likely low) sum could be claimed on behalf of each class member, applying compensatory principles despite the fact that different class members would have been affected differently by the use of the browser cookie. As to the former issue, and as set out above, the court found that damages were not available for “loss of control” of data. As to the latter, Google objected to the lowest common denominator approach, noting that Lloyd did not have authority from class members to waive parts of their damages claims. The Supreme Court opted not to decide this issue, but stated:

“We are prepared to assume… that as a matter of discretion the court could – if satisfied that the persons represented would not be prejudiced and with suitable arrangements in place enabling them to opt out of the proceedings if they chose – allow a representative claim to be pursued for only a part of the compensation that could potentially be claimed by any given individual.”

This signals that the representative action mechanism can potentially be used even if claimants’ individual losses differ.

The importance of proper pleadings

The court also closely examined how Lloyd had defined the class and the facts as pleaded. Claimants face a tension; they will seek to avoid framing a claim as one which turns on the proof of any facts specific to an individual member of the class, yet they need to plead facts that entitle them to compensation. The court found that, even if damages were available for “loss of control” of data, the manner in which the common facts had been pleaded meant that certain class members would have suffered only trivial harm, below the de minimis threshold of a data protection claim. In reviewing the pleaded facts and class definition, the Supreme Court noted,

“the question that must be asked is whether membership of the represented class is sufficient by itself to entitle an individual to compensation, without proof of any further facts particular to that individual.”

The de minimis threshold is a feature of data protection claims and so is unlikely to present such a challenge to claimants bringing other causes of action.

Implications

“Floodgates” is an overused term, but perhaps merited in this context. The Court of Appeal ruling in favour of Lloyd prompted a number of extremely large claims to be filed, each on behalf of classes of millions of people. The ability to bring representative actions for “loss of control” of data posed a risk to a huge number of businesses across a range of sectors and also to public sector bodies. That risk has reduced significantly following the Supreme Court’s ruling.

That said, this is not the end of the representative action mechanism. The judgment has broadened the “same interest” test by endorsing a more flexible approach. Claimants and litigation funders will now look for scenarios where they can set out methodologies for calculating compensatory damages on a basis that is common to all members of the class.

The court has also indicated that, where the “same interest” test is met, the factors that bear on the court’s discretion as to whether to allow a claim to proceed as a representative action are “likely to militate in favour of allowing a claim, where practicable, to be continued as a representative action”. Together with the Supreme Court’s decision in Merricks v Mastercard [2020] UKSC 51 – which held that the “suitability” requirement for a Collective Proceedings Order imposes a low-bar test of whether a collective proceeding would be more appropriate than many individual claims – we now have a clear indication that English courts will be slow to exercise their discretion to preclude opt-out class actions going ahead where they fall within the terms of the relevant procedural mechanism.

Lloyd v Google has been decided against a backdrop of increasing interest from the UK government in introducing further mechanisms for opt-out class actions. The Department for Business, Energy & Industrial Strategy is currently running a consultation titled “Reforming competition and consumer policy” which proposes a new class action device for consumers. The government has yet to state whether or not it intends to implement such a device. Following a separate consultation in late 2020, the Department for Digital, Culture, Media and Sport decided not to implement an opt-out regime whereby non-profit organisations could lodge complaints and bring court proceedings for compensation under the DPA 2018 on behalf of data subjects. The government made this decision on the basis that “there are mechanisms elsewhere in the law which allow collection action proceedings against data controllers for breaches of data protection legislation” and referred expressly to the Court of Appeal’s decision in Lloyd v Google as a relevant consideration. Given the reversal of the Court of Appeal’s decision, the government may re-evaluate its position.

Google and other corporates facing very large class actions seeking damages for “loss of control” of data will breathe a sigh of relief in light of the Supreme Court’s judgment. That reprieve may be temporary.

CMS acted for the 3rd Intervener.