The UK Supreme Court has rejected the notion that every data subjectAn individual who can be identified or is identifiable from data. affected by a ‘non-trivial’ breach of the Data Protection Act 1998 is entitled to an award of compensation for the mere “loss of control” of their personal dataInformation which relates to an identified or identifiable natural person.. The court, instead, confirmed that an award of compensation can be made only if the data subject suffered some form of material damage; for example, tangible financial loss or if they suffered demonstrable distress.
The Supreme Court found that the claim raised against Google was not viable as a representative action for damages. Lloyd, a former executive director at Which?, disavowed the individual circumstances of each of the millions of individuals who he claimed were a part of the represented class. The Supreme Court found that this approach was impermissible in principle. It stated that Lloyd had to show that each of those individuals had both suffered a breach of their rights and suffered damage as a result of that breach. Similar cases have been put on hold as a result of the Supreme Court’s decision; these include cases against Marriott Hotels, Facebook, and TikTok.
The Facts
The case concerned Google’s placing of advertising cookiesData which tracks a visitor’s movement on a website and remembers their behaviour and preferences. on iPhones using Apple’s ‘Safari’ browser in England and Wales between August 2011 and February 2012. Google rolled out their “social ads” on its discontinued Google+ service, claiming that data privacy was protected through the segregation of data. This worked well on other browsers, but this failed on Safari due to its handling of third-party cookies. Google’s workaround was to implement ‘DoubleClick’ advertising cookies, set in a third-party context. Because Safari was unable to use this, at the time, it was claimed that the DoubleClick cookies were set without users’ consentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed..
What’s next?
The judgment was given by Lord Leggatt, and agreed by the other four judges, who made it clear that his analysis relates to the position under the 1998 Data Protection Act – not UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. and the 2018 Data Protection Act. Despite this, the judgment confirms that there are distinct differences between data protection and misuse of private information as causes of action. The decision brings the position firmly in line with the outcome of the Government’s consultation conducted last winter, possibly introducing a bespoke procedureAn approved and established way of completing a certain task. for opt-out class actions in the data protection space.
Although this case was about data protection under the old 1998 Data Protection Act, there may be some key takeaways from this case. This case was to do with representation action, which is an opt-out model, meaning everyone within a class of people is included in the action unless they opt outA positive action to choose not to be part of an activity or to stop being involved in it.. This type of litigation has been allowed in the past and was used in the British Airways case. It also seems that there is a shift to get claimants to go to county courts, rather than the bigger courts, for smaller induvial claims; this often means that the compensation tends to be significantly lower and be more favourable towards the defendants.
As this was decided using the old law, it will be interesting to see if similar reasoning will apply to the UK GDPR. Article 82 makes it clear that there can be ‘material’ or ‘non-material’ damage, and both are entitled to compensation. In addition, Recital 85 makes it clear that ‘loss of control’ is enough to turn an incident into a data breach, which can itself trigger compensation.
You can find out more about the Supreme Court case here, including the full judgement and the videos from the sessions and the judgment summary.