Lloyd v Google: Supreme Court rules in favour of Google

On Wednesday 10th November 2021, the United Kingdom (“UK”) Supreme Court handed down its judgment in the case of Lloyd v Google. The Supreme Court unanimously allowed Google’s appeal and restored the order initially made by the judge in October 2018.  

Background

 In 2017, former Which? Director, Richard Lloyd, brought a representative claim against Google under Rule 19.6 of the Civil Procedure Rules. The lawsuit states that Google illegally gathered the personal data of millions of iPhone users between 2011 – 2012 and used it for targeted advertising. 

It did this, the claim stated, by harvesting personal information – including people’s race, age, sexuality and more – through the Apple web browser: Safari. The company then sold this data to third-party advertisers. 

Lloyd alleged that Google breached its responsibilities as a data controller under section 4 of the Data Protection Act 1998 (“DPA”). He claimed that the company used an illegal workaround to collect individuals’ data – potentially even in instances where third-party cookies were blocked.  

Please read our previous blog on the Lloyd vs Google case for further details on the representative claim and its significance to UK law.  

Timeline of events

• July 2017: Google is formally notified of the claim 
• October 2018: The High Court blocks the case from going any further on the basis that there is no proof that those impacted have suffered any damage as a result of the data sharing, which is required under section 13 of the DPA. The judge also rules that it is difficult to see how the millions of people impacted share the “same interest” requirement for Representative Action under CPR 19.6. 
• September 2019: Lloyd takes the High Court’s decision to the Court of Appeal, and they overturn the ruling. The Court states that damages can be awarded for a loss of control of data under section 13 of the DPA, even if no pecuniary loss has been caused. They also rule that the class members do indeed share the same interest. This means the claim can proceed as a representative action case. 
• March 2020: The Supreme Court grants Google permission to appeal against the Court of Appeal’s decision. Google argues data protection claims need to show proof of damage as its rebuttal. 
• April 2021: The appeal is heard in the Supreme Court. 
• November 2021: The Supreme Court rules unanimously allows Google’s appeal. 

Commentary on the decision

This decision was one of the most eagerly awaited in recent years. Had Lloyd won the appeal, then an increase in US-style class-action lawsuits for data protection claims was to be expected. This type of litigation has struggled to blossom in the UK due to the complexity of organising Group Litigation Orders (“GLO”). However, in this instance, Google’s appeal won the day, meaning that such class action claims will likely become less attractive.  

The Court’s reason for the judgement is multi-fold, as shown in the Supreme Court’s Press Summary. There are (and will soon be) lots of detailed analysis online (including webinars) on the case from law firms and others so we won’t go into detail here, beyond a brief summary of the key findings.  

Firstly, the Court rejected Lloyd’s request that a uniform sum of damages is awarded to each member of the represented class. The Court expressed that this was unsustainable as each individual would have to demonstrate the losses or damages they suffered or the extent of the unlawful processing. Indeed, to assess compensation, the Court would have needed to consider factors such as how long Google tracked individuals for, the nature of the lost data, and how that data was used. Due to the absence of this evidence, the Court ruled the individuals are not entitled to compensation. 

Secondly, the court had an issue with the “loss of control” concept put forward by Lloyd. As the court said in its judgement: “Loss of control is not an expression used in the DPA 1998” and “…none of the requirements of the Act is predicated on “control” over personal data by the data subject”.  

Instead, the court focused on the wording at section 13 of the DPA which states that “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”. The court interpreted this wording as meaning material damage (such as financial loss) or mental distress arising from the unlawful processing, rather than the act of unlawful processing in and of itself.  

Through this judgement, the UK Supreme Court has set a precedent for data protection claimants: individuals are entitled to compensation for violations of the DPA only if they can demonstrate they have suffered material damage or distress. The ruling can be seen as a victory for Google and will be a relief for controllers, but it is not without its controversy. The Open Rights Group has already published an open letter criticising the decision – and we can expect to see similar commentary from consumer privacy bodies in the coming days.  

Need help?

If you need assistance with data protection compliance, we can help. evalian® is a specialist data protection services provider, working with organisations of all sizes. Please contact us for more information.