Google has won an appeal against a class action-style lawsuit which was seeking compensation of up to £3bn for illegal tracking of data subjects. The court’s ruling in Lloyd v Google asserted that damages cannot be claimed on behalf of all data subjects affected by a breach en masse, saying that they will need to be assessed individually to ascertain their fiscal or emotional damages due to the breach. This is likely to benefit Big Tech in the long run, but will also protect smaller businesses against similar claims.
Richard Lloyd, former executive director of consumer watchdog Which? and known privacy advocate, bought the case against Google in 2017, alleging that the tech giant ignored iPhone user privacy settings. Lloyd put it to the courts that between 2011 and 2012 Google applied a Safari workaround to illegally override iPhone privacy settings, allowing Google to track behaviour with the use of tracking cookies. He was seeking compensation on behalf of some four million customers who were breached at that time, maintaining that they had lost control of their data, putting Google in breach of the Data Protection Act 1998 (DPA 1998).
In 2018 Lord Justice Warby ruled that the claim should not “be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated”. The judge presiding over the appeal agreed, meaning that rather than data subjects affected by a breach automatically being opted into a lawsuit of this size, litigators will need to go through each subject individually, to ascertain any losses they suffered.
What does this mean for tech companies?
The ruling will make it more difficult for privacy campaigners to file actions en masse against companies for a single breach, explains Alexander Dittel, data protection partner at the law firm Wedlake Bell. “What it says is that you can’t just turn up to the court and say, ‘Oh, we know there’s been a breach and all these people are likely affected, but we don’t know how each of them individually might have been affected. We don’t even know if they noticed it, yet here we are, and we wish to claim damages’,” he says.
The court has ruled that there needs to be a stronger case on behalf of each claimant. “You have to have your facts and evidence to establish a stronger footing,” says Dittel. “You have to be able to say how those individuals were affected.” Before the ruling in Google’s favour, a data subject would not have to prove their financial or emotional distress in order to claim.
Though the ruling benefits Google, it will also serve to prolong the suit and other similar claims against Big Tech, as privacy campaigners could now potentially go through each affected data subject individually. Several similar cases have been on hold pending today’s ruling.
While winning this appeal will certainly benefit Big Tech, it will also serve to protect SMEs from what has been termed ‘officious litigation’, using the notion of ‘loss of control’ of data as a way of trying to profit from a case regardless of actual damages suffered by users.
Lloyd v Google: the long-term implications
This may lead Big Tech into strange territory, however, as it appears that companies are being given the right to use data as long as the data subjects do not feel they have suffered a loss as a result of its unmitigated use. So if individuals do not understand the value of their data, they may not have cause to make a complaint.
This is something that should be left up to the regulators or the government to straighten out, says Dittel. “[This ruling] does benefit Big Tech,” he says. “This is probably the regulatory environment and legal environment that we currently live in, where technology constantly outpaces the law. And parliaments struggle to react. Ultimately they will react, but it always takes a bit of time.”
