Google has won an appeal against a class action-style lawsuit which was seeking compensation of up to £3bn for illegal tracking of data subjects. The court’s ruling in Lloyd v Google asserted that damages cannot be claimed on behalf of all data subjects affected by a breach en masse, saying that they will need to be assessed individually to ascertain their fiscal or emotional damages due to the breach. This is likely to benefit Big Tech in the long run, but will also protect smaller businesses against similar claims.
Richard Lloyd, former executive director of consumer watchdog Which? and known privacy advocate, bought the case against Google in 2017, alleging that the tech giant ignored iPhone user privacy settings. Lloyd put it to the courts that between 2011 and 2012 Google applied a Safari workaround to illegally override iPhone privacy settings, allowing Google to track behaviour with the use of tracking cookies. He was seeking compensation on behalf of some four million customers who were breached at that time, maintaining that they had lost control of their data, putting Google in breach of the Data Protection Act 1998 (DPA 1998).
In 2018 Lord Justice Warby ruled that the claim should not “be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated”. The judge presiding over the appeal agreed, meaning that rather than data subjects affected by a breach automatically being opted into a lawsuit of this size, litigators will need to go through each subject individually, to ascertain any losses they suffered.
What does this mean for tech companies?
The ruling will make it more difficult for privacy campaigners to file actions en masse against companies for a single breach, explains Alexander Dittel, data protection partner at the law firm Wedlake Bell. “What it says is that you can’t just turn up to the court and say, ‘Oh, we know there’s been a breach and all these people are likely affected, but we don’t know how each of them individually might have been affected. We don’t even know if they noticed it, yet here we are, and we wish to claim damages’,” he says.