An attempt to bring legal action against Google for its alleged tracking of an estimated 4.4 million iPhone users in 2011 and 2012 has been blocked by the UK High Court (the court).
Campaign group “Google You Owe Us” brought the claim as a representative action on behalf of the affected individuals (the class) in 2017. It is thought to be the UK’s first mass legal action of its kind.
Google You Owe Us argued that Google breached its duty under the Data Protection Act 1998 by circumventing the default settings in Apple Safari, placing cookies on the browser to track user’s movements, and using the collected data to sell advertisements. The decision is still relevant to the Data Protection Act 2018.
In an application for permission to serve the claim on Google in the United States, the High Court was required to determine, amongst other things, whether the claim had a reasonable prospect of success.
Justice Warby acknowledged that Google may have breached its duty. He said: “There is no dispute that it is arguable that Google’s alleged role in the collection, collation and use of data obtained via the Safari Workaround was wrongful, and a breach of duty.”
However, the court could not find in favour of Google You Owe Us because:
(i) Actual damage must be sustained from the breach. Google You Owe Us brought the claim on the basis of loss of control of personal data alone. No financial loss or distress was alleged. The court held that there must be actual damage, such as a material loss, or emotional harm such as distress – without this, there is nothing to compensate.
(ii) To bring a representative action, individuals in the class must have the “same interest” in the claim. In this case, not everybody in the class suffered damage, nor did they all suffer the same damage. Therefore, the class could not have the “same interest” in the claim.
(iii) This was an opt-out-style representative action, which presented the risk of abuse. The number of individuals in the class was unknown, and individuals would be required to come forward to claim compensation at the end of the case. The court found that there was a difficulty in this verification process: “Absent a viable method of identifying and excluding individuals in this category, there is an obvious risk that compensation will go to persons who did not suffer damage on any view.” This is consistent with the UK courts’ general resistance to opt-out representative actions.
Google You Owe Us plans to seek permission to appeal the High Court’s decision.
This case makes clear that any claim for a data privacy breach must be supported by evidence of actual damage; the fact of a breach alone will not suffice. The case also reinforces the fact that representative actions cannot be brought on behalf of unidentified individuals in the UK on an opt-out basis.
Somewhat in contrast to the general trend of tighter regulation and increasing accountability around the handling of personal data, with this decision the High Court has highlighted the limitations around the application of data protection laws, in particular the ability of individuals to seek financial compensation following the misuse of their personal data.