Supreme Court rejects £3bn data claim against Google

The Supreme Court appears to have put the kibosh on a raft of compensation claims in the UK over abuse of data rights after ruling that Google is not liable to pay up for tracking millions of iPhone users without their permission, due to a lack of proof over the damage its actions caused.

Delivering the court’s judgment, which was unanimous, Lord Leggatt insisted that the case could not proceed as former Which? director Richard Lloyd had not provided proof of material or financial damage suffered by the 4 million iPhone represented, nor had he shown how long the tracking had occurred for, the amount of data affected or whether it was sensitive or private information.

Lord Leggatt also found that even if damages were available for loss of control, it would still be necessary to establish the extent of the unlawful processing in the case of each individual, and this would render a representative action unviable.

The ruling is likely to send many class action claims, triggered by the rise of an army of “no win, no fee” compensation lawyers, back to the drawing board as legal firms will now need to have solid proof of the damages that a data breach has caused.

At the last count, class actions are being planned against Experian, Marriott International, Salesforce, Oracle, Facebook, easyJet, and TalkTalk.

David Barker, who led the Pinsent Masons team which acted for Google in this case, said: “Lord Leggatt’s comments on the availability of damages for loss of control may lead to a more general dampening of the claims market in this space, with a greater emphasis on the requirement for data subjects to show material damage or distress on an individualised basis.”

The Google case has been running for nearly four years but actually dates back over a decade, when it is alleged the mass collection of consumers’ personal data first took place.

Lloyd’s lawyers alleged that Google bypassed privacy settings on Apple iPhone handsets between August 2011 and February 2012 and used data to divide people into categories for advertisers.

It was claimed that the information collected included racial or ethnic origin, physical and mental heath, political affiliations or opinions, sexuality and sexual interests and social class.

It was also alleged that information about an individual’s financial situation, shopping habits and their geographical location were obtained and that the data was then aggregated and users were put into groups such as “football lovers” or “current affairs enthusiasts”.

Lloyd first started legal action in November 2017, when Google was summoned to the High Court to answer the charges. His group, Google You Owe Us, was hoping to win at least £750 for each of the 4 million people affected, totalling £3bn in compensation for alleged breaches of the Data Protection Act.

But Google argued that data protection claims for compensation must show proof of damage and that Lloyd’s proposed case should not go ahead.

At a two-day remote hearing in April, the UK’s highest court considered whether the claim should proceed.

The High Court initially ruled that Lloyd could not serve the claim on Google outside the jurisdiction of England and Wales in October 2018, but that decision was overturned by the Court of Appeal in October 2019.

One of the most high profile data breach compensation cases, against British Airways, was settled out of court in July this year when the airline paid out to thousands of customers affected by its 2018 data breach.

The litigation was resolved on confidential terms, following mediation between representatives for affected claimants and BA.