iPhone users, the Data Protection Act and UK Class Actions

A recent case concerning Google’s use of cookies has had important implications for the development of UK class actions in privacy cases. This case will be of particular importance to those whose work involves processing and retaining clients’ personal data or private information. Most importantly, the final decision of this case has recognised the right to claim damages in the event of a loss of control of data, even where there has been no distress of monetary loss.

 

The case

The case of Lloyd v Google follows a representative claim brought about by Mr Richard Lloyd, a former director of Which?, on behalf of himself and four million iPhone users - all of whom were allegedly affected by Google’s use of ‘cookies’ between 9 August 2011 and 15 February 2012.

Lloyd claimed that Google’s processing of personal data was in breach of the statutory duty imposed by section 4(4) of the Data Protection Act. In reliance on the supposed breach by Google, the claim was framed as one seeking damages for all concerned under s13(1) of the DPA, which states that “An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.”

 

The Safari Workaround

So how did Google manage to obtain personal data? It is alleged that Google was able to place a cookie of its own on iPhone devices without the knowledge or consent of the user. It was able to do this by taking advantage of a relaxed default setting on the Safari web browser - known as the ‘Safari Workaround’. The system was eventually changed by Apple, but up until this point it is alleged that Google collected a wide range of data on its users, including the order and frequency that they visited different websites.

Mr Lloyd’s argument was that by collating and tracking this information, Google had been allowed to obtain information not just about users’ internet usage, but also their interests, ethnicity or race, political and religious views, social class, gender, sexuality or even financial position. With this information in their possession, Google allegedly arranged the data into groups that they then offered to subscribing advertisers - which allowed these advertisers to target specific groups with their advertising.

 

The Decision

Initially, the Court dismissed Lloyd’s case against Google on the basis that:

  • None of the class he represented suffered damage within the meaning of s13 of the DPA, failing to prove financial loss or distress; and
  • The members of the class did not have the same interest needed to form a class under Civil Procedure Rule 19.6 and were not identifiable.

 

The Appeal

The Court of Appeal was asked to consider the original decision to dismiss Lloyd’s action, and decided to reverse it in respect of both issues. On the issue of damages, the Court of Appeal ruled that financial loss or distress did not need to be demonstrated because the individuals’ data did have an intrinsic value.

The first instance decision on the necessary ‘same interest’ was also overruled. The Court of Appeal held that all the members of this class had their information taken without their consent, with such information being extracted over the same period and by the same method.