UKSC - Richard Lloyd v Google LLC (2021) UKSC 50: Difference between revisions
From GDPRhub
| Line 98: | Line 98: | ||
Following an analysis of ''Vidal-Hall v Google Inc'' (discussing Section 13 DPA 1998) and ''Gulati v MGN Ltd'' (discussing tort for misuse of private information) the court outlined that it would be possible for Lloyd to claim (1) damages under Section 13(1) DPA 1998 for distress suffered due to Google’s infringement of the Act; (2) and /or damages for the misuse of private information without the need to show material damage or distress. However, the court outlined that the case was not made for either (claim for misuse of information tort having not be made). Again, the Court reiterated that to recover damages for distress under Section 13(1) DPA 1998, it would be necessary to provide evidence of this distress for each individual represented – making this incompatible with the nature of representative action. | Following an analysis of ''Vidal-Hall v Google Inc'' (discussing Section 13 DPA 1998) and ''Gulati v MGN Ltd'' (discussing tort for misuse of private information) the court outlined that it would be possible for Lloyd to claim (1) damages under Section 13(1) DPA 1998 for distress suffered due to Google’s infringement of the Act; (2) and /or damages for the misuse of private information without the need to show material damage or distress. However, the court outlined that the case was not made for either (claim for misuse of information tort having not be made). Again, the Court reiterated that to recover damages for distress under Section 13(1) DPA 1998, it would be necessary to provide evidence of this distress for each individual represented – making this incompatible with the nature of representative action. | ||
The UK Supreme Court rejected the argument that an infringement of the DPA 1998 should be dealt with in the same way as the tort of misuse of private information and that therefore | The UK Supreme Court rejected the argument that an infringement of the DPA 1998 should be dealt with in the same way as the tort of misuse of private information and that therefore compensation can be recovered for interference by an organisation without the need to demonstrate material damage or distress. The UK Supreme Court relied on the fact that Section 13(1) DPA 1998 cannot be interpreted using that analogy, as highlighted above. The wording of the DPA 1998 and its interpretation in caselaw cannot be detached from the fact that material damage or distress must be demonstrated: | ||
''"…the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention.''" | ''"…the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention.''" | ||
Revision as of 08:45, 25 November 2021
| UKSC - Richard Lloyd v Google LLC (2021) UKSC 50 | |
|---|---|
 | |
| Court: | UKSC (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 23 of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Rule 19.6 of the Civil Procedure Rules Section 13 of the Data Protection Act 1998 Section 14 of the Data Protection Act 1998 Section 4(4) of the Data Protection Act 1998 Rule 19.11 of the Civil Procedure Rules |
| Decided: | 10.11.2021 |
| Published: | 10.11.2021 |
| Parties: | Richard Lloyd Google LLC |
| National Case Number/Name: | Richard Lloyd v Google LLC (2021) UKSC 50 |
| European Case Law Identifier: | |
| Appeal from: | EWCA (UK) Lloyd v Google LLC (2019) EWCA Civ 1599 |
| Appeal to: | |
| Original Language(s): | English |
| Original Source: | The Supreme Court of the United Kingdom (in English) |
| Initial Contributor: | MH |
The UK Supreme Court held that to claim compensation for an infringement of the Data Protection Act 1998, it was necessary to demonstrate material damage or distress suffered by each individual. A representative action was therefore not suitable.
English Summary
Facts
Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location.
As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service.
This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US.
Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc).
Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate that the claimant suffered financial or mental distress as a result of the infringement.
Holding
Legal framework:
Section 4(4) of the Data Protection Act 1998 (DPA 1998) imposes a duty on data controllers to comply with data protection principles. These are laid out in Schedule 1 of the DPA 1998.
Section 13 of the DPA 1998 gives individuals a right to compensation from the controller if they suffer damage as a result of a contravention of the Act by that controller.
Individuals can bring claims which give rise to a common issue of fact or law can apply for a Group Litigation Order to be made under Rule 19.11 of the Civil Procedure Rules. This is an “opt-in” regime where claimants must take steps to join the group.
They can also do so under a representative action, reflected in Rule 19.6 of the Civil Procedure Rules (CPR). However, as a detailed legislative framework is missing, the representative action rules within common law have been considered by the Supreme Court. The following principles are relevant:
- “same interest” requirement where the representative must have the same interest or common issues as the persons they represent (within Rule 19.6 CPR);
- “court’s discretion” as to whether to allow the claim to proceed as a representative action. This is an objective assessment as to whether the case can be dealt with justly and at a proportionate cost (within Rules 1.1 and 1.2 CPR);
- “no requirement of consent” or awareness required from the people represented;
- “class definition” requirement where the class of people represented must be clearly defined;
- “liability for costs” requirement where the persons represented will not have to pay costs of being represented incurred by the representative;
- “scope for claiming damages” where claiming damages is limited by the nature of the remedy of damages at common law, or by the fact that damages may require an individual assessment.
Holding:
The UK Supreme court did not object to a representative claim brought to establish whether Google was in breach of DPA 1998. The Supreme Court also determined that the individuals had similar interests or common issues caused by tracking of their behaviour without consent.
According to the Court, there was no uniform effect caused by Google’s actions across the represented class. Instead, the effect and the amount recoverable by each individual would depend on the circumstances particular to the individuals (eg how often they used Safari or website with DoubleClick Ad content). Contrary to Lloyd’s claim, the Court held that DPA 1998 cannot be read to mean that individuals are entitled to compensation for any contravention of the DPA 1998 without needing to prove financial loss or distress. According to the leading judgement, under Section 13 DPA 1998, it is not enough to prove an infringement by a data controller as “damage” (interpreted as only meaning material damages) or “distress” must be suffered as a result.
Following an analysis of Vidal-Hall v Google Inc (discussing Section 13 DPA 1998) and Gulati v MGN Ltd (discussing tort for misuse of private information) the court outlined that it would be possible for Lloyd to claim (1) damages under Section 13(1) DPA 1998 for distress suffered due to Google’s infringement of the Act; (2) and /or damages for the misuse of private information without the need to show material damage or distress. However, the court outlined that the case was not made for either (claim for misuse of information tort having not be made). Again, the Court reiterated that to recover damages for distress under Section 13(1) DPA 1998, it would be necessary to provide evidence of this distress for each individual represented – making this incompatible with the nature of representative action.
The UK Supreme Court rejected the argument that an infringement of the DPA 1998 should be dealt with in the same way as the tort of misuse of private information and that therefore compensation can be recovered for interference by an organisation without the need to demonstrate material damage or distress. The UK Supreme Court relied on the fact that Section 13(1) DPA 1998 cannot be interpreted using that analogy, as highlighted above. The wording of the DPA 1998 and its interpretation in caselaw cannot be detached from the fact that material damage or distress must be demonstrated:
"…the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention."
Section 14 DPA 1998 also supports the interpretation that a damage, and not purely an infringement of the legislation, must be demonstrated. The Court also relied on the interpretation by the Court of Appeal in Vidall-Hall v Google Inc, which distinguished damage or distress suffered and contravention of a requirement in the DPA 1998. The Court also did not consider that it was possible to rely on an analogy between the tort of misuse of information and Section 13 DPA 1998 simply because they are both founded in the common route of “right to privacy” embodied in Article 8 European Convention on Human Rights.
Additionally, the Court held that it would be, in any case, necessary to identify damage or distress suffered by each individual for the purpose of awarding compensation (even if it was not necessary to show individual damage or distress as a result of the infringement). Factors like extent of Google’s tracking; quantity of data processed; nature of the data processed (sensitive nature?); use of that information and benefit from it by Google would all need to be assessed for individual cases. Without such individualised assessment, Lloyd’s argument that the “lowest common denominator” on which the claim is based (proof that the individual us part of the class by having an iPhone at the time) would not be sufficient to be something more than trivial (as required under Section 13 DPA 1998). Therefore, compensation could not be quantified beyond 0.
The UK Supreme Court concluded and decided unanimously that:
“In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result.”
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Michaelmas Term
[2021] UKSC 50
On appeal from: [2019] EWCA Civ 1599
JUDGMENT
Lloyd (Respondent) v Google LLC (Appellant)
before
Lord Reed, President
Lady Arden
Lord Sales
Lord Leggatt
Lord Burrows
JUDGMENT GIVEN ON
10 November 2021
Heard on 28 and 29 April 2021 Appellant
Antony White QC
Edward Craven
(Instructed by Pinsent Masons LLP (London))
Respondent
Hugh Tomlinson QC
Oliver Campbell QC
Victoria Wakefield QC
(Instructed by Milberg London LLP)
1st Intervener (Information Commissioner)
Gerry Facenna QC
Nikolaus Grubeck
(Instructed by Information Commissioner’s Office)
2nd Intervener (Open Rights Group)
(written submissions only)
Robert Palmer QC
Julianne Kerr Morrison
(Instructed by AWO)
3rd Intervener (Association of the British Pharmaceutical Industry and Association of British
HealthTech Industries (ABPI and ABHI))
(written submissions only)
Lord Anderson of Ipswich KBE QC
Robin Hopkins
Rupert Paines
(Instructed by CMS Cameron McKenna Nabarro Olswang LLP (London))
4th Intervener (Liberty, Coram Children’s Legal Centre and Inclusion London)
(written submissions only)
Dan Squires QC
Aidan Wills
Tim James-Matthews
(Instructed by Liberty, Coram Children’s Legal Centre and Deighton Pierce Glynn)
5th Intervener (Internet Association)
(written submissions only)
Christopher Knight
(Instructed by Linklaters LLP (London))6th Intervener (TECHUK Ltd (trading as techUK))
(written submissions only)
Catrin Evans QC
Ian Helme
(Instructed by RPC LLP (London))LORD LEGGATT: (with whom Lord Reed, Lady Arden, Lord Sales and Lord Burrows
agree)
A. INTRODUCTION
1. Mr Richard Lloyd - with financial backing from Therium Litigation Funding IC, a
commercial litigation funder - has issued a claim against Google LLC, alleging breach of
its duties as a data controller under section 4(4) of the Data Protection Act 1998 (“the
DPA 1998”). The claim alleges that, for several months in late 2011 and early 2012,
Google secretly tracked the internet activity of millions of Apple iPhone users and used
the data collected in this way for commercial purposes without the users’ knowledge
or consent.
2. The factual allegation is not new. In August 2012, Google agreed to pay a civil
penalty of US$22.5m to settle charges brought by the United States Federal Trade
Commission based upon the allegation. In November 2013, Google agreed to pay
US$17m to settle consumer-based actions brought against it in the United States. In
England and Wales, three individuals sued Google in June 2013 making the same
allegation and claiming compensation under the DPA 1998 and at common law for
misuse of private information: see Vidal-Hall v Google Inc (Information Comr
intervening)[2015] EWCA Civ 311; [2016] QB 1003. Following a dispute over
jurisdiction, their claims were settled before Google had served a defence. What is
new about the present action is that Mr Lloyd is not just claiming damages in his own
right, as the three claimants did in Vidal-Hall. He claims to represent everyone resident
in England and Wales who owned an Apple iPhone at the relevant time and whose
data were obtained by Google without their consent, and to be entitled to recover
damages on behalf of all these people. It is estimated that they number more than 4m.
3. Class actions, in which a single person is permitted to bring a claim and obtain
redress on behalf of a class of people who have been affected in a similar way by
alleged wrongdoing, have long been possible in the United States and, more recently,
in Canada and Australia. Whether legislation to establish a class action regime should
be enacted in the UK has been much discussed. In 2009, the Government rejected a
recommendation from the Civil Justice Council to introduce a generic class action
regime applicable to all types of claim, preferring a “sector based approach”. This was
for two reasons:
“Firstly, there are potential structural differences between
the sectors which will require different consideration. …
Secondly, it will be necessary to undertake a full assessment
Page 2 of the likely economic and other impacts before
implementing any reform.”
See the Government’s Response to the Civil Justice Council’s Report: “Improving
Access to Justice through Collective Actions” (2008), paras 12-13.
4. Since then, the only sector for which such a regime has so far been enacted is
that of competition law. Parliament has not legislated to establish a class action regime
in the field of data protection.
5. Mr Lloyd has sought to overcome this difficulty by what the Court of Appeal in
this case described as “an unusual and innovative use of the representative procedure”
in rule 19.6 of the Civil Procedure Rules: see [2019] EWCA Civ 1599; [2020] QB 747,
para 7. This is a procedure of very long standing in England and Wales whereby a claim
can be brought by (or against) one or more persons as representatives of others who
have “the same interest” in the claim. Mr Lloyd accepts that he could not use this
procedure to claim compensation on behalf of other iPhone users if the compensation
recoverable by each user would have to be individually assessed. But he contends that
such individual assessment is unnecessary. He argues that, as a matter of law,
compensation can be awarded under the DPA 1998 for “loss of control” of personal
data without the need to prove that the claimant suffered any financial loss or mental
distress as a result of the breach. Mr Lloyd further argues that a “uniform sum” of
damages can properly be awarded in relation to each person whose data protection
rights have been infringed without the need to investigate any circumstances
particular to their individual case. The amount of damages recoverable per person
would be a matter for argument, but a figure of £750 was advanced in a letter of claim.
Multiplied by the number of people whom Mr Lloyd claims to represent, this would
produce an award of damages of the order of £3 billion.
6. Because Google is a Delaware corporation, the claimant needs the court’s
permission to serve the claim form on Google outside the jurisdiction. The application
for permission has been contested by Google on the grounds that the claim has no real
prospect of success as: (1) damages cannot be awarded under the DPA 1998 for “loss
of control” of data without proof that it caused financial damage or distress; and (2)
the claim in any event is not suitable to proceed as a representative action. In the High
Court Warby J decided both issues in Google’s favour and therefore refused permission
to serve the proceedings on Google: see [2018] EWHC 2599 (QB); [2019] 1 WLR 1265.
The Court of Appeal reversed that decision, for reasons given in a judgment of the
Chancellor, Sir Geoffrey Vos, with which Davis LJ and Dame Victoria Sharp agreed:
[2019] EWCA Civ 1599; [2020] QB 747.
Page 37. On this further appeal, because of the potential ramifications of the issues
raised, as well as hearing the claimant and Google, the court has received written and
oral submissions from the Information Commissioner and written submissions from
five further interested parties.
8. In this judgment I will first summarise the facts alleged and the relevant legal
framework for data protection before considering the different methods currently
available in English procedural law for claiming collective redress and, in particular, the
representative procedure which the claimant is seeking to use. Whether that
procedure is capable of being used in this case critically depends, as the claimant
accepts, on whether compensation for the alleged breaches of data protection law
would need to be individually assessed. I will then consider the claimant’s arguments
that individual assessment is unnecessary. For the reasons given in detail below, those
arguments cannot in my view withstand scrutiny. In order to recover compensation
under the DPA 1998 for any given individual, it would be necessary to show both that
Google made some unlawful use of personal data relating to that individual and that
the individual suffered some damage as a result. The claimant’s attempt to recover
compensation under the Act without proving either matter in any individual case is
therefore doomed to fail.
B. FACTUAL BACKGROUND
9. The relevant events took place between 9 August 2011 and 15 February 2012
and involved the alleged use by Google of what has been called the “Safari
workaround” to bypass privacy settings on Apple iPhones.
10. Safari is an internet browser developed by Apple and installed on its iPhones. At
the relevant time, unlike most other internet browsers, all relevant versions of Safari
were set by default to block third party cookies. A “cookie” is a small block of data that
is placed on a device when the user visits a website. A “third party cookie” is a cookie
placed on the device not by the website visited by the user but by a third party whose
content is included on that website. Third party cookies are often used to gather
information about internet use, and in particular web pages visited over time, to
enable the delivery to the user of advertisements tailored to interests inferred from
the user’s browsing history.
11. Google had a cookie known as the “DoubleClick Ad cookie” which could operate
as a third party cookie. It would be placed on a device if the user visited a website that
included DoubleClick Ad content. The DoubleClick Ad cookie enabled Google to
identify visits by the device to any website displaying an advertisement from its vast
Page 4advertising network and to collect considerable amounts of information. It could tell
the date and time of any visit to a given website, how long the user spent there, which
pages were visited for how long, and what advertisements were viewed for how long.
In some cases, by means of the IP address of the browser, the user’s approximate
geographical location could be identified.
12. Although the default settings for Safari blocked all third party cookies, a blanket
application of these settings would have prevented the use of certain popular web
functions; so Apple devised some exceptions to them. These exceptions were in place
until March 2012, when the system was changed. But in the meantime the exceptions
made it possible for Google to devise and implement the Safari workaround. Its effect
was to place the DoubleClick Ad cookie on an Apple device, without the user’s
knowledge or consent, immediately, whenever the user visited a website that
contained DoubleClick Ad content.
13. It is alleged that, in this way, Google was able to collect or infer information
relating not only to users’ internet surfing habits and location, but also about such
diverse factors as their interests and pastimes, race or ethnicity, social class, political or
religious beliefs or affiliations, health, sexual interests, age, gender and financial
situation.
14. Further, it is said that Google aggregated browser generated information from
users displaying similar patterns, creating groups with labels such as “football lovers”,
or “current affairs enthusiasts”. Google’s DoubleClick service then offered these group
labels to subscribing advertisers to choose from when selecting the type of people at
whom they wanted to target their advertisements.
C. THE LEGAL FRAMEWORK
15. The DPA 1998 was enacted to implement Parliament and Council Directive
95/46/EC of 24 October 1995 “on the protection of individuals with regard to the
processing of personal data and on the free movement of such data” (OJ 1995 L281, p
31) (the “Data Protection Directive”). The Data Protection Directive has been
superseded by the General Data Protection Regulation, which became law in the UK in
May 2018, supplemented by the Data Protection Act 2018 (“the DPA 2018”). The DPA
2018 repealed and replaced the DPA 1998 except in relation to acts or omissions which
occurred before it came into force.
Page 516. Because the acts and omissions giving rise to the present claim occurred in 2011
and 2012, the claim is governed by the old law contained in the DPA 1998 and the Data
Protection Directive. The parties and interveners in their submissions on this appeal
nevertheless made frequent references to provisions of the General Data Protection
Regulation and the DPA 2018. In principle, the meaning and effect of the DPA 1998 and
the Data Protection Directive cannot be affected by legislation which has been enacted
subsequently. The later legislation therefore cannot help to resolve the issues raised
on this appeal, and I shall leave it to one side.
(1) The scheme of the DPA 1998
17. Section 4(4) of the DPA 1998 imposed a duty on a data controller to comply
with “the data protection principles” set out in Schedule 1 “in relation to all personal
data with respect to which he is the data controller”. As defined in section 1(1) of the
Act, “personal data” are, in effect, all recorded information which relate to an
identifiable individual. An individual who is the subject of personal data is referred to
as the “data subject”. A “data controller” is a person who (either alone or with others)
“determines the purposes for which and the manner in which any personal data are, or
are to be, processed.” The term “processing” is defined very broadly to mean
“obtaining, recording or holding the information or data or carrying out any operation
or set of operations on the information or data …”. Section 2 of the Act establishes a
category of “sensitive personal data” consisting of information about certain specified
matters, which include the racial or ethnic origin, political opinions, religious beliefs,
physical or mental health or sexual life of the data subject.
18. The first of the eight “data protection principles” set out in Schedule 1 is that:
“Personal data shall be processed fairly and lawfully and, in
particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met,
and
(b) in the case of sensitive personal data, at least one
of the conditions in Schedule 3 is also met.”
The other seven data protection principles, in summary, require personal data: (2) to
be obtained and processed only for specified and lawful purposes; (3) to be “adequate,
relevant, and not excessive” in relation to those purposes; (4) to be accurate and,
Page 6where necessary, kept up to date; (5) not to be kept for longer than is necessary for
those purposes; (6) to be processed in accordance with the rights of data subjects
under the Act; (7) to be protected by appropriate technical and organisational security
measures against unauthorised or unlawful processing and against accidental loss or
destruction or damage; and (8) not to be transferred outside the European Economic
Area unless the destination country or territory provides an adequate level of
protection for data subjects in relation to the processing of personal data.
19. As discussed in more detail below, section 13 of the DPA 1998 gives an
individual who suffers damage “by reason of any contravention by a data controller of
any of the requirements of this Act” a right to compensation from the data controller
for that damage.
(2) The allegations of breach of duty
20. The claimant, Mr Lloyd, contends that Google processed personal data of each
member of the represented class in breach of the first, second and seventh data
protection principles. The represented class consists in essence of everyone in England
and Wales who at the relevant time had an Apple iPhone on which Google’s
DoubleClick Ad cookie was placed through the Safari workaround. (The precise
definition of the class is set out at para 19 of Warby J’s judgment.) Two principal
allegations made are that, in breach of the first data protection principle, (i) the data
obtained by placing the DoubleClick Ad cookie on each class member’s device were not
processed fairly and (ii) none of the conditions in Schedule 2 (or 3) was met.
21. Schedule 1, Part II, paragraph 2, provides, in substance, that personal data
obtained from the data subject are not to be treated as processed fairly unless the
data controller informs the data subject of the purpose for which the data are
intended to be processed - a requirement with which it is said that Google failed to
comply in this case.
22. Schedule 2 contains a list of conditions capable of justifying the processing of
data. To comply with the first data protection principle, at least one of these
conditions must be satisfied. The first condition in Schedule 2 is that “the data subject
has given his consent to the processing”. Other conditions are that the processing is
necessary for (amongst other things): the performance of a contract to which the data
subject is a party; or compliance with a legal obligation (other than a contractual
obligation) of the data controller; or to protect the vital interests of the data subject;
or for the exercise of any functions of a public nature exercised in the public interest
by any person. The claimant asserts that the members of the represented class whose
Page 7personal data Google processed had not given their consent to the processing, nor was
any of the other conditions capable of justifying the processing met. Hence for this
reason too Google was in breach of the first data protection principle.
23. There is no doubt that the claimant is entitled to advance a claim against Google
on this basis in his own right which has a real prospect of success. The issue is whether
he can also do so on behalf of all other iPhone users who fall within the represented
class. This depends on the scope of the representative procedure available under the
Civil Procedure Rules (“CPR”). Before I come to that procedure, I will mention in order
to compare them the two other methods of claiming collective redress currently
available in English procedural law.
D. COLLECTIVE REDRESS IN ENGLISH LAW
(1) Group Actions
24. A group of people who wish to bring claims which give rise to common or
related issues of fact or law can apply to the court for a Group Litigation Order to be
made under CPR rule 19.11, providing for the claims to be managed together, usually
by a single designated judge. The Group Litigation Order will establish a register of the
claims included in the group, which is maintained by the claimants’ lead solicitor. The
order may also make provision for how the litigation costs are to be shared among the
claimants. How the claims are managed is a matter for the designated judge, but
procedures typically used are to select one or more claims to be tried as test claims
while the remaining claims are stayed and to decide as preliminary issues common
issues of law or fact which are potentially dispositive of the litigation. Unless the court
orders otherwise, a judgment given or order made in the litigation is binding on all the
claimants included in the group register: see CPR rule 19.12(1)(a).
25. Where the individual claims are of sufficiently high value, group actions can be
an effective way of enabling what are typically several hundred or thousands of claims
to be litigated and managed together, avoiding duplication of the court’s resources
and allowing the claimants to benefit from sharing costs and litigation risk and by
obtaining a single judgment which is binding in relation to all their claims. However,
the group action procedure suffers from the drawback that it is an “opt-in” regime: in
other words, claimants must take active steps to join the group. This has an
administrative cost, as a solicitor conducting the litigation has to obtain sufficient
information from a potential claimant to determine whether he or she is eligible to be
added to the group register, give appropriate advice and enter into a retainer with the
client. For claims which individually are only worth a few hundred pounds, this process
Page 8is not economic as the initial costs alone may easily exceed the potential value of the
claim.
26. Another limitation of opt-in proceedings is that experience has shown that only
a relatively small proportion of those eligible to join the group are likely to do so,
particularly if the number of people affected is large and the value of each individual
claim relatively small. For example, a group action was recently brought against the
Morrisons supermarket chain for compensation for breach of the DPA 1998 arising
from the disclosure on the internet by a Morrisons’ employee of personal data relating
to other employees. Of around 100,000 affected employees, fewer than 10,000 opted
to join the group action: see Various Claimants v Wm Morrisons Supermarkets plc
[2017] EWHC 3113 (QB); [2019] QB 772 (reversed on the issue of vicarious liability by
the Supreme Court: [2020] UKSC 12; [2020] AC 989). During the period of more than 12
years in which collective proceedings under the Competition Act 1998 (discussed
below) could be brought only on an opt-in basis just one action was commenced,
based on a finding of price fixing in the sale of replica football shirts. Although around
1.2 – 1.5m people were affected, despite widespread publicity only 130 people opted
into the proceedings: see The Consumers' Association v JJB Sports Plc[2009] CAT 2,
para 5; Civil Justice Council Report “Improving Access to Justice through Collective
Actions” (2008), Part 6, para 22; and Grave D, McIntosh M and Rowan G (eds), Class
Actions in England and Wales, 1st ed (2018), para 1-068.
27. Likely explanations for the low participation rates typically experienced in opt-in
regimes include lack of awareness of the opportunity to join the litigation and the
natural human tendency to do nothing when faced with a choice which requires
positive action - particularly if there is no immediate benefit to be gained and the
consequences are uncertain and not easy to understand: see eg Thaler R and Sunstein
C, Nudge: The Final Edition (2021), pp 36-38; Samuelson W and Zeckhauser R, “Status
Quo Bias in Decision Making” (1988) 1 Journal of Risk and Uncertainty 7-59. As the
New Zealand Court of Appeal has recently said of opt-in class actions:
“Whichever approach is adopted, many class members are
likely to fail to take any positive action for a range of reasons
that have nothing at all to do with an assessment of whether
or not it is in their interests to participate in the proceedings.
Some class members will not receive the relevant notice.
Others will not understand the notice, or will have difficulty
understanding what action they are required to take and
completing any relevant form, or will be unsure or hesitant
about what to do and will do nothing. Even where a class
member considers that it is in their interests to participate in
Page 9 the proceedings, the significance of inertia in human affairs
should not be underestimated.”
Ross v Southern Response Earthquake Services Ltd [2019] NZCA 431, para 98; approved
by the New Zealand Supreme Court at [2020] NZSC 126, para 40.
28. A further factor which makes group litigation impractical in cases where the loss
suffered by each individual is small, even if in aggregate it may amount to a very large
sum of money, is the need to prove the quantum of loss in each individual case. Not
only are eligible individuals less likely to opt into the proceedings where the potential
gain to them is small, but the costs of obtaining evidence from each individual to
support their claim is again likely to make group litigation uneconomic in such cases.
(2) Collective Proceedings
29. Compared to group actions, the method of collective redress which is now
available in the field of competition law offers significant advantages for claimants,
particularly where many people have been affected by the defendant’s conduct but
the value of each individual claim is small. Section 47B of the Competition Act 1998
(added by the Enterprise Act 2002 and as amended by the Consumer Rights Act 2015)
makes provision for bringing “collective proceedings” in the Competition Appeal
Tribunal (“CAT”) combining two or more claims to which section 47A applies
(essentially, claims in respect of an infringement or alleged infringement of
competition law). Such proceedings must be commenced by a person who proposes to
be the representative of a specified class of persons, and the proceedings may only be
continued if they are certified by the CAT as satisfying criteria set out in section 47B
and in the CAT Rules. Two features of this regime may be noted.
30. First, unlike group litigation, collective proceedings may be brought on either an
“opt-in” or “opt-out” basis. “Opt-out” collective proceedings are proceedings brought
on behalf of each class member except any member who opts out by notifying the
class representative that their claim should not be included in the proceedings: see
section 47B(11). Where “opt-out” collective proceedings are permitted, a person may
therefore have a claim brought on their behalf without taking any affirmative step and,
potentially, without even knowing of the existence of the proceedings and the fact that
he or she is represented in them.
31. A second significant feature of the collective proceedings regime is that it
enables liability to be established and damages recovered without the need to prove
Page 10that members of the class have individually suffered loss: it is sufficient to show that
loss has been suffered by the class viewed as a whole. This is the effect of section
47C(2) of the Competition Act, which provides:
“The tribunal may make an award of damages in collective
proceedings without undertaking an assessment of the
amount of damages recoverable in respect of the claim of
each represented person.”
Such an award of damages is referred to in the CAT Rules as “an aggregate award of
damages”: see rule 73(2).
32. As Lord Briggs explained in Merricks v Mastercard[2020] UKSC 51; [2021] Bus LR
25, at para 76, section 47C(2) of the Competition Act “radically alters the established
common law compensatory principle by removing the requirement to assess individual
loss”. This is so for the purposes both of making and of paying out an aggregate award
of damages. How an aggregate award of damages is distributed among the members
of the class is subject to the control of the CAT and, as this court held in Merricks v
Mastercard, the only requirement is that the distribution should be just: see paras 76-
77, 149. No doubt in many cases a just method of distribution will be one which divides
up an aggregate award of damages in a way which takes account of individual loss. But
particularly where the size of the class is large and the amount of damages awarded
small considered on a per capita basis, it may be impractical or disproportionate to
adopt such a method. In such cases some other method of distribution, such as an
equal division among all the members of the class, may be justified.
(3) Representative Actions
33. Collective proceedings are a recent phenomenon in English law. By contrast, the
representative procedure which the claimant is seeking to use in this case has existed
for several hundred years. The current version of the representative rule is CPR rule
19.6, which states:
“(1) Where more than one person has the same interest in
a claim -
(a) the claim may be begun; or
Page 11 (b) the court may order that the claim be continued,
by or against one or more of the persons who have the same
interest as representatives of any other persons who have
that interest.
(2) The court may direct that a person may not act as a
representative.
(3) Any party may apply to the court for an order under
paragraph (2).
(4) Unless the court otherwise directs any judgment or
order given in a claim in which a party is acting as a
representative under this rule -
(a) is binding on all persons represented in the claim;
but
(b) may only be enforced by or against a person who is
not a party to the claim with the permission of the
court.”
(a) Origins of the rule
34. This rule has its origins in the procedure of the Court of Chancery before the
Judicature Act of 1873. The general rule was that all persons materially interested in
the subject-matter of a suit should be made parties to it, either as claimants or
defendants, so as to ensure that the rights of all persons interested were settled by a
single judgment of the court: see eg Adair v New River Co (1805) 11 Ves Jr 429; 32 ER
1153; Cockburn v Thompson (1809) 16 Ves Jr 321; 33 ER 1005. However, to join all
interested persons as parties was not always practically convenient- particularly if they
were very numerous. The solution devised was not to abandon the aim of settling the
rights of all interested persons in a single proceeding; rather, it was to relax the
“complete joinder rule” by allowing one or more claimants or defendants to represent
all others who had the same interest as them: see Sorabji J, “The hidden class action in
English civil procedure” (2009) 28 CJQ 498. All persons represented in this way, as well
as the parties actually before the court, were bound by the court’s decision.
Page 1235. In the very early cases in the 16th and 17th centuries in which this procedure
was adopted, the persons represented were invariably a cohesive communal group,
such as parishioners or manorial tenants, whose members had agreed to be
represented; and the representatives were often required to show proof of their
authority to represent the group. But as the nature of society changed and new, more
impersonal institutions such as friendly societies and joint stock companies with
multiple investors emerged, this requirement was dropped. The court allowed persons
to be represented whether or not they had consented to such representation or even
knew of the action, relying on community of interest among the members of the group
to ensure that the interests of all were adequately protected: see Yeazell, “From Group
Litigation to Class Action, Part I: The Industrialization of Group Litigation” (1980) 27
UCLA Law Review 514.
36. Many of the formative cases involved joint stock companies at a time (before
the Joint Stock Companies Acts 1844 to 1858) when such companies were not yet
recognised as separate legal entities which could sue or be sued. An action had
therefore to be brought by (or against) the members themselves. In Chancey v May
(1722) Precedents in Chancery 592; 24 ER 265, the treasurer and manager of a brass-
works brought an action on behalf of themselves and all other proprietors of the
undertaking, of whom there were 800 in total, except for the defendants, who were its
former managers, to call the defendants to account for alleged mismanagement and
embezzlement. The defendants objected that the claim should not be allowed to
proceed as the rest of the proprietors had not been made parties. The court dismissed
that objection on the grounds that, first, the action had been brought on behalf of all
the other proprietors, so that “all the rest were in effect parties”, and secondly:
“Because it would be impracticable to make them all parties
by name, and there would be continual abatements by death
and otherwise, and no coming at justice, if all were to be
made parties.”
37. Another notable case involving a joint stock company was Meux v Maltby (1818)
2 Swanston 277; 36 ER 621. In this case the treasurer and directors of the company
were sued as representative defendants on a contract made on behalf of all the
members of the company to grant a lease. In rejecting an argument that the claim was
defective because not all the proprietors were before the court, Plumer MR explained,
at pp 281-282:
“The general rule, which requires the plaintiff to bring before
the court all the parties interested in the subject in question,
admits of exceptions. The liberality of this court has long held
Page 13 that there is of necessity an exception to the general rule,
when a failure of justice would ensue from its enforcement.”
After citing numerous authorities, he concluded, at p 284:
“Here is a current of authority, adopting more or less a
general principle of exception, by which the rule, that all
persons interested must be parties, yields when justice
requires it, in the instance either of plaintiffs or defendants.
… It is quite clear that the present suit has sufficient parties,
and that the defendants may be considered as representing
the company.”
38. In Duke of Bedford v Ellis [1901] AC 1, 8, Lord Macnaghten summarised the
practice of the Court of Chancery in this way:
“The old rule in the Court of Chancery was very simple and
perfectly well understood. Under the old practice the Court
required the presence of all parties interested in the matter
in suit, in order that a final end might be made of the
controversy. But when the parties were so numerous that
you never could ‘come at justice’, to use an expression in one
of the older cases, if everybody interested was made a party,
the rule was not allowed to stand in the way. It was originally
a rule of convenience: for the sake of convenience it was
relaxed. Given a common interest and a common grievance,
a representative suit was in order if the relief sought was in
its nature beneficial to all whom the plaintiff proposed to
represent.”
(b) Effect of the Judicature Act
39. By the Supreme Court of Judicature Act 1873, all the jurisdiction previously
exercised by the Court of Chancery and the courts of common law was transferred to
and vested in the new High Court of Justice. Rules of procedure for the High Court
were scheduled to the Act, which included as rule 10:
“Where there are numerous parties having the same interest
in one action, one or more of such parties may sue or be
Page 14 sued, or may be authorised by the court to defend in such
action, on behalf or for the benefit of all parties so
interested.”
This rule became Order 16, rule 9 of the Rules of the Supreme Court and has remained
in force in the same or similar form ever since. Save that the requirement for
“numerous parties” has been reduced to “more than one”, there is no significant
difference in the current version of the rule, quoted at para 33 above.
40. At first after the enactment of the Judicature Act the courts construed the new
rule narrowly. In Temperton v Russell [1893] 1 QB 435, 438, Lindley LJ, who gave the
judgment of the Court of Appeal, expressed the view that the rule only applied to
“persons who have or claim some beneficial proprietary right” which they are asserting
or defending in an action that would have come within the jurisdiction of the old Court
of Chancery; hence the rule did not apply to a claim for damages in tort. That view,
however, was repudiated by the House of Lords in Duke of Bedford v Ellis [1901] AC 1.
Six individuals sued the Duke of Bedford, who owned Covent Garden Market, on behalf
of themselves and all other growers of fruit, flowers, vegetables, roots and herbs, to
enforce certain preferential rights claimed under the Covent Garden Market Act 1828
to stands in the market. They sought declarations of the rights of the growers and an
injunction to restrain the Duke from acting inconsistently with those rights. They also
claimed - though only for themselves and not on behalf of other growers - an account
and repayment of sums charged to them for selling at the market in excess of what
they would have paid if afforded their alleged preferential rights. The Duke applied to
have the action stayed either on the ground that the claimants had no beneficial
proprietary right, or on the ground that the joinder in one action of parties claiming
separate and different rights under the Act, both personally and as representing a
class, would embarrass or delay the trial. The House of Lords rejected both grounds
(the first unanimously and the second by a majority of 3 to 2) and held that the action
could be maintained.
41. Lord Macnaghten, who gave the leading speech, expressly disapproved the
restrictive view of the representative rule expressed in Temperton v Russell and
confirmed that its purpose was simply to apply the practice of the Court of Chancery to
all divisions of the High Court. The only change was therefore that the rule was now
applicable in actions which, before the Judicature Act, could only have been brought in
a court of common law. He said, at pp 10-11, that:
“… in all other respects I think the rule as to representative
suits remains very much as it was a hundred years ago. From
the time it was first established it has been recognised as a
Page 15 simple rule resting merely upon convenience. It is impossible,
I think, to read such judgments as those delivered by Lord
Eldon in Adair v New River Co, in 1805, and in Cockburn v
Thompson, in 1809, without seeing that Lord Eldon took as
broad and liberal a view on this subject as anybody could
desire. ‘The strict rule’, he said, ‘was that all persons
materially interested in the subject of the suit, however
numerous, ought to be parties … but that being a general rule
established for the convenient administration of justice must
not be adhered to in cases to which consistently with
practical convenience it is incapable of application’. ‘It was
better’, he added, ‘to go as far as possible towards justice
than to deny it altogether’. He laid out of consideration the
case of persons suing on behalf of themselves and all others,
‘for in a sense’, he said, ‘they are before the Court’. As
regards defendants, if you cannot make everybody interested
a party, you must bring so many that it can be said they will
fairly and honestly try the right. I do not think, my Lords, that
we have advanced much beyond that in the last hundred
years …”
As Megarry J commented in John v Rees[1970] Ch 345, 370, this explanation made it
plain that the representative rule is to be treated as being “not a rigid matter of
principle but a flexible tool of convenience in the administration of justice”.
42. In Taff Vale Railway Co v Amalgamated Society of Railway Servants [1901] AC
426, 443, Lord Lindley (as he had become) went out of his way to endorse this view
and to retract his earlier observations in Temperton v Russell, stating:
“The principle on which the rule is based forbids its
restriction to cases for which an exact precedent can be
found in the reports. The principle is as applicable to new
cases as to old, and ought to be applied to the exigencies of
modern life as occasion requires. The rule itself has been
embodied and made applicable to the various Divisions of the
High Court by the Judicature Act, 1873, sections 16 and 23-
25, and Order XVI, rule 9; and the unfortunate observations
made on that rule in Temperton v Russell have been happily
corrected in this House in the Duke of Bedford v Ellis and in
the course of the argument in the present case.”
Page 16 (c) Markt and declarations of rights
43. The subsequent decision of the Court of Appeal in Markt & Co Ltd v Knight
Steamship Co Ltd [1910] 2 KB 1021 has sometimes been seen as undermining the
broad and flexible view of the representative rule adumbrated by the House of Lords in
these two cases by imposing significant constraints on its use: see eg Esanda Finance
Corpn Ltd v Carnie (1992) 29 NSWLR 382, 395; Mulheron R, The Class Action in
Common Law Legal Systems (2004) pp 78-82; Sorabji J, “The hidden class action in
English civil procedure” (2009) 28 CJQ 498. I do not think, however, that the decision
should be understood in this way. Markt was heard together with another action also
brought against the owners of a cargo vessel which was intercepted by a Russian
cruiser on a voyage to Japan during the Russo-Japanese war, on suspicion of carrying
contraband of war, and sunk. Just before the limitation period expired, two cargo-
owners issued writs “on behalf of themselves and others owners of cargo lately laden
on board” the vessel, claiming “damages for breach of contract and duty in and about
the carriage of goods by sea”. No further particulars of the claims were given.
44. All three members of the Court of Appeal agreed that the claims as formulated
could not be pursued as representative actions as there was no basis for asserting that
all the cargo owners had the same interest in the actions. That was so if only because a
claim that the shipowners were in breach of duty in carrying contraband goods plainly
could not be maintained on behalf of any cargo-owners who had themselves shipped
such goods; furthermore, each cargo owner would need to prove their individual loss.
Buckley LJ would have allowed the claimants to amend their writs and continue the
proceedings on behalf of themselves and all cargo-owners who were not shippers of
contraband goods, claiming a declaration that the defendants were in breach of
contract and duty in shipping contraband of war. The other judges, however, did not
agree to this course. Vaughan Williams LJ, at p 1032, rejected it on the grounds that
the proposed amendment had not been brought before the court in a way which gave
a proper opportunity for argument and doubted anyway whether the amendment
could be so framed as to disclose a common purpose of the shippers or any class of the
shippers. Fletcher Moulton LJ, at p 1042, considered that making a declaration of the
type suggested would be contrary to the practice of the courts and that subsequent
claims by individual cargo-owners relying on such a declaration to recover damages
would constitute new claims which would be time-barred, as the limitation period had
now expired.
45. The readiness of English courts to give judgments declaring legal rights where it
would serve a useful purpose has much increased since 1910. An important step was
the decision of the Court of Appeal in Guaranty Trust Co of New York v Hannay & Co
[1915] 2 KB 536, which held that a declaration can be granted at the instance of a
Page 17claimant even if the claimant has no cause of action against the defendant. Two cases
decided together by the Court of Appeal in 1921 showed that there is no reason in
principle why a claim for a declaration of the kind suggested by Buckley LJ in Markt
cannot be brought as a representative action. In David Jones v Cory Bros & Co Ltd
(1921) 56 LJ 302; 152 LT Jo 70, five individuals sued on their own behalf and on behalf
of all other underground and surface workmen employed at the defendant’s colliery
on three specified days in September 1919. They alleged that on those three days the
safety lamps in use at the colliery were not in accordance with statutory requirements,
were insufficient in number and were not properly examined; and that in consequence
the workmen justifiably refused to go to work and lost the wages they would
otherwise have earned and were entitled to damages. In Thomas v Great Mountain
Collieries Co, which was heard at the same time, two claimants sued the owner of
another colliery for loss of wages, alleging breach of statutory duty in not having a
weighing machine to weigh coal as near the pit mouth as was reasonably practicable.
The workmen were divided into two classes - one comprising all workmen whose
wages depended on the amount of coal gotten and the other comprising all other
underground and surface workmen. The claimants sued on their own behalf and on
behalf of the class they respectively represented.
46. In each action the claims were divisible under three heads: (1) claims for
declarations upon matters in which the classes represented were alleged to have a
common interest; (2) claims for damages by the individual named claimants; and (3)
claims for damages by the individual members of the classes represented.
Unfortunately, only a bare summary of the judgments is reported. But this records that
the Court of Appeal by a majority (Bankes and Atkin LJJ, with Scrutton LJ dissenting)
held that the claimants were entitled to sue in a representative capacity as regards
claims that came within (1) and (2), but not as regards claims for damages by the
individual members of the classes represented.
47. In Prudential Assurance Co Ltd v Newman Industries Ltd [1981] Ch 229 the
claimant brought a derivative action as a minority shareholder of the first defendant
company claiming damages on behalf of the company against two of its directors for
breach of duty and conspiracy. At the start of the hearing the claimant applied to
amend its statement of claim to add a personal claim against the directors and the
company, brought in a representative capacity on behalf of all the shareholders. The
relief sought was a declaration that those shareholders who had suffered loss asa
result of the alleged conspiracy were entitled to damages. The judge (Vinelott J)
allowed the amendment. He distinguished Markt and followed David Jones v Cory Bros
in holding that a representative claim for a declaration could be pursued
notwithstanding that each member of the class of persons represented had a separate
cause of action. Although the personal claim was later held by the Court of Appeal in
Prudential Assurance Co Ltd v Newman Industries Ltd (No 2) [1981] Ch 204 at 222 to be
Page 18misconceived as a matter of substantive law, the Court of Appeal cast no doubt on the
use of the representative procedure.
48. This decision was important in demonstrating the potential for a bifurcated
process whereby issues common to the claims of a class of persons may be decided in
a representative action which, if successful, can then form a basis for individual claims
for redress. More generally, the Prudential case marked a welcome revival of the spirit
of flexibility which characterised the old case law.
(d) Claims for damages
49. In the cases so far mentioned where claims were held to come within the scope
of the representative rule, the relief claimed on behalf of the represented class was
limited to a declaration of legal rights. It was accepted or held that the named
claimants could only claim damages or other monetary relief in their personal capacity.
In Markt Fletcher Moulton LJ expressed the view, at pp 1035 and 1040-1041, that
damages are “a personal relief” and that:
“no representative action can lie where the sole relief sought
is damages, because they have to be proved separately in the
case of each plaintiff, and therefore the possibility of
representation ceases.”
50. In many cases, of which Markt was one, it is clearly correct that the assessment
of damages depends on circumstances personal to each individual claimant. In such
cases it is unlikely to be practical or fair to assess damages on a common basis and
without each individual claimant’s participation in the proceedings. However, this is
not always so, and representative actions for damages have sometimes been allowed.
For example, in the case of insurance underwritten by Lloyd’s syndicates, which are
not separate legal entities, it is standard practice for a single member of the syndicate
(usually the leading underwriter) to be named as a representative claimant or
defendant suing, or being sued, for themselves and all the other members. There is no
difficulty in awarding damages for or against the representative in such proceedings, as
the calculation of any damages which the members of the syndicate are collectively
entitled to recover or liable to pay does not depend on how the risk is divided among
the members of the syndicate.
51. In Pan Atlantic Insurance Co Ltd v Pine Top Insurance Co Ltd [1989] 1 Lloyd’s Rep
568 the claimant companies sued on behalf of themselves and members of a syndicate
Page 19which had reinsured on a quota share basis a proportion of the risks they had
underwritten, claiming under contracts which provided excess of loss reinsurance
cover for the claimants and their quota share reinsurers. The Court of Appeal rejected
an argument that the claimants were not entitled to sue in a representative capacity. It
made no difference that there was a dispute between one of the claimants and some
members of the syndicate about the validity of the quota share reinsurance, since as
Lloyd LJ said, at p 571: “the question is whether the parties have the same interest as
against the defendants; not whether they have the same interest as between
themselves”.
52. In Irish Shipping Ltd v Commercial Union Assurance Co plc (The “Irish Rowan”)
[1991] 2 QB 206 numerous insurers had subscribed in various proportions to a policy of
marine insurance. The Court of Appeal accepted that, as a matter of law, each
subscription constituted a separate contract of insurance (of which there were said to
be 77 in all). Claims for losses allegedly covered by the policy were made by suing two
of the insurers as representative defendants. The Court of Appeal rejected an
argument that claims for debt or damages could not be included in a representative
action, merely because they are made by numerous claimants individually or resisted
by numerous defendants individually, and held that the action could continue as a
representative action. While the policy terms contained a broadly worded leading
underwriter clause, the presence of this clause was not essential to the decision: see
Bank of America National Trust and Savings Association v Taylor (The Kyriaki) [1992] 1
Lloyd’s Rep 484, 493-494; National Bank of Greece SA v Outhwaite [2001] CLC 591,
para 31.
53. In EMI Records Ltd v Riley [1981] 1 WLR 923, and in Independiente Ltd v Music
Trading On-Line (HK) Ltd [2003] EWHC 470 (Ch), the claimants sued in a representative
capacity on behalf of all members of the British Phonographic Industry Ltd (“BPI”), a
trade association for the recorded music industry (and also in the latter case on behalf
of Phonographic Performance Ltd), claiming damages for breach of copyright in selling
pirated sound recordings. In each case the claims were allowed to proceed as
representative actions. Because it was accepted or could safely be assumed that the
owner of the copyright in any pirated recording was a member of the represented
class, this procedure enabled breach of copyright to be proved and damages to be
awarded without the need to prove which particular pirated recordings had been sold
in what quantities. Again, what mattered was that the members of the class had a
community of interest in suing the defendant.
54. In EMI Records it was asserted, and not disputed by the defendants, that the
members of the BPI had consented to all sums recovered in actions for breach of
copyright being paid to the BPI: see [1981] 1 WLR 923, 925. In Independiente, however,
Page 20this assertion was disputed and Morritt V-C found that there was no binding
agreement that any money recovered should go to the BPI: see [2003] EWHC 470 (Ch),
paras 16 and 28. He nevertheless held, at paras 28 and 39, that the claim was properly
brought as a representative action, observing that what the claimants did with any
damages recovered was a matter for them or between them, the BPI and the class
members, and not between them and the defendants.
55. Although not cited in these cases, the same point had been made long before in
Warrick v Queen’s College Oxford (No 4) (1871) LR 6 Ch App 716, 726, where Lord
Hatherley LC gave an example of:
“classes of shareholders in a railway company who have
different rights inter se, but they may all have a common
enemy in the shape of a fraudulent director, and they may all
join, of course, in one common suit against that director,
although after the common right is established they may
have a considerable litigation among themselves as to who
are the persons entitled to the gains obtained through that
suit.”
While the right enforced in such a common suit would in modern company law be seen
as a right belonging to the company itself, rather than its shareholders, it is clear from
the context that Lord Hatherley had in mind a representative action brought on behalf
of shareholders, as he gave this analogy to explain how in that case a representative
claim could be brought on behalf of all the freehold tenants of a manor to establish
common rights against the lord of the manor even though different tenants or classes
of tenant had different rights as between themselves.
(e) Emerald Supplies
56. In giving the Court of Appeal’s judgment in the present case, the Chancellor, at
[2020] QB 747, para 73, focused on Emerald Supplies Ltd v British Airways plc [2010]
EWCA Civ 1284; [2011] Ch 345 as providing the latest authoritative interpretation of
the representative rule. The decision in that case turned, however, on the particular
way in which the class of represented persons had been defined. The claimants alleged
that the defendant airline was a party to agreements or concerted practices with other
airlines to fix prices for air freight charged for importing cut flowers into the UK. They
claimed on behalf of all “direct or indirect purchasers of air freight services, the prices
for which were inflated by the agreements or concerted practices”, a declaration that
damages were recoverable in principle from the defendant by those purchasers. The
Page 21Court of Appeal upheld a decision to strike out the representative claim on the basis
that, in the way the class had been defined, the issue of liability would have to be
decided before it could be known whether or not a person was a member of the
represented class and therefore bound by the judgment: see paras 62-63 and 65. Such
an approach would not be just, not least because, if the claim failed, no purchasers of
air freight services apart from the named claimants would be bound by the result.
57. The Court of Appeal in Emerald Supplies also considered that a second difficulty
with the class definition was that the members of the represented class did not all
have the same interest in the claim, as there was a conflict of interest between direct
and indirect purchasers of air freight services: see paras 28-29 and 64. If it was shown
that prices had been inflated by agreements or concerted practices to which the
defendant was a party, it would be in the interests of direct purchasers to seek to
prove that they had absorbed the higher prices in order to avoid a potential defence
that they had suffered no loss because the higher prices had been passed on to
“indirect purchasers” (understood to include sub-purchasers). On the other hand, it
would be in the interests of such indirect purchasers to seek to prove that the higher
prices had indeed been passed on to them.
58. It seems to me that this second difficulty might have been avoided either by
altering the class definition to exclude sub-purchasers or by following the approach
adopted in Prudential of claiming a declaration that those members of the class who
had suffered damage as a result of the alleged price fixing were entitled to damages.
However, those possibilities do not appear to have been considered. I think that the
judge in Rendlesham Estates plc v Barr Ltd [2014] EWHC 3968 (TCC); [2015] 1 WLR
3663 - a case relied on by Google on this appeal - was therefore wrong to conclude
from Emerald Supplies, at para 90, that “if damage is an ingredient of the cause of
action a representative claim could not be maintained”. The Court of Appeal in
Emerald Supplies did not doubt the correctness of the Prudential decision, where a
representative claim was allowed to proceed although damage was an ingredient of
the cause of action. As Professor Rachael Mulheron, a leading expert in this field, has
persuasively argued, it should likewise have been possible in Emerald Suppliesto adopt
a bifurcated process in which the questions whether prices had been inflated by
agreements or concerted practices and whether passing on was in principle available
as a defence were decided in a representative action. If successful, this action could
then have formed the basis for further proceedings to prove the fact and amount of
damage in individual cases: see Mulheron R, “Emerald Supplies Ltd v British Airways
plc; A Century Later, The Ghost of Markt Lives On” [2009] Comp Law 159, 171.
Page 22 (f) Commonwealth cases
59. The highest courts of Australia, Canada and New Zealand have all adopted a
broad and flexible approach in interpreting representative rules derived from the
English rule.
(i) Australia
60. In Carnie v Esanda Finance Corpn Ltd (1994) 127 ALR 76 the High Court of
Australia held that the fact that the claims arose under separate contracts did not
prevent the named claimants and the persons represented from having “the same
interest” in proceedings. It was enough to satisfy this requirement that there was a
community of interest in the determination of a substantial question of law or fact that
arose in the proceedings. Commenting on an argument that the representative rule
was an inadequate basis for a “class action”, which required a comprehensive
legislative regime, Toohey and Gaudron JJ (with whom Mason CJ, Deane and Dawson JJ
generally agreed) said, at p 91:
“... it is true that rule 13 lacks the detail of some other rules
of court. But there is no reason to think that the Supreme
Court of New South Wales lacks the authority to give
directions as to such matters as service, notice and the
conduct of proceedings which would enable it to monitor and
finally to determine the action with justice to all concerned.
The simplicity of the rule is also one of its strengths, allowing
it to be treated as a flexible rule of convenience in the
administration of justice and applied ‘to the exigencies of
modern life as occasion requires’. The court retains the
power to reshape proceedings at a later stage if they become
impossibly complex or the defendant is prejudiced.”
(ii) Canada
61. In Western Canadian Shopping Centres Inc v Dutton [2001] 2 SCR 534, paras 38-
48, the Supreme Court of Canada held that representative actions should be allowed
to proceed where the following conditions are met: (1) the class is capable of clear
definition; (2) there are issues of fact or law common to all class members; (3) success
for one class member means success for all (although not necessarily to the same
extent); and (4) the proposed representative adequately represents the interests of
Page 23the class. If these conditions are met the court must also be satisfied, in the exercise of
its discretion, that there are no countervailing considerations that outweigh the
benefits of allowing the representative action to proceed. The Supreme Court held that
the conditions were met by the claimants in Dutton, who sued as representatives of a
group of investors complaining that the defendant had breached fiduciary duties to the
investors by mismanaging their funds.
62. Giving the judgment of the court, McLachlin CJ, at para 47, distinguished its
earlier decision in General Motors of Canada Ltd v Naken [1983] 1 SCR 72, where a
representative action had been disallowed. In Naken the action was brought on behalf
of purchasers of new Firenza motor vehicles against the manufacturer, complaining
that the quality of the vehicles had been misrepresented or was not as warranted in
advertisements, other published materials and contracts which were partly oral and
partly written. Damages were claimed limited to $1,000 per person. The claims were
held to be unsuitable for resolution through a representative action, principally
because determining both liability and damages would have required particularised
evidence and fact-finding in relation to each individual purchaser.
63. McLachlin CJ also commented, at para 46, that over the period since Naken was
decided the benefits of class actions had become manifest. She identified, at paras 27-
29, three important advantages which such actions offer over a multiplicity of
individual suits: (1) avoiding unnecessary duplication in fact-finding and legal analysis;
(2) making economical the prosecution of claims that would otherwise be too costly to
prosecute individually; and (3) serving efficiency and justice by ensuring that actual
and potential wrongdoers who cause widespread but individually minimal harm take
into account the full costs of their conduct.
64. McLachlin CJ further observed, at para 34, that, while it would clearly be
advantageous if there existed a comprehensive legislative framework regulating class
actions, in its absence “the courts must fill the void”.
(iii) New Zealand
65. The Supreme Court of New Zealand has recently considered the use of the
representative procedure in Southern Response Earthquake Services Ltd v Ross [2020]
NZSC 126. This was a representative action brought on behalf of some 3,000
policyholders who had settled insurance claims for damage to their homes caused by
earthquakes in the Canterbury region of New Zealand. The claimants alleged that the
policyholders had been misled by the insurers about the cost of remedying the
damage, with the result that they had settled their claims on a less favourable basis
Page 24than otherwise would have been the case. The insurers did not oppose the action
being brought on a representative basis, but argued that the class represented should
be limited to policyholders who completed a form electing to opt into the proceedings.
It was agreed that the proceedings would need to be heard in two stages. The first
stage would deal with issues common to all members of the represented class. If the
claimants succeeded at that stage in whole or in part, there would need to be a second
stage, in which questions of relief were addressed. It was also agreed that, at the
second stage, it would be necessary for all of the policyholders represented to take
active steps - that is, to opt in - if they wished to establish their individual claims.
66. The New Zealand Supreme Court affirmed the decision of the Court of Appeal
that the claim should be allowed to continue on an opt out basis. In doing so, the
Supreme Court rejected an argument that it should not develop an opt out regime in
the absence of a statutory framework and gave guidance on various matters relating to
supervision of opt out representative proceedings.
(g) Principles governing use of the representative procedure
67. Although the world has changed out of all recognition since the representative
procedure was devised by the Court of Chancery, it has done so in ways which have
made the problems to which the procedure provided a solution more common and
often vastly bigger in scale. The mass production of goods and mass provision of
services have had the result that, when legally culpable conduct occurs, a very large
group of people, sometimes numbering in the millions, may be affected. As the
present case illustrates, the development of digital technologies has added to the
potential for mass harm for which legal redress may be sought. In such cases it is
necessary to reconcile, on the one hand, the inconvenience or complete impracticality
of litigating multiple individual claims with, on the other hand, the inconvenience or
complete impracticality of making every prospective claimant (or defendant) a party to
a single claim. The only practical way to “come at justice” is to combine the claims in a
single proceeding and allow one or more persons to represent all others who share the
same interest in the outcome. When trying all the individual claims is not feasible, the
adages of Lord Eldon quoted by Lord Macnaghten in Ellis remain as pertinent as ever:
that it is better to go as far as possible towards justice than to deny it altogether and
that, if you cannot realistically make everybody interested a party, you should ensure
that those who are parties will “fairly and honestly try the right”.
68. I agree with the highest courts of Australia, Canada and New Zealand that, while
a detailed legislative framework would be preferable, its absence (outside the field of
competition law) in this country is no reason to decline to apply, or to interpret
restrictively, the representative rule which has long existed (and has had a legislative
Page 25basis since 1873). I also agree with the view expressed in Carnie that the very simplicity
of the representative rule is in some respects a strength, allowing it to be treated as “a
flexible tool of convenience in the administration of justice” and “applied to the
exigencies of modern life as occasion requires”.
(i) The “same interest” requirement
69. In its current form in CPR rule 19.6 the rule imposes no limit (either as a
minimum or maximum) on the number of people who may be represented. Only one
condition must be satisfied before a representative claim may be begun or allowed to
continue: that is, that the representative has “the same interest” in the claim as the
person(s) represented.
70. The phrase “the same interest” is capable of bearing a range of meanings and
requires interpretation. In interpreting the phrase, reference has often been made to
Lord Macnaghten’s statement in Ellis (quoted at para 38 above) that: “Given a
common interest and a common grievance, a representative suit was in order if the
relief sought was in its nature beneficial to all whom the plaintiff proposed to
represent.” This statement has sometimes been treated as if it were a definition
imposing a tripartite test: see eg Smith v Cardiff Corpn[1954] 1 QB 210. Such an
approach seems to me misguided. It is clear from the context that Lord Macnaghten
was not attempting to define “the same interest”, but to convey how limiting the rule
to persons having a beneficial proprietary interest in the claim would be contrary to
the old practice in the Court of Chancery. More profoundly, such a reading of Lord
Macnaghten’s speech shows precisely the rigidity of approach to the application of the
representative rule which he disparaged.
71. The phrase “the same interest”, as it is used in the representative rule, needs to
be interpreted purposively in light of the overriding objective of the civil procedure
rules and the rationale for the representative procedure. The premise for a
representative action is that claims are capable of being brought by (or against) a
number of people which raise a common issue (or issues): hence the potential and
motivation for a judgment which binds them all. The purpose of requiring the
representative to have “the same interest” in the claim as the persons represented is
to ensure that the representative can be relied on to conduct the litigation in a way
which will effectively promote and protect the interests of all the members of the
represented class. That plainly is not possible where there is a conflict of interest
between class members, in that an argument which would advance the cause of some
would prejudice the position of others. Markt and Emerald Supplies are both examples
of cases where it was found that the proposed representative action, as formulated,
could not be maintained for this reason.
Page 2672. As Professor Adrian Zuckerman has observed in his valuable book on civil
procedure, however, a distinction needs to be drawn between cases where there are
conflicting interests between class members and cases where there are merely
divergent interests, in that an issue arises or may well arise in relation to the claims of
(or against) some class members but not others. So long as advancing the case of class
members affected by the issue would not prejudice the position of others, there is no
reason in principle why all should not be represented by the same person: see
Zuckerman on Civil Procedure: Principles of Practice, 4th ed (2021), para 13.49. As
Professor Zuckerman also points out, concerns which may once have existed about
whether the representative party could be relied on to pursue vigorously lines of
argument not directly applicable to their individual case are misplaced in the modern
context, where the reality is that proceedings brought to seek collective redress are
not normally conducted and controlled by the nominated representative, but rather
are typically driven and funded by lawyers or commercial litigation funders with the
representative party merely acting as a figurehead. In these circumstances, there is no
reason why a representative party cannot properly represent the interests of all
members of the class, provided there is no true conflict of interest between them.
73. This purposive and pragmatic interpretation of the requirement is exemplified
by The “Irish Rowan”, where Staughton LJ, at pp 227-228, noted that some of the
insurers might wish to resist the claim on a ground that was not available to others. He
rightly did not regard that circumstance as showing that all the insurers did not have
“the same interest” in the action, or that it was not within the rule, and had “no
qualms about a proceeding which allows that ground to be argued on their behalf by
others”.
74. Even if it were considered inconsistent with the “same interest” requirement, or
otherwise inappropriate, for a single person to represent two groups of people in
relation to whom different issues arise although there is no conflict of interest
between them, any procedural objection could be overcome by bringing two (or more)
representative claims, each with a separate representative claimant or defendant, and
combining them in the same action.
(ii) The court’s discretion
75. Where the same interest requirement is satisfied, the court has a discretion
whether to allow a claim to proceed as a representative action. As with any power
given to it by the Civil Procedure Rules, the court must in exercising its discretion seek
to give effect to the overriding objective of dealing with cases justly and at
proportionate cost: see CPR rule 1.2(a). Many of the considerations specifically
included in that objective (see CPR rule 1.1(2)) - such as ensuring that the parties are
Page 27on an equal footing, saving expense, dealing with the case in ways which are
proportionate to the amount of money involved, ensuring that the case is dealt with
expeditiously and fairly, and allotting to it an appropriate share of the court’s
resources while taking into account the need to allot resources to other cases - are
likely to militate in favour of allowing a claim, where practicable, to be continued as a
representative action rather than leaving members of the class to pursue claims
individually.
76. Four further features of the representative rule deserve mention.
(iii) No requirement of consent
77. First, as the ability to act as a representative under the rule does not depend on
the consent of the persons represented but only on community of interest between
them, there is ordinarily no need for a member of the represented class to take any
positive step, or even to be aware of the existence of the action, in order to be bound
by the result. The rule does not confer a right to opt out of the proceedings (though a
person could, at least in theory, apply to the court for a direction under rule 19.6(3)
that the named claimant (or defendant) may not represent them or under rule 19.6(4)
that any judgment given will not be binding on them). It is, however, always open to
the judge managing the case to impose a requirement to notify members of the class
of the proceedings and establish a simple procedure for opting out of representation, if
this is considered desirable. Equally, if there are circumstances which make it
appropriate to limit the represented class to persons who have positively opted into
the litigation, it is open to the judge to make this a condition of representation. The
procedure is entirely flexible in these respects.
(iv) The class definition
78. Second, while it is plainly desirable that the class of persons represented should
be clearly defined, the adequacy of the definition is a matter which goes to the court’s
discretion in deciding whether it is just and convenient to allow the claim to be
continued on a representative basis rather than being a precondition for the
application of the rule. Emerald Supplies illustrates a general principle that
membership of the class should not depend on the outcome of the litigation. Beyond
that, whether or to what extent any practical difficulties in identifying the members of
the class are material must depend on the nature and object of the proceedings. In
Duke of Bedford v Ellis, for example, it did not matter that the number and identities of
growers of fruit etc would have been difficult if not impossible to ascertain or that the
class was a fluctuating one: given that the aim was to establish whether anyone who
Page 28was a grower had preferential rights, all that mattered was that there would be no real
difficulty in determining whether a particular person who claimed a preferential right
to a vacant stand at Covent Garden was a grower or not: see [1901] AC 1 at 11. In
some cases, however, for example where the viability of a claim for damages depends
on demonstrating the size of the class or who its members are, such practical
difficulties might well be significant.
(v) Liability for costs
79. Third, as persons represented by a representative claimant or defendant will
not normally themselves have been joined as parties to the claim, they will not
ordinarily be liable to pay any costs incurred by the representative in pursuing (or
defending) the claim. That does not prevent the court, if it is in the interests of justice
to do so, from making an order requiring a represented person to pay or contribute to
costs and giving permission for the order to be enforced against that person pursuant
to CPR rule 19.6(4)(b). Alternatively, such an order could be made pursuant to the
general jurisdiction of the court to make costs orders against non-parties. It is difficult,
however, to envisage circumstances in which it could be just to order a represented
person to contribute to costs incurred by a claimant in bringing a representative claim
which the represented person did not authorise. On the other hand, a commercial
litigation funder who finances unsuccessful proceedings is likely to be ordered to pay
the successful party’s costs at least to the extent of the funding: see Davey v Money
[2020] EWCA Civ 246; [2020] 1 WLR 1751. That principle is no less applicable where the
proceedings financed are a representative action.
(vi) The scope for claiming damages
80. Finally, as already discussed, it is not a bar to a representative claim that each
represented person has in law a separate cause of action nor that the relief claimed
consists of or includes damages or some other monetary relief. The potential for
claiming damages in a representative action is, however, limited by the nature of the
remedy of damages at common law. What limits the scope for claiming damages in
representative proceedings is the compensatory principle on which damages for a civil
wrong are awarded with the object of putting the claimant - as an individual - in the
same position, as best money can do it, as if the wrong had not occurred. In the
ordinary course, this necessitates an individualised assessment which raises no
common issue and cannot fairly or effectively be carried out without the participation
in the proceedings of the individuals concerned. A representative action is therefore
not a suitable vehicle for such an exercise.
Page 2981. In cases where damages would require individual assessment, there may
nevertheless be advantages in terms of justice and efficiency in adopting a bifurcated
process - as was done, for example, in the Prudential case - whereby common issues of
law or fact are decided through a representative claim, leaving any issues which
require individual determination - whether they relate to liability or the amount of
damages - to be dealt with at a subsequent stage of the proceedings. In Prudential
[1981] Ch 229, 255, Vinelott J expressed the view (obiter) that time would continue to
run for the purpose of limitation until individual claims for damages were brought by
the persons represented; see also the dicta of Fletcher Moulton LJ in Markt [1910] 2 KB
1021, 1042, referred to at para 44 above. The court in Prudential did not have cited to
it, however, the decision of the Court of Appeal in Moon v Atherton [1972] 2 QB 435. In
that case a represented person applied to be substituted for the named claimant after
the limitation period had expired when the claimant (and all the other represented
persons) no longer wished to continue the action. The Court of Appeal, in allowing the
substitution, held that the defendant was not thereby deprived of a limitation defence,
as for the purpose of limitation the represented person was already a party to the
action, albeit not a “full” party. It might be clearer to say that, although the
represented person did not become a “party” until substituted as the claimant, an
action was brought within the meaning of the statute of limitation by that person
when the representative claim was initiated. Such an analysis has been adopted in
Australia, including by the New South Wales Court of Appeal in Fostif Pty Ltd v
Campbells Cash & Carry Pty Ltd[2005] NSWCA 83; (2005) 63 NSWLR 203, and by the
New Zealand Supreme Court in Credit Suisse Private Equity v Houghton [2014] NZSC 37.
82. There is no reason why damages or other monetary remedies cannot be
claimed in a representative action if the entitlement can be calculated on a basis that is
common to all the members of the class. Counsel for the claimant, Hugh Tomlinson
QC, gave the example of a claim alleging that every member of the class was wrongly
charged a fixed fee; another example might be a claim alleging that all the class
members acquired the same product with the same defect which reduced its value by
the same amount. In such cases the defendant’s monetary liability could be
determined as a common issue and no individualised assessment would be needed.
The same is true where loss suffered by the class as a whole can be calculated without
reference to the losses suffered by individual class members - as in the cases
mentioned at para 53 above. Such an assessment of loss on a global basis is sometimes
described as a “top down” approach, in contrast to a “bottom up” approach of
assessing a sum which each member of the class is individually entitled to recover.
83. The recovery of money in a representative action on either basis may give rise
to problems of distribution to the members of the class, about which the
representative rule is silent. Although in Independiente Morritt V-C was untroubled by
such problems, questions of considerable difficulty would arise if in the present case
Page 30the claimant was awarded damages in a representative capacity with regard to how
such damages should be distributed, including whether there would be any legal basis
for paying part of the damages to the litigation funders without the consent of each
individual entitled to them: see Mulheron R, “Creating and Distributing Common Funds
under the English Representative Rule” (2021) King’s Law Journal 1-33. Google has not
relied on such difficulties as a reason for disallowing a representative action, however,
and as these matters were only touched on in argument, I will say no more about
them.
E. THE REPRESENTATIVE CLAIM IN THIS CASE
84. In the present case I could see no legitimate objection to a representative claim
brought to establish whether Google was in breach of the DPA 1998 and, if so, seeking
a declaration that any member of the represented class who has suffered damage by
reason of the breach is entitled to be paid compensation. The individual claims that
could theoretically have been brought by each iPhone user who was affected by the
Safari workaround clearly raise common issues; and it is not suggested that there is
any conflict of interest among the members of the represented class. For the purpose
of CPR rule 19.6(1), all would therefore have the same interest in such a claim as the
representative claimant. There is no suggestion that Mr Lloyd is an unsuitable person
to act in that capacity. Although Google has argued that there would be practical
difficulties in identifying whether an individual falls within the class definition, even on
Google’s evidence it is evident that the number of people affected by the Safari
workaround was extremely large and it is unclear at this stage of the litigation how
serious the difficulties of proof would actuallybe. Moreover, even if only a few
individuals were ultimately able to obtain compensation on the basis of a declaratory
judgment, I cannot see why that should provide a reason for refusing to allow a
representative claim to proceed for the purpose of establishing liability.
85. The claimant has not proposed such a bifurcated process, however. That is
doubtless because success in the first, representative stage of such a process would
not itself generate any financial return for the litigation funders or the persons
represented. Funding the proceedings could therefore only be economic if pursuing
separate damages claims on behalf of those individuals who opted into the second
stage of the process would be economic. For the reasons discussed at paras 25-28
above and emphasised in argument by counsel for the claimant, it clearly would not. In
practice, therefore, as both courts below accepted, a representative action for
damages is the only way in which the claims can be pursued.
Page 31(1) The formulation of the claim fordamages
86. In formulating the claim made in this action, the claimant has not adopted the
“top down” approach of claiming compensation for damage suffered by the class as a
whole without reference to the entitlements of individual class members. The claim
advanced is for damages calculated from the “bottom up”. The way in which the
claimant seeks to obviate the need for individualised assessment is by claiming
damages for each class member on what is described as a “uniform per capita basis”.
87. The difficulty facing this approach is that the effect of the Safari workaround
was obviously not uniform across the represented class. No challenge is or could
reasonably be made to the judge’s findings, at [2018] EWHC 2599 (QB); [2019] 1 WLR
1265, para 91, that:
“… some affected individuals were ‘super users’- heavy
internet users. They will have been ‘victims’ of multiple
breaches, with considerable amounts of [browser generated
information] taken and used throughout the Relevant Period.
Others will have engaged in very little internet activity.
Different individuals will have had different kinds of
information taken and used. No fewer than 17 categories of
personal data are identified in the claim documents. The
specified categories of data vary in their sensitivity, some of
them being ‘sensitive personal data’ within the meaning of
the section 2 of the DPA (such as sexuality, or ethnicity). …
But it is not credible that all the specified categories of data
were obtained by Google from each represented claimant. …
The results of the acquisition and use will also have varied
according to the individual, and their attitudes towards the
acquisition, disclosure and use of the information in
question.”
If liability is established, the ordinary application of the compensatory principle would
therefore result in different awards of compensation to different individuals.
Furthermore, the amount of any compensation recoverable by any member of the
class would depend on a variety of circumstances particular to that individual.
Individualised assessment of damages would therefore be required.
88. The claimant seeks to overcome this difficulty in one or other of two ways. Both
rely on the proposition that an individual is entitled to compensation for any (non-
Page 32trivial) contravention of the DPA 1998 without the need to prove that the individual
suffered any financial loss or distress. On that footing it is argued, first of all, that
general damages can be awarded on a uniform per capita basis to each member of the
represented class without the need to prove any facts particular to that individual. The
draft particulars of claim plead that the uniform sum awarded should reflect “the
serious nature of the breach, in particular (but non-exhaustively):
“(a) The lack of consent or knowledge of the
Representative Claimant and each member of the Claimant
Class to the defendant’s collection and use of their personal
data.
(b) The fact that such collection and use was contrary to
the defendant’s public statements.
(c) The fact that such collection and use was greatly to
the commercial benefit of the defendant.
(d) The fact that the defendant knew or ought to have
known of the operation of the Safari Workaround from a very
early stage during the Relevant Period. …”
I interpose that factor (c), although no doubt true in relation to the class as a whole,
plainly could not in fact be established in relation to any individual class member
without evidence of what use, if any, was actually made of personal data of that
individual by Google. If there is to be no individualised assessment, this factor must
therefore be left out of account.
89. The alternative case pleaded is that each member of the class is entitled to
damages assessed as an amount which they could reasonably have charged for
releasing Google from the duties which it breached. Again, it is contended that such
damages should be assessed on a uniform per capita basis, “reflecting the generalised
standard terms (rather than individuated basis) on which [Google] does business”.
(2) Section 13 of the DPA 1998
90. The claim for compensation made in the present case is founded (exclusively)
on section 13 of the DPA 1998. This provides:
Page 33 “(1) An individual who suffers damage by reason of any
contravention by a data controller of any of the requirements
of this Act is entitled to compensation from the data
controller for that damage.
(2) An individual who suffers distress by reason of any
contravention by a data controller of any of the requirements
of this Act is entitled to compensation from the data
controller for that distress if -
(a) the individual also suffers damage by reason of the
contravention, or
(b) the contravention relates to the processing of
personal data for the special purposes.
(3) In proceedings brought against a person by virtue of
this section it is a defence to prove that he had taken such
care as in all the circumstances was reasonably required to
comply with the requirement concerned.”
91. Section 13 was intended to implement article 23 of the Data Protection
Directive. This stated:
“1. Member states shall provide that any person who has
suffered damage as a result of an unlawful processing
operation or of any act incompatible with the national
provisions adopted pursuant to this Directive is entitled to
receive compensation from the controller for the damage
suffered.
2. The controller may be exempted from this liability, in
whole or in part, if he proves that he is not responsible for
the event giving rise to the damage.”
92. Two initial points can be made about the wording and structure of section 13.
First, to recover compensation under this provision it is not enough to prove a breach
by a data controller of its statutory duty under section 4(4) of the Act: an individual is
Page 34only entitled to compensation under section 13 where “damage” - or in some
circumstances “distress” - is suffered as a consequence of such a breach of duty.
Second, it is plain from subsection (2) that the term “damage” as it is used in section
13 does not include “distress”. The term “material damage” is sometimes used to
describe any financial loss or physical or psychological injury, but excluding distress (or
other negative emotions not amounting to a recognised psychiatric illness): see eg
Watkins v Secretary of State for the Home Department [2006] UKHL 17; [2006] 2 AC
395, para 7. Adopting this terminology, on a straightforward interpretation the term
“damage” in section 13 refers only to material damage and compensation can only be
recovered for distress if either of the two conditions set out in subsection (2) is met.
(3) Vidal-Hall v Google Inc
93. The effect of section 13 was considered by the Court of Appeal in Vidal-Hall v
Google Inc [2016] QB 1003 on facts which, in terms of the generic allegations made,
were identical to those on which the present claim is based. The three claimants
sought damages arising out of the Safari workaround on two alternative bases: (1) at
common law for misuse of private information; and (2) under section 13 of the DPA
1998. As in the present case, permission to serve the proceedings outside the
jurisdiction was opposed by Google. The main issues raised were: (1) whether misuse
of private information is a tort for the purpose of the rules providing for service out of
the jurisdiction; and (2) whether compensation can be recovered for distress under
section 13 of the DPA 1998 in the absence of financial loss. The judge decided both
issues in the claimants’ favour and the Court of Appeal affirmed that decision, for
reasons given in a judgment written by Lord Dyson MR and Sharp LJ, with which
Macfarlane LJ agreed.
94. On the second issue Google submitted that, as discussed above, the term
“damage” in section 13 must mean material damage, which for practical purposes
limits its scope to financial loss. Hence section 13(2) has the effect that an individual
may only recover compensation for distress suffered by reason of a contravention by a
data controller of a requirement of the Act if either (a) the contravention also causes
the individual to suffer financial loss or (b) the contravention relates to the processing
of personal data for “special purposes” - which are defined as journalistic, artistic or
literary purposes (see section 3). It was not alleged that either of those conditions was
satisfied in the Vidal-Hall case.
95. The Court of Appeal accepted that section 13(2) does indeed have this meaning
but held that this makes it incompatible with article 23 of the Data Protection
Directive, which section 13 of the DPA 1998 was meant to implement. This is because
the word “damage” in article 23 is to be interpreted as including distress, which is the
Page 35primary form of damage likely to be caused by an invasion of data privacy; and article
23 does not permit national laws to restrict the right to receive compensation for
“damage” where it takes the form of distress. The Court of Appeal considered whether
it is possible to interpret section 13 in a way which achieves the result sought by the
Directive, but concluded that the words of section 13 are not capable of being
interpreted in such a way and that the limits set by Parliament to the right to
compensation for breaches of the DPA 1998 are a fundamental feature of the UK
legislative scheme. In the words of Lord Dyson MR and Sharp LJ in their joint judgment,
at para 93, if the court were to disapply the limits on the right to compensation for
distress set out in section 13(2), “the court would, in effect, be legislating against the
clearly expressed intention of Parliament on an issue that was central to the scheme as
a whole”.
96. The Court of Appeal nevertheless held that section 13(2) should be disapplied
on the ground that it conflicts with articles 7 and 8 of the Charter of Fundamental
Rights of the European Union (“the EU Charter”). Article 7 of the EU Charter is in
materially similar terms to article 8 of the European Convention for the Protection of
Human Rights and Fundamental Freedoms (“the Convention”) and provides that
“[e]veryone has the right to respect for his or her private and family life, home and
communications”. Article 8(1) provides that “[e]veryone has the right to the protection
of personal data concerning him or her”. In addition, article 47 requires that
“[e]veryone whose rights and freedoms guaranteed by the law of the Union are
violated has the right to an effective remedy before a tribunal …”. The Court of Appeal
decided that, in order to provide an effective remedy for the rights guaranteed by
articles 7 and 8 of the EU Charter, it was necessary that national law should give effect
to the obligation under article 23 of the Data Protection Directive to provide a right to
receive compensation from the data controller for any damage, including distress,
suffered as a result of an unlawful processing operation. That result could and should
be achieved by disapplying section 13(2) of the DPA 1998, thus enabling section 13(1)
to be interpreted compatibly with article 23: see [2016] QB 1003, para 105.
(4) Misuse of private information
97. The Court of Appeal in Vidal-Hall also held that the claims for damages for
misuse of private information made by the claimants in that case were properly
classified as claims in tort for the purpose of service out of the jurisdiction and had a
real prospect of success. As described at paras 18-25 of the judgment, the tort of
misuse of private information evolved out of the equitable action for breach of
confidence, influenced by the protection of the right to respect for private life
guaranteed by article 8 of the Convention. The critical step in its emergence as a
distinct basis for a claim was the identification of privacy of information as worthy of
Page 36protection in its own right, irrespective of whether the information was imparted in
circumstances which give rise to a duty of confidence: see Campbell v MGN Ltd [2004]
UKHL 22; [2004] 2 AC 457. As Lord Hoffmann put it in Campbell, at para 50:
“What human rights law has done is to identify private
information as something worth protecting as an aspect of
human autonomy and dignity.”
98. The complaint in Campbell was about the publication of private information.
Lord Nicholls of Birkenhead described the “essence of the tort”, at para 14, as “misuse
of private information”. He also noted, however, at para 15, that an individual’s privacy
can be invaded in ways not involving publication of information, and subsequent cases
have held that intrusion on privacy, without any misuse of information, is actionable:
see PJS v News Group Newspapers Ltd [2016] UKSC 26; [2016] 2 AC 1081, paras 58-60.
It is misuse of information, however, which is primarily relevant in this case, and I shall
generally - as counsel did in argument - use the label for the tort of “misuse of private
information”.
99. To establish liability for misuse of private information (or other wrongful
invasion of privacy), it is necessary to show that there was a reasonable expectation of
privacy in the relevant matter. As the Court of Appeal (Sir Anthony Clarke MR, Laws
and Thomas LJJ) explained in upholding a claim to restrain the publication of
photographs taken in a public place of the child of the well-known author, JK Rowling,
in Murray v Express Newspapers plc [2008] EWCA Civ 446; [2009] Ch 481, para 36:
“… the question whether there is a reasonable expectation of
privacy is a broad one, which takes account of all the
circumstances of the case. They include the attributes of the
claimant, the nature of the activity in which the claimant was
engaged, the place at which it was happening, the nature and
purpose of the intrusion, the absence of consent and
whether it was known or could be inferred, the effect on the
claimant and the circumstances in which and the purposes
for which the information came into the hands of the
publisher.”
If this test is met, in cases where freedom of expression is involved the court must then
undertake a “balancing exercise” to decide whether in all the circumstances the
interests of the owner of the private information must yield to the right to freedom of
Page 37expression conferred on the publisher by article 10 of the Convention: see eg
McKennitt v Ash [2006] EWCA Civ 1714; [2008] QB 73, para 9.
(5) Gulati v MGN Ltd
100. The measure of damages for wrongful invasion of privacy was considered in
depth in Gulati v MGN Ltd [2015] EWHC 1482 (Ch); [2016] FSR 12 and [2015] EWCA Civ
1291; [2017] QB 149 by Mann J and by the Court of Appeal. The eight test claimants in
that case were individuals in the public eye whose mobile phones were hacked by
newspapers, leading in some instances to the publication of articles containing
information obtained by this means. The newspapers admitted liability for breach of
privacy but disputed the amount of damages. Their main argument of principle was
that (in the absence of material damage) all that could be compensated for was
distress caused by their unlawful activities: see [2016] FSR 12, para 108. The judge
rejected that argument. He said, at para 111, that he did not see why “distress (or
some similar emotion), which would admittedly be a likely consequence of an invasion
of privacy, should be the only touchstone for damages”. In his view:
“While the law is used to awarding damages for injured
feelings, there is no reason in principle … why it should not
also make an award to reflect infringements of the right
itself, if the situation warrants it.”
101. The judge referred to cases in which damages have been awarded to very young
children (only ten months or one year old) for misuse of private information by
publishing photographs of them even though, because of their age, they could not
have suffered any distress: see AAA v Associated Newspapers Ltd [2012] EWHC 2103
(QB); [2013] EMLR 2; and Weller v Associated Newspapers Ltd[2014] EWHC 1163 (QB);
[2014] EMLR 24. He concluded, at para 144:
“I shall therefore approach the consideration of quantum in
this case on the footing that compensation can be given for
things other than distress, and in particular can be given for
the commission of the wrong itself so far as that commission
impacts on the values protected by the right.”
Later in the judgment, at para 168, the judge referred back to his finding that:
Page 38 “the damages should compensate not merely for distress …,
but should also compensate (if appropriate) for the loss of
privacy or autonomy as such arising out [of] the infringement
by hacking (or other mechanism) as such.”
102. The Court of Appeal affirmed this decision: [2015] EWCA Civ 1291; [2017] QB
149. Arden LJ (with whom Rafferty and Kitchin LJJ agreed) held, at para 45, that:
“the judge was correct to conclude that the power of the
court to grant general damages was not limited to distress
and could be exercised to compensate the claimants also for
the misuse of their private information. The essential
principle is that, by misusing their private information, MGN
deprived the claimants of their right to control the use of
private information.”
Arden LJ justified this conclusion, at para 46, on the basis that:
“Privacy is a fundamental right. The reasons for having the
right are no doubt manifold. Lord Nicholls of Birkenhead put
it very succinctly in Campbell v MGN Ltd [2004] 2 AC 457,
para 12: ‘[Privacy] lies at the heart of liberty in a modern
state. A proper degree of privacy is essential for the well-
being and development of an individual.’”
103. The Court of Appeal in Gulati rejected a submission, also rejected by the judge,
that granting damages for the fact of intrusion into a person’s privacy independently of
any distress caused is inconsistent with the holding of this court in R (WL (Congo)) v
Secretary of State for the Home Department [2011] UKSC 12; [2012] 1 AC 245, paras
97-100, that vindicatory damages are not available as a remedy for violation of a
private right. As Arden LJ pointed out at para 48, no question arose of awarding
vindicatory damages of the kind referred to in WL (Congo), which have been awarded
in some constitutional cases appealed to the Privy Council “to reflect the sense of
public outrage, emphasise the importance of the constitutional right and the gravity of
the breach, and deter further breaches”: see WL (Congo), para 98; Attorney General of
Trinidad and Tobago v Ramanoop [2005] UKPC 15; [2006] 1 AC 328, para 19. Rather,
the purpose of the relevant part of the awards made in Gulati was “to compensate for
the loss or diminution of a right to control formerly private information”.
Page 39104. Mann J’s reference to “loss of privacy or autonomy” and the Court of Appeal’s
explanation that the claimants could be compensated for misuse of their private
information itself because they were deprived of “their right to control [its] use”
convey the point that English common law now recognises as a fundamental aspect of
personal autonomy a person’s freedom to choose and right to control whether and
when others have access to his or her private affairs: see on this point the helpful
discussion by NA Moreham, “Compensating for Loss of Dignity and Autonomy” in
Varuhas J and Moreham N (eds), Remedies for Breach of Privacy (2018) ch 5.
(6) How the present claim is framed
105. On the basis of the decisions of the Court of Appeal in Vidal-Hall and Gulati,
neither of which is challenged by either party on this appeal, it would be open to Mr
Lloyd to claim, at least in his own right: (1) damages under section 13(1) of the DPA
1998 for any distress suffered by reason of any contravention by Google of any of the
requirements of the Act; and/or (2) damages for the misuse of private information
without the need to show that it caused any material damage or distress.
106. Neither of these claims, however, is made in this case. The reasons why no
claim is made in tort for misuse of private information have not been explained; but
the view may have been taken that, to establish a reasonable expectation of privacy, it
would be necessary to adduce evidence of facts particular to each individual claimant.
In Vidal-Hall, the claimants produced confidential schedules about their internet use,
showing that the information tracked and collected by Google in their cases was, in the
Court of Appeal’s words at [2016] QB 1003, para 137, “often of an extremely private
nature”. As discussed earlier, the need to obtain evidence in relation to individual
members of the represented class would be incompatible with the representative
claim which Mr Lloyd is seeking to bring.
107. Similarly, to recover damages for distress under section 13(1) of the DPA 1998
would require evidence of such distress from each individual for whom such a claim
was made. Again, this would be incompatible with claiming damages on a
representative basis.
108. Instead of making either of these potential claims, the claimant seeks to break
new legal ground by arguing that the principles identified in Gulati as applicable to the
assessment of damages for misuse of private information at common law also apply to
the assessment of compensation under section 13(1) of the DPA 1998. The case
advanced, which is also supported by the Information Commissioner, is that the word
Page 40“damage” in section 13(1) not only extends beyond material damage to include
distress, as decided in Vidal-Hall, but also includes “loss of control” over personal data.
(7) “Loss of control” over personal data
109. There is potential for confusion in the use of this description. “Loss of control” is
not an expression used in the DPA 1998 and, as the third interveners (the Association
of the British Pharmaceutical Industry and Association of British HealthTech Industries)
pointed out in their helpful written submissions, none of the requirements of the Act is
predicated on “control” over personal data by the data subject. Under the legislative
scheme the relevant control is that of the data controller: the entity which
“determines the purposes for which and the manner in which any personal data are, or
are to be, processed.” The nearest analogue to control as regards the data subject is
his or her “consent to the processing”, being the first condition in Schedule 2 (see para
22 above). Such consent, however, is neither necessary nor sufficient to render the
processing of personal data compliant with the Act.
110. It was made clear in submissions, however, that, in describing the basis for the
compensation claimed as “loss of control” of personal data, the claimant is not seeking
to single out a particular category of breaches of the DPA 1998 by a data controller as
breaches in respect of which the data subject is entitled to compensation without
proof of material damage or distress. The claimant’s case, which was accepted by the
Court of Appeal, is that an individual is entitled to recover compensation under section
13 of the DPA 1998 without proof of material damage or distress whenever a data
controller fails to comply with any of the requirements of the Act in relation to any
personal data of which that individual is the subject, provided only that the
contravention is not trivial or de minimis. Any such contravention, on the claimant’s
case, ipso facto involves “loss of control” of data for which compensation is payable.
Only where the individual claiming compensation is not the data subject is it necessary
on the claimant’s case to show that the individual has suffered material damage or
distress.
(8) The common sourceargument
111. The claimant’s core argument for this interpretation is that, as a matter of
principle, the same approach to the damage for which compensation can be awarded
should apply under the data protection legislation as where the claim is brought in tort
for misuse of private information because the two claims, although not coterminous,
have a common source. Both seek to protect the same fundamental right to privacy
Page 41guaranteed by article 8 of the Convention. This objective is expressly referred to in
recital (10) of the Data Protection Directive, which states:
“Whereas the object of the national laws on the processing
of personal data is to protect fundamental rights and
freedoms, notably the right to privacy, which is recognized
both in article 8 of the European Convention for the
Protection of Human Rights and Fundamental Freedoms and
in the general principles of [EU] law; whereas, for that
reason, the approximation of those laws must not result in
any lessening of the protection they afford but must, on the
contrary, seek to ensure a high level of protection in the
[EU];”
The aim of protecting the right to privacy with regard to the processing of personal
data is also articulated in recitals (2), (7), (8) and (11) of the Data Protection Directive,
and is spelt out in article 1 which states:
“Object of the Directive
In accordance with this Directive, member states shall
protect the fundamental rights and freedoms of natural
persons, and in particular their right to privacy with respect
to the processing of personal data.”
Reliance is also placed on the recognition in article 8 of the EU Charter, quoted at para
96 above, of the right to the protection of personal data as a fundamental right in EU
law.
112. The claimant argues that, given that the tort of misuse of private information
and the data protection legislation are both rooted in the same fundamental right to
privacy, it would be wrong in principle to adopt a different approach to the nature of
the damage which can be compensated under the two regimes. The conclusion should
therefore be drawn that, in each case, damages can be recovered for interference with
the claimant’s right, without the need to prove that the interference resulted in any
material damage or distress.
113. I cannot accept this argument for two reasons. First, even if the suggested
analogy between the privacy tort and the data protection regime were persuasive,
Page 42section 13(1) of the DPA 1998 cannot, in my opinion, properly be interpreted as having
the meaning for which the claimant contends. Second, the logic of the argument by
analogy is in any event flawed.
(a) The wording of the DPA 1998
114. I do not accept a submission made by counsel for Google that the interpretation
of section 13 of the DPA 1998 should be approached on the basis of a general rule that
breaches of statutory duty are not actionable without proof of material damage. The
question in Cullen v Chief Constable of the Royal Ulster Constabulary [2003] UKHL 39;
[2003] 1 WLR 1763, relied on to support this submission, was whether a statute which
did not expressly confer a right to compensation on a person affected by a breach of
statutory duty nevertheless conferred such a right impliedly. That is not the question
raised in this case, where there is an express entitlement to compensation provided by
section 13 of the DPA 1998. The only question in this case is what the words of the
relevant statutory provision mean.
115. Those words, however, cannot reasonably be interpreted as giving an individual
a right to compensation without proof of material damage or distress whenever a data
controller commits a non-trivial breach of any requirement of the Act in relation to any
personal data of which that individual is the subject. In the first place, as discussed
above, the wording of section 13(1) draws a distinction between “damage” suffered by
an individual and a “contravention” of a requirement of the Act by a data controller,
and provides a right to compensation “for that damage” only if the “damage” occurs
“by reason of” the contravention. This wording is inconsistent with an entitlement to
compensation based solely on proof of the contravention. To say, as the claimant does
in its written case, that what is “damaged” is the data subject’s right to have their data
processed in accordance with the requirements of the Act does not meet this point, as
it amounts to an acknowledgement that on the claimant’s case the damage and the
contravention are one and the same.
116. Nor is the claimant’s case assisted by section 14 of the DPA 1998, on which
reliance is placed. Section 14(1) gives the court power, on the application of a data
subject, to order a data controller to rectify, block, erase or destroy personal data if
satisfied that the data are inaccurate. Section 14(4) states:
“If a court is satisfied on the application of a data subject -
Page 43 (a) that he has suffered damage by reason of any
contravention by a data controller of any of the
requirements of this Act in respect of any personal
data, in circumstances entitling him to compensation
under section 13, and
(b) that there is a substantial risk of further
contravention in respect of those data in such
circumstances,
the court may order the rectification, blocking, erasure or
destruction of any of those data.”
117. Counsel for the claimant submitted that, if Google’s case on what is meant by
“damage” is correct, a data subject who does not suffer material damage or distress as
a result of a breach of duty by a data controller cannot claim rectification, blocking,
erasure or destruction of data, unless those data are inaccurate, however egregious
the breach. This is true, but I can see nothing unreasonable in such a result. Indeed,
section 14 seems to me positively to confirm that “damage” means something distinct
from a contravention of the Act itself. If a contravention by a data controller of the Act
could by itself constitute “damage”, section 14(4)(a) would be otiose and there would
be no material distinction in the remedies available in cases where the data are
inaccurate and in cases where the data are accurate. The manifest intention behind
section 14 is to limit the remedies of rectification, blocking, erasure or destruction of
accurate data to cases where the contravention of the Act has caused the data subject
some harm distinct from the contravention itself, whereas no such limitation is
imposed where the contravention involves holding inaccurate personal data.
118. The second reason why the claimant’s interpretation is impossible to reconcile
with the language of section 13 is that, as the Court of Appeal recognised in Vidal-Hall,
it is plain from the words enacted by Parliament the term “damage” was intended to
be limited to material damage and not to extend to “distress”. The only basis on which
the Court of Appeal in Vidal-Hall was able to interpret the term “damage” as
encompassing distress was by disapplying section 13(2) as being incompatible with EU
law. By the same token, if the term “damage” in section 13 is to be interpreted as
having an even wider meaning and as encompassing an infringement of a data
subject’s rights under the Act which causes no material damage nor even distress, that
could only be because this result is required by EU law. On a purely domestic
interpretation of the DPA 1998, such a reading is untenable.
Page 44 (b) The effect of EU law
119. It is not suggested in the present case that section 13(1) should be disapplied:
the claimant’s case is founded on it. No argument of the kind which succeeded in
Vidal-Hall that words of the statute must be disapplied because they conflict with EU
law is therefore available (or is advanced by the claimant). The question is whether the
term “damage” in section 13(1) can and should be interpreted as having the meaning
for which the claimant contends because such an interpretation is required in order to
make the domestic legislation compatible with EU law. There are two aspects of this
question: (i) what does the term “damage” mean in article 23 of the Data Protection
Directive, which section 13 of the DPA 1998 was intended to implement; and (ii) if
“damage” in article 23 includes contraventions of the national provisions adopted
pursuant to the Directive which cause no material damage or distress, is it possible to
interpret the term “damage” in section 13(1) of the DPA 1998 as having the same
meaning?
120. To take the second point first, it does not seem to me possible to interpret the
term “damage” in section 13(1) of the DPA 1998 as having the meaning for which the
claimant contends, even if such an interpretation were necessary to make the Act
compatible with the Data Protection Directive. In Vidal-Hall the Court of Appeal held,
rightly in my opinion, that section 13 of the DPA 1998 could not be construed as
providing a general right to compensation for distress suffered by reason of a
contravention of the Act “without contradicting the clearly expressed intention of
Parliament on an issue that was central to the scheme” of the legislation (see para 95
above). The same is equally, if not all the more, true of the contention that section 13
of the DPA 1998 can be interpreted as providing a right to compensation for
contraventions of the Act which have not caused any distress, let alone material
damage. The distinction between “damage” suffered by an individual and a
“contravention” of a requirement of the Act by a data controller which causes such
damage is a fundamental feature of the remedial scheme provided by the Act which,
as indicated above, permeates section 14 as well as section 13. If it were found that
this feature makes the DPA 1998 incompatible with the Data Protection Directive, such
incompatibility could, in my view, only be removed by amending the legislation. That
could only be done by Parliament.
121. No such incompatibility arises, however, as there is no reason to interpret the
term “damage” in article 23 of the Data Protection Directive as extending beyond
material damage and distress. The wording of article 23 draws exactly the same
distinction as section 13(1) of the DPA 1998 between “damage” and an unlawful act of
which the damage is “a result”. Again, this wording identifies the “damage” for which a
person is entitled to receive compensation as distinct from the wrongful act which
Page 45causes the damage. This is inconsistent with giving a right to compensation for the
unlawful act itself on the basis that the act constitutes an interference with the
claimant’s data protection rights. Nor has any authority been cited which suggests that
the term “damage”, either generally in EU law or in the specific context of article 23 of
the Data Protection Directive, is to be interpreted as including an infringement of a
legal right which causes no material damage or distress.
122. If there were evidence that at least some national laws on the processing of
personal data which pre-dated the Data Protection Directive and are referred to in
recital (10), quoted at para 111 above, provided a right to compensation for unlawful
processing without proof of material damage or distress, that might arguably support
an inference that the Directive was intended to ensure a similarly high level of
protection across all member states. But it has not been asserted that any national
laws did so. The Data Protection Act 1984, which was the applicable UK legislation
when the Data Protection Directive was adopted, in sections 22 and 23 gave the data
subject an entitlement to compensation in certain circumstances for damage or
distress suffered by reason of the inaccuracy of data or the loss or unauthorised
destruction or disclosure of data or unauthorised obtaining of access to data. By clear
implication, UK national law gave no right to compensation for unlawful processing of
personal data which did not result in material damage or distress. There is no evidence
that the national law of any other member state at that time did so either.
123. EU law therefore does not provide a basis for giving a wider meaning to the
term “damage” in section 13 of the DPA 1998 than was given to that term by the Court
of Appeal in Vidal-Hall.
(c) Flaws in the common source argument
124. I also reject the claimant’s argument that the decision in Gulati affords any
assistance to its case on this issue. Leaving aside the fact that Gulati was decided many
years after the Data Protection Directive was adopted, there is no reason on the face
of it why the basis on which damages are awarded for an English domestic tort should
be regarded as relevant to the proper interpretation of the term “damage” in a
statutory provision intended to implement a European directive. The claimant relies on
the fact that both derive from the right to respect for private life protected by article 8
of the Convention (and incorporated in article 7 of the EU Charter when it was created
in 2007). It does not follow, however, from the fact that two different legal regimes
aim, at a general level, to provide protection for the same fundamental value that they
must do so in the same way or to the same extent or by affording identical remedies.
There are significant differences between the nature and scope of the common law
privacy tort and the data protection legislation, to which I will draw attention in a
Page 46moment. But the first point to note is that the decision in Gulati that damages can be
awarded for misuse of private information itself was not compelled by article 8 of the
Convention; nor did article 8 require the adoption of the particular legal framework
governing the protection of personal data contained in the Data Protection Directive
and the DPA 1998.
125. The Convention imposes obligations on the states which are parties to it, but
not on private individuals and bodies. In some cases the obligations on state parties
extend beyond negative obligations not to act in ways which violate the Convention
rights and include certain positive obligations on the state to ensure effective
protection of those rights. That is so as regards the right to respect for private life
guaranteed by article 8. The European Court of Human Rights has held that in certain
circumstances the state’s positive obligations under article 8 are not adequately
fulfilled unless the state secures respect for private life in the relations between
individuals by setting up a legislative framework taking into consideration the various
interests to be protected in a particular context. However, the court has emphasised
that there are different ways of ensuring respect for private life and that “the choice of
the means calculated to secure compliance with article 8 of the Convention in the
sphere of the relations of individuals between themselves is in principle a matter that
falls within the contracting states’ margin of appreciation”: see the judgment of the
Grand Chamber in Bărbulescu v Romania [2017] ECHR 754; [2017] IRLR 1032, para 113.
126. While the House of Lords in Campbell drew inspiration from article 8, it did not
suggest that the Convention or the Human Rights Act 1998 required the recognition of
a civil claim for damages for misuse of private information in English domestic law, let
alone that damages should be recoverable in such claim where no material damage or
distress has been caused. In Gulati the Court of Appeal rejected an argument that the
approach to awarding damages for misuse of private information ought to follow the
approach of the European Court of Human Rights in making awards of just satisfaction
under article 41 of the Convention. As Arden LJ observed, at para 89, in awarding
damages for misuse of private information, the court is not proceeding under section 8
of the Human Rights Act 1998 or article 41 of the Convention, and the conditions of
the tort are governed by English domestic law and not the Convention.
127. For those reasons, I do not regard as relevant the decision of the European
Court of Human Rights in Halford v United Kingdom (1997) 24 EHRR 523, relied on by
counsel for the claimant. In Halford a senior police officer whose telephone calls had
been intercepted by her employer in violation of article 8 was awarded £10,000 as just
satisfaction. As Lord Sales pointed out in argument, on one reading of the judgment,
which is far from clear, although it could not be shown that the interception of the
applicant’s phone calls, as opposed to other conflicts with her employer, had caused
Page 47stress for which she had required medical treatment, it was reasonably assumed that
this invasion of privacy had caused her mental harm. Even if the award of just
satisfaction is understood to have been for the invasion of the right to privacy itself
rather than for any distress felt by the applicant, however, it does not follow that, in an
action between private parties under national law for a similar invasion of privacy, the
Convention requires the court to be able to award damages simply for the loss of
privacy itself.
128. Whilst it may be said that pursuant to the general principles of EU law
embodied in articles 7 and 8 of the EU Charter the EU had a positive obligation to
establish a legislative framework providing for protection of personal data, there was
clearly a wide margin of choice as to the particular regime adopted; and the same
applies to the positive obligation imposed directly on the UK by the Convention. It
could not seriously be argued that the content of those positive obligations included a
requirement to establish a right to receive compensation for any (non-trivial) breach of
any requirement (in relation to any personal data of which the claimant is the subject)
of whatever legislation the EU and UK chose to enact in this area without the need to
prove that the claimant suffered any material damage or distress as a result of the
breach.
129. Accordingly, the fact that the common law privacy tort and the data protection
legislation have a common source in article 8 of the Convention does not justify
reading across the principles governing the award of damages from one regime to the
other.
(d) Material differences between the regimes
130. There are further reasons why no such analogy can properly be drawn
stemming from the differences between the two regimes. It is plain that the detailed
scheme for regulating the processing of personal data established by the Data
Protection Directive extended beyond the scope of article 8 and much more widely
than the English domestic tort of misusing private information. An important
difference is that the Directive (and the UK national legislation implementing it)
applied to all “personal data” with no requirement that the data are of a confidential
or private nature or that there is a reasonable expectation of privacy protection. By
contrast, information is protected against misuse by the domestic tort only where
there is a reasonable expectation of privacy. The reasonable expectation of privacy of
the communications illicitly intercepted by the defendants in the phone hacking
litigation was an essential element of the decision in Gulati that the claimants were
entitled to compensation for the commission of the wrong itself. It cannot properly be
Page 48inferred that the same entitlement should arise where a reasonable expectation of
privacy is not a necessary element of the claim.
131. This point goes to the heart of the approach adopted by the claimant in the
present case. Stripped to its essentials, what the claimant is seeking to do is to claim
for each member of the represented class a form of damages the rationale for which
depends on there being a violation of privacy, while avoiding the need to show a
violation of privacy in the case of any individual member of the class. This is a flawed
endeavour.
132. Another significant difference between the privacy tort and the data protection
legislation is that a claimant is entitled to compensation for a contravention of the
legislation only where the data controller has failed to exercise reasonable care. Some
contraventions are inherently fault based. For example, the seventh data protection
principle with which a data controller has a duty to comply pursuant to section 4(4) of
the DPA 1998 (and article 17 of the Data Protection Directive) states:
“Appropriate technical and organisational measures shall be
taken against unauthorised or unlawful processing of
personal data and against accidental loss or destruction of, or
damage to, personal data.”
A complaint that a data controller has failed to take such “appropriate technical and
organisational measures” is similar to an allegation of negligence in that it is
predicated on failure to meet an objective standard of care rather than on any
intentional conduct. Even where a contravention of the legislation does not itself
require fault, pursuant to section 13(3), quoted at para 90 above, there is no
entitlement to compensation if the data controller proves that it took “such care as in
all the circumstances was reasonably required to comply with the requirement
concerned”.
133. The privacy tort, like other torts for which damages may be awarded without
proof of material damage or distress, is a tort involving strict liability for deliberate
acts, not a tort based on a want of care. No inference can be drawn from the fact that
compensation can be awarded for commission of the wrong itself where private
information is misused that the same should be true where the wrong may consist only
in a failure to take appropriate protective measures and where the right to
compensation is expressly excluded if the defendant took reasonable care.
Page 49134. Indeed, this feature of the data protection legislation seems to me to be a yet
further reason to conclude that the “damage” for which an individual is entitled to
compensation for a breach of any of its requirements does not include the commission
of the wrong itself. It would be anomalous if failure to take reasonable care to protect
personal data gave rise to a right to compensation without proof that the claimant
suffered any material damage or distress when failure to take care to prevent personal
injury or damage to tangible moveable property does not.
135. Accordingly, I do not accept that the decision in Gulati is applicable by analogy
to the DPA 1998. To the contrary, there are significant differences between the privacy
tort and the data protection legislation which make such an analogy positively
inappropriate.
(e) Equivalence and effectiveness
136. I add for completeness that the EU law principles of equivalence and
effectiveness, on which the Court of Appeal placed some reliance, do not assist the
claimant’s case. The principle of equivalence requires that procedural rules governing
claims for breaches of EU law rights must not be less favourable than procedural rules
governing equivalent domestic actions. As explained by Lord Briggs, giving the
judgment of this court, in Totel Ltd v Revenue and Customs Comrs [2018] UKSC 44;
[2018] 1 WLR 4053, para 7, the principle is “essentially comparative”. Thus:
“The identification of one or more similar procedures for the
enforcement of claims arising in domestic law is an essential
prerequisite for its operation. If there is no true comparator,
then the principle of equivalence can have no operation at
all. The identification of one or more true comparators is
therefore the essential first step in any examination of an
assertion that the principle of equivalence has been
infringed.” [citation omitted]
For the reasons given, even if the measure of damages is regarded as a procedural
rule, a claim for damages for misuse of private information at common law is not a
true comparator of a claim under section 13 of the DPA 1998. The principle of
equivalence can therefore have no operation.
137. The principle of effectiveness invalidates a national procedure if it renders the
enforcement of a right conferred by EU law either virtually impossible or excessively
Page 50difficult: see again Totel Ltd at para 7. However, the absence of a right to
compensation for a breach of data protection rights which causes no material damage
or distress, even if regarded as a procedural limitation, does not render the
enforcement of such rights virtually impossible or excessively difficult. The right to an
effective remedy does not require awards of compensation for every (non-trivial)
breach of statutory requirements even if no material damage or distress has been
suffered.
(f) Conclusion on the effect of section 13
138. For all these reasons, I conclude that section 13 of the DPA 1998 cannot
reasonably be interpreted as conferring on a data subject a right to compensation for
any (non-trivial) contravention by a data controller of any of the requirements of the
Act without the need to prove that the contravention has caused material damage or
distress to the individual concerned.
(9) The claim for user damages
139. “User damages” is the name commonly given to a type of damages readily
awarded in tort where use has wrongfully been made of someone else’s land or
tangible moveable property although there has been no financial loss or physical
damage to the property. The damages are assessed by estimating what a reasonable
person would have paid for the right of user. Damages are also available on a similar
basis for patent infringement and other breaches of intellectual property rights.
Following the seminal decision of this court in OneStep (Support) Ltd v Morris-Garner
[2018] UKSC 20; [2019] AC 649, it is now clear that user damages are compensatory in
nature, their purpose being to compensate the claimant for interference with a right to
control the use of property where the right is a commercially valuable asset. As Lord
Reed explained in Morris-Garner, at para 95(1):
“The rationale of such awards is that the person who makes
wrongful use of property, where its use is commercially
valuable, prevents the owner from exercising a valuable right
to control its use, and should therefore compensate him for
the loss of the value of the exercise of that right. He takes
something for nothing, for which the owner was entitled to
require payment.”
Page 51140. Lord Reed, at paras 27 and 29, cited authorities which make it clear that the
entitlement to user damages does not depend on whether the owner would in fact
have exercised the right to control the use of the property, had it not been interfered
with. The “loss” for which the claimant is entitled to compensation is not loss of this
“conventional kind” (para 30); rather, it lies in the wrongful use of the claimant’s
property itself, for which the economic value of the use provides an appropriate
measure. This value can be assessed by postulating a hypothetical negotiation and
estimating what fee would reasonably have been agreed for releasing the defendant
from the duty which it breached. It is this method of assessment on which the claimant
relies in the alternative formulation of the present claim.
141. A claim in tort for misuse of private information based on the factual allegations
made in this case, such as was made in Vidal-Hall, would naturally lend itself to an
award of user damages. The decision in Gulati shows that damages may be awarded
for the misuse of private information itself on the basis that, apart from any material
damage or distress that it may cause, it prevents the claimant from exercising his or
her right to control the use of the information. Nor can it be doubted that information
about a person’s internet browsing history is a commercially valuable asset. What was
described by the Chancellor in the Court of Appeal [2020] QB 747, para 46, as “the
underlying reality of this case” is that Google was allegedly able to make a lot of money
by tracking the browsing history of iPhone users without their consent and selling the
information collected to advertisers.
142. The view has sometimes been expressed that asserting privacy in information is
inconsistent, or at least in tension, with treating such information as a commercial
asset: see eg Douglas v Hello! Ltd (No 3) [2005] EWCA Civ 595; [2006] QB 125, para
246; and on appeal sub nom OBG Ltd v Allan [2007] UKHL 21; [2008] AC 1, para 275
(Lord Walker of Gestinghorpe). But once the basis of the right to privacy is understood
to be the protection of a person’s freedom to choose and right to control whether and
when others have access to his or her private affairs, I think that any tension largely
disappears. It is common experience that some people are happy to exploit for
commercial gain facets of their private lives which others would feel mortified at
having exposed to public view. Save in the most extreme cases, this should be seen as
a matter of personal choice on which it is not for the courts to pass judgments.
Moreover, where the defendant’s very purpose in wrongfully obtaining and using
private information is to exploit its commercial value, the law should not be prissy
about awarding compensation based on the commercial value of the exercise of the
right. As was confirmed in Morris-Garner, the fact that the claimant would not have
chosen to exercise the right himself is no answer to a claim for user damages. It is
enough that, as Lord Reed put it at paras 30 and 95(1) of his majority judgment, the
defendant has taken something for nothing, for which the owner of the right was
entitled to require payment.
Page 52143. The point does not arise in the present case, however, because the claimant is
not claiming damages for misuse of private information. As discussed, the only claim
advanced is under the DPA 1998. Here it follows from the conclusion reached above
about the meaning of section 13 that user damages are not available. This is because,
for the reasons given, compensation can only be awarded under section 13 of the DPA
1998 for material damage or distress caused by an infringement of a claimant’s right to
have his or her personal data processed in accordance with the requirements of the
Act, and not for the infringement itself. Although his reasoning was in part based on an
understanding of user damages overtaken by this court’s decision in Morris-Garner, it
follows that Patten J was right to hold in Murray v Express Newspapers Plc[2007]
EWHC 1908 (Ch); [2007] EMLR 22, at para 92, that the principles on which user
damages are awarded do not apply to a claim for compensation under the DPA 1998.
F. THE NEED FOR INDIVIDUALISED EVIDENCE OF MISUSE
144. There is a further reason why the claimant’s attempt to recover damages under
section 13 of the DPA 1998 by means of a representative claim cannot succeed. Even if
(contrary to my conclusion) it were unnecessary in order to recover compensation
under this provision to show that an individual has suffered material damage or
distress as a result of unlawful processing of his or her personal data, it would still be
necessary for this purpose to establish the extent of the unlawful processing in his or
her individual case. In deciding what amount of damages, if any, should be awarded,
relevant factors would include: over what period of time did Google track the
individual’s internet browsing history? What quantity of data was unlawfully
processed? Was any of the information unlawfully processed of a sensitive or private
nature? What use did Google make of the information and what commercial benefit, if
any, did Google obtain from such use?
(1) The claim for the “lowest common denominator”
145. The claimant does not dispute that the amount of any compensation awarded
must in principle depend on such matters. But he contends that it is possible to
identify an “irreducible minimum harm” suffered by every member of the class whom
he represents for which a “uniform sum” of damages can be awarded. This sum is
claimed on the basis that it represents what the Chancellor in the Court of Appeal
described as the “lowest common denominator” of all the individual claims: see [2020]
QB 747, para 75.
146. Google objects that Mr Lloyd, as the self-appointed representative of the class,
has no authority from any individual class member to waive or abandon what may be
Page 53the major part of their damages claim by disavowing reliance on any circumstances
affecting that individual. Mr Lloyd’s answer, which the Court of Appeal accepted, is a
pragmatic one. He points out that the limitation period for bringing any proceedings
has now expired. For any represented individual there is therefore no longer any
realistic possibility of recovering any compensation at all other than through the
present action. Furthermore, to make this action viable, it is necessary to confine the
amount of damages claimed for each class member to a uniform sum; and a uniform
sum of damages, even if considerably smaller than an individualised award would be, is
better than nothing.
147. I do not think it necessary to enter into the merits of this issue. I am prepared to
assume, without deciding, that as a matter of discretion the court could - if satisfied
that the persons represented would not be prejudiced and with suitable arrangements
in place enabling them to opt out of the proceedings if they chose - allow a
representative claim to be pursued for only a part of the compensation that could
potentially be claimed by any given individual. The fundamental problem is that, if no
individual circumstances are taken into account, the facts alleged are insufficient to
establish that any individual member of the represented class is entitled to damages.
That is so even if it is unnecessary to prove that the alleged breaches caused any
material damage or distress to the individual.
(2) The facts common to each individual case
148. The facts alleged against Google generically cannot establish that any given
individual is entitled to compensation. To establish any such individual entitlement it
must be shown, at least, that there was unlawful processing by Google of personal
data of which that particular individual was the subject. In considering whether the
facts alleged, if proved, are capable of establishing an entitlement to damages, it is
therefore necessary to identify what unlawful processing by Google of personal data is
alleged to have occurred in Mr Lloyd’s own case and also in the case of each other
member of the represented class. What facts is the claimant proposing to prove to
show that Google acted unlawfully in each individual case?
149. The answer, on analysis, is: only those facts which are necessary to show that
the individual falls within the definition of the “claimant class”. The premise of the
claim is that Mr Lloyd and each person whom he represents is entitled to damages
simply on proof that they are members of the class and without the need to prove any
further facts to show that Google wrongfully collected and used their personal data.
Any such further facts would inevitably vary from one individual member of the class
to another and would require individual proof.
Page 54150. To fall within the definition of the class, it must be shown, in substance, that the
individual concerned had an iPhone of the appropriate model running a relevant
version of the Apple Safari internet browser which, at any date during the relevant
period whilst present in England and Wales, he or she used to access a website that
was participating in Google’s DoubleClick advertising service. There are exclusions
from the class definition for anyone who changed the default settings in the Safari
browser, opted out of tracking and collation via Google’s “Ads Preference Manager” or
obtained a DoubleClick Ad cookie via a “first party request” rather than as a “third
party cookie”. The aim of the definition is to identify all those people who had a
DoubleClick Ad cookie placed on their device unlawfully, through the Safari
workaround, but not to include within the class anyone who did not receive a
DoubleClick Ad cookie during the relevant period or who received the cookie by lawful
means.
151. It is sufficient to bring an individual within the class definition that he or she
used the Safari browser to access a website participating in Google’s DoubleClick
advertising service on a single occasion. The theory is that on that occasion the
DoubleClick Ad cookie will have been placed on the user’s device unlawfully as a third
party cookie. To qualify for membership of the class, it is not necessary to show that
the individual ever visited a website participating in Google’s DoubleClick advertising
service again during the relevant period. Nor is it alleged that any individual or
individuals did visit such a website on more than one occasion. The “lowest common
denominator” on which the claim is based is therefore someone whose internet usage
- apart from one visit to a single website - was not illicitly tracked and collated and who
received no targeted advertisements as a result of receiving a DoubleClick Ad cookie.
This is because the claimant has deliberately chosen, in order to advance a claim in a
representative capacity for damages assessed from the bottom up, not to rely on any
facts about the internet activity of any individual iPhone user beyond those which
bring them within the class of represented persons.
152. For reasons given earlier, I am leaving aside the difficulties of proving
membership of the class, significant as they would appear to be, and am assuming that
such difficulties are not an impediment to the claim. But the question that must be
asked is whether membership of the represented class is sufficient by itself to entitle
an individual to compensation, without proof of any further facts particular to that
individual.
153. On the claimant’s own case there is a threshold of seriousness which must be
crossed before a breach of the DPA 1998 will give rise to an entitlement to
compensation under section 13. I cannot see that the facts which the claimant aims to
prove in each individual case are sufficient to surmount this threshold. If (contrary to
Page 55the conclusion I have reached) those facts disclose “damage” within the meaning of
section 13 at all, I think it impossible to characterise such damage as more than trivial.
What gives the appearance of substance to the claim is the allegation that Google
secretly tracked the internet activity of millions of Apple iPhone users for several
months and used the data obtained for commercial purposes. But on analysis the
claimant is seeking to recover damages without attempting to prove that this
allegation is true in the case of any individual for whom damages are claimed. Without
proof of some unlawful processing of an individual’s personal data beyond the bare
minimum required to bring them within the definition of the represented class, a claim
on behalf of that individual has no prospect of meeting the threshold for an award of
damages.
(3) User damages on a lowest common denominator basis
154. The claimant’s case is not improved by formulating the claim as one for user
damages quantified by estimating what fee each member of the represented class
could reasonably have charged - or which would reasonably have been agreed in a
hypothetical negotiation - for releasing Google from the duties which it breached. I
have already indicated why, in my opinion, user damages cannot be recovered for
breaches of the DPA 1998. But even if (contrary to that conclusion) user damages
could in principle be recovered, the inability or unwillingness to prove what, if any,
wrongful use was made by Google of the personal data of any individual again means
that any damages awarded would be nil.
155. The claimant asserts, and I am content to assume, that if, instead of bypassing
privacy settings through the Safari workaround, Google had offered to pay a fee to
each affected Apple iPhone user for the right to place its DoubleClick Ad cookie on
their device, the fee would have been a standard one, agreed in advance, rather than a
fee which varied according to the quantity or commercial value to Google of the
information which was subsequently collected as a result of the user’s acceptance of
the cookie. However, imagining the negotiation of a fee in advance in this way is not
the correct premise for the valuation.
156. As explained in Morris-Garner, the object of an award of user damages is to
compensate the claimant for use wrongfully made by the defendant of a valuable asset
protected by the right infringed. The starting point for the valuation exercise is thus to
identify what the extent of such wrongful use actually was: only then can an estimate
be made of what sum of money could reasonably have been charged for that use or,
put another way, for releasing the wrongdoer from the duties which it breached in the
wrongful use that it made of the asset. Imagining a hypothetical negotiation, as Lord
Reed explained at para 91 of Morris-Garner, is merely “a tool” for arriving at this
Page 56estimated sum. As in any case where compensation is awarded, the aim is to place the
claimant as nearly as possible in the same position as if the wrongdoing had not
occurred. Accordingly, as Patten LJ put it in Eaton Mansions (Westminster) Ltd v Stinger
Compania de Inversion SA [2013] EWCA Civ 1308; [2014] 1 P & CR 5, para 21:
“The valuation construct is that the parties must be treated
as having negotiated for a licence which covered the acts of
trespass that actually occurred. The defendant is not required
to pay damages for anything else.”
See also Enfield London Borough Council v Outdoor Plus Ltd[2012] EWCA Civ 608, para
47; and Marathon Asset Management LLP v Seddon [2017] EWHC 300 (Comm); [2017]
ICR 791, paras 254-262.
157. Applying that approach, the starting point would therefore need to be to
establish what unlawful processing by Google of the claimant’s personal data actually
occurred. Only when the wrongful use actually made by Google of such data is known
is it possible to estimate its commercial value. As discussed, in order to avoid individual
assessment, the only wrongful act which the claimant proposes to prove in the case of
each represented person is that the DoubleClick Ad cookie was unlawfully placed on
their device: no evidence is - or could without individual assessment - be adduced to
show that, by means of this third party cookie, Google collected or used any personal
data relating to that individual. The relevant valuation construct is therefore to ask
what fee would hypothetically have been negotiated for a licence to place the
DoubleClick Ad cookie on an individual user’s phone as a third party cookie, but
without releasing Google from its obligations not to collect or use any information
about that person’s internet browsing history. It is plain that such a licence would be
valueless and that the fee which could reasonably be charged or negotiated for it
would accordingly be nil.
G. CONCLUSION
158. The judge took the view that, even if the legal foundation for the claim made in
this action were sound, he should exercise the discretion conferred by CPR rule 19.6(2)
by refusing to allow the claim to be continued as a representative action. He
characterised the claim as “officious litigation, embarked upon on behalf of individuals
who have not authorised it” and in which the main beneficiaries of any award of
damages would be the funders and the lawyers. He thought that the representative
claimant “should not be permitted to consume substantial resources in the pursuit of
litigation on behalf of others who have little to gain from it, and have not authorised
Page 57the pursuit of the claim, nor indicated any concern about the matters to be litigated”:
[2019] 1 WLR 1265, paras 102-104. The Court of Appeal formed a very different view
of the merits of the representative claim. They regarded the fact that the members of
the represented class had not authorised the claim as an irrelevant factor, which the
judge had wrongly taken into account, and considered that it was open to them to
exercise the discretion afresh. They saw this litigation as the only way of obtaining a
civil compensatory remedy for what, if proved, was a “wholesale and deliberate
misuse of personal data without consent, undertaken with a view to commercial
profit”: see [2020] QB 747, para 86. In these circumstances the Court of Appeal took
the view that, as a matter of discretion, the claim should be allowed to proceed.
159. It is unnecessary to decide whether the Court of Appeal was entitled to
interfere with the judge’s discretionary ruling or whether it would be desirable for a
commercially funded class action to be available on the facts alleged in this case. This is
because, regardless of what view of it is taken, the claim has no real prospect of
success. That in turn is because, in the way the claim has been framed in order to try to
bring it as a representative action, the claimant seeks damages under section 13 of the
DPA 1998 for each individual member of the represented class without attempting to
show that any wrongful use was made by Google of personal data relating to that
individual or that the individual suffered any material damage or distress as a result of
a breach of the requirements of the Act by Google. For the reasons explained in this
judgment, without proof of these matters, a claim for damages cannot succeed.
160. I would therefore allow the appeal and restore the order made by the judge
refusing the claimant’s application for permission to serve the proceedings on Google
outside the jurisdiction of the courts of England and Wales.
Page 58
