Lloyd (Respondent) v Google LLC (Appellant)  UKSC 50
Summary of today's decision of the Supreme Court in Lloyd (Respondent) v Google LLC (Appellant)  UKSC 50
Mr Lloyd’s claim was brought under section 13 of the Data Protection Act 1998 (“the DPA 1998”) for damage allegedly suffered by a class of Apple iPhone users whose personal data had been unlawfully processed by Google in late 2011 and early 2012.
The Supreme Court held that Mr Lloyd’s claim under section 13 of the DPA 1998 for a “loss of control” of personal data could not succeed and permission to serve the proceedings on Google outside the jurisdiction was therefore refused.
The Supreme Court’s reasoning in summary:
- In this case, compensation could not be awarded under the DPA 1998 for “loss of control” of personal data—which was constituted by any non–trivial contravention by a data controller of any of the requirements of the Act.
- First, the term “damage” under section 13 referred to material damage (such as financial loss) or mental distress—which was distinct from the unlawful processing of personal data, itself, in contravention of the DPA 1998. As a result, compensation for a less serious contravention by a data controller than mental distress was not permitted.
- Second, in order to recover compensation under section 13, it is necessary to prove what unlawful processing by Google of personal data relating to each given individual occurred.
- Therefore, the "attempt to recover damages without proving either what, if any, unlawful processing of personal data occurred in the case of any individual or that the individual suffered material damage or mental distress as a result of such unlawful processing is unsustainable" (see the Supreme Court’s press summary of 10 November 2021).
Data controllers will no doubt consider today’s Supreme Court ruling to be a positive development. However, the Court’s rejection of Mr Lloyd’s representative action may leave those who suffer the wholesale misuse of their personal data without their consent unable to recover compensation, even where this misuse is deliberate and undertaken with a view to commercial profit or gain. Claimants will certainly need to consider what financial losses or mental distress they have suffered if contemplating similar actions in future.
A relatively high barrier was also set by the Court for the possible assessment of compensation in similar future actions, should any individuals be found to be entitled to receive damages. As the Court noted, it would have been necessary, in the instant matter, to consider over what period of time Google tracked individuals’ internet browsing history, what quantity of data was unlawfully processed, whether any of this data was sensitive or private, what use Google made of the data and what commercial benefit Google obtained. This undertaking alone may suppress the growth of claims in this area.
By Celso De Azevedo and Paul Schwartfeger of 36 Commercial, part of The 36 Group.