In contrast to its friends across the pond, collective actions have not proliferated in England and Wales. In the High Court, collective actions can arise from group litigation orders (GLOs), claims by representative claimants, and as a result of case management by the court of a group of like cases. (Other remedies are available in the Competition Appeals Tribunal.)
Lloyd v. Google [2019] EWCA Civ 1599 belongs to the second category of representative claims. In group litigation orders, claimants must opt in to participate in the lawsuit. Representative claims are more akin to class action lawsuits in the United States as they operate on an opt-out basis, meaning that it is not necessary for the parties to be joined or identified. Under rule 19.6 of the Civil Procedure Rules ("CPR 19.6"), any person belonging to a group which has the ‘same interest’ in a claim is able to bring such a representative claim, subject to the court’s power to direct any person not to act as a representative (CPR 19.6(2)).
As of yet, though the representative action procedure has existed for many years, CPR 19.6 has not proliferated due to the courts’ restrictive interpretation of the ‘same interest’ requirement. In Emerald Supplies Ltd v. British Airways, the claimants were flower importers using British Airways’ air freight services, initially alleging price-fixing in breach of UK and EU competition law. The High Court allowed British Airways’ application to strike out the representative element of the claim, holding that ‘same interest’ meant it was necessary for claimants to be identifiable at the time the claim was made. As the identity of the class claimants depended on the outcome of the case, the class did not have the ‘same interest’. The decision was upheld on broadly the same grounds by the Court of Appeal.
This forms a context which seems to be rather unfriendly to representative claims. However, in Lloyd v. Google, the Court of Appeal granted permission for notice to be served outside the jurisdiction, allowing the action to proceed.
In a ten-month period from April 2011 to February 2012, Google allegedly used its DoubleClick cookie technology to circumvent privacy settings in Apple’s Safari browser which blocked third-party cookies by default. The appellant Richard Lloyd, a consumer rights activist, alleged that Google tracked the behaviour of approximately 4 million users without consent and sold the data to advertisers in contravention of its stated privacy policy and in breach of section 4(4) of the Data Protection Act 1998.
The Court of Appeal, overturning the High Court’s refusal of permission, held that members of the class Lloyd sought to represent did have the 'same interest' as they all had their browsing data taken without consent in the same period of time. Furthermore, Lloyd sought a uniform amount for each alleged victim and did not seek to make claims for pecuniary loss and distress, which would have varied for each individual class member.
Analysis
The Supreme Court has now granted Google permission to appeal against the decision of the Court of Appeal and is due to hear the case in late 2020 or early 2021. If the Supreme Court decides to uphold the Court of Appeal decision, there will be significant risks for companies which hold a large amount of personal data. This is particularly concerning for industries which are at high risk of data breaches, including the finance and healthcare sectors.
An accidental data breach was not alleged in this case, but any decision could very well be extended to cover such cases, with the Court of Appeal holding that damages could be awarded notwithstanding a lack of pecuniary loss and distress. Though Lloyd v. Google was decided under the Data Protection Act 1998, it is likely to apply to ‘loss of control’ cases under the General Data Protection Regulation. As Sir Geoffrey Vos C notes at [64], the GDPR gives further support to a broader view of ‘loss of control’ damages in respect of ‘material or non-material damage’.
