Court of Appeal green lights data privacy class action against Google

Yesterday the Court of Appeal cleared the way for a data privacy class action against Google to proceed, reversing last year's High Court decision, in what could well turn out to be a landmark ruling.

Richard Lloyd, a former director of Which?, had issued a representative claim on behalf of more than 4 million iPhone users in the UK, centring on the so-called Safari Workaround, which allowed Google to collect large amounts of information about their online activity, without their consent.

Last October, the High Court had refused permission to serve the proceedings on Google in the US, on the basis that the claimants were not entitled to compensation under the Data Protection Act 1998, and that the claim was not a valid representative action.

The Court of Appeal has now reversed that decision in its entirety. It has held that "a person's control over data" is "an asset that has value". Therefore, loss of control over that data entitles the data subject to compensation under English and EU data protection law. There is no need for a claimant to prove either distress or financial loss.

The Court of Appeal also disagreed with the trial judge's finding that the members of the class did not have the 'same interest', ruling that the judge had applied too stringent a test. In the Court of Appeal's view, the represented class were all victims of the same alleged wrong, and had all sustained the same loss, namely loss of control over their personal data. They all therefore had the same interest in the claim.

The Court's confirmation that, in principle, damages may be awarded for loss of control of data, even in the absence of financial loss and distress, will be welcome news for victims of data breaches. However, the Court made it clear that claims must still reach a "threshold of seriousness", which would for example exclude claims for damages for "an accidental one-off data breach that was quickly remedied". Nevertheless, this decision is likely to considerably widen the scope of data protection claims which are deemed worthy of at least some level of compensation

The decision also reopens the door to large scale 'opt out' class actions in data protection cases, a door which the High Court, in its earlier decision, had seemed keen to slam shut. 

Given the potential ramifications of the judgment, Google may well seek permission to appeal to the Supreme Court.

A Court summary of the decision is here, and the full judgment here.