A mere “loss of control” of personal data does not mean you are owed compensation (£££££)

The supreme court says to claim compensation for a data breach individuals must show the [1] suffered a breach of their rights and [2] suffered damage as a result of that breach.

The case concerned Google's placing of advertising tracking cookies on iPhones using Apple's 'Safari' browser in England and Wales between August 2011 and February 2012.

Recap of what went wrong:

1. The technical background is not straightforward.
2. In essence, however, Google rolled out a new feature known as “social ads” on its now discontinued Google+ service.
3. In rolling out this feature Google sought to protect user-privacy through segregation of data.
4. Whilst this approach worked effectively on other browsers, there were difficulties in implementing the feature for users of the Safari browser due to Safari’s handling of third-party cookies.
5. Google therefore identified a workaround to implement the feature on Safari browsers. However, a by-product of this workaround was that Google’s ‘DoubleClick’ advertising cookie was also set in a third-party context, even though Apple’s stated policy at the time was that this would not be possible with the Safari browser.
6. On that basis it was alleged that DoubleClick cookies were set without the consent of users.

The Supreme Court:

1. The Supreme Court’s unanimous decision that a representative action brought against Google should not proceed is a very positive development for data controllers of all sizes.
2. The judgment will be read closely by those interested in the wider UK class actions landscape.

Key points

1. The Supreme Court has rejected the notion that every data subject affected by a non-trivial data breach is entitled to an award of compensation for the mere “loss of control” of their personal data.
2. Rather, the court has confirmed that an award of compensation for a non-trivial breach of the Data Protection Act 1998 can be made only if the data subject has suffered some form of material damage, i.e. tangible financial loss, or if they have suffered distress.
3. The Supreme Court also found that the claim raised against Google is not viable as a representative action for damages.
4. Richard Lloyd, a former executive director of consumer watchdog Which? who brought the claim, expressly sought to disavow the individual circumstances of each of the millions of individuals who he said formed part of the represented class.
5. The Supreme Court found this approach impermissible in principle. It said that,
• In order to advance a representative action on behalf of each member of the proposed represented class,
• Lloyd had to show that each of those individuals had both suffered a breach of their rights and suffered damage as a result of that breach.
6. Several other representative actions based on alleged data protection breaches have been on hold pending the Supreme Court’s judgment in this case. These include claims against
• TikTok, Facebook and Marriott Hotels.
7. It now seems unlikely that litigation funders will have any appetite to pursue these claims.

Lloyd v Google: Supreme Court unanimously rejects claimant’s representative action (pinsentmasons.com)

• https://www.pinsentmasons.com/out-law/analysis/lloyd-v-google-supreme-court-representative-action