Tweet
Some of you might recall last year, Richard Lloyd, a former director of Which? issued a class action against Google in relation to their Sarafi web browser work around (some 10 years ago) which allowed Google to collective user data without knowledge or consent.
Yesterday the Court of Appeal overturned that decision and held, among other things that proof did not need to be shown first, before one could claim compensation. Judgment is below but there's an interesting discussion around the damage element as well as some reference to non-material damage under the GDPR which the court thought useful in making its decision. I should point out that Google have been refused permission by the Court of Appeal but may still appeal directly to the Supreme Court.
LINK TO JUDGMENT: https://www.judiciary.uk/judgments/r...-v-google-llc/
Yesterday the Court of Appeal overturned that decision and held, among other things that proof did not need to be shown first, before one could claim compensation. Judgment is below but there's an interesting discussion around the damage element as well as some reference to non-material damage under the GDPR which the court thought useful in making its decision. I should point out that Google have been refused permission by the Court of Appeal but may still appeal directly to the Supreme Court.
43. It was common ground, in this context, that if the court decided that the infringement of the Directive and the DPA was trivial or de minimis it would be entitled to refuse to make an award of what Mr Tomlinson referred to as “loss of control damages”.
46. The first question that arises is whether control over data is an asset that has value. That question again should, in this context, be answered as a matter of EU law. In Your Response Limited v. Datateam Business Media Limited [2014] EWCA Civ 281, this court held that, as a matter of English law, an electronic database was not a form of property capable of possession and that, therefore, it could not be subject to a possessory lien. That question may in due course need to be revisited, but it does not, in my judgment affect the answer to the relevant question for current purposes. Even if data is not technically regarded as property in English law, its protection under EU law is clear. It is also clear that a person’s BGI has economic value: for example, it can be sold. It is commonplace for EU citizens to obtain free wi-fi at an airport in exchange for providing their personal data. If they decline to do so, they have to pay for their wifi usage. The underlying reality of this case is that Google was able to sell BGI collected from numerous individuals to advertisers who wished to target them with their advertising. That confirms that such data, and consent to its use, has an economic value. 47. Accordingly, in my judgment, a person’s control over data or over their BGI does have a value, so that the loss of that control must also have a value. In one sense, if that is right, it is sufficient to answer the question of whether, in theory, a person can recover compensation under section 13 and article 23. But it is necessary first to consider whether this kind of loss of control over data can properly be considered damage in the legal sense in which the term “damage” is used in article 23 and section 13.
57. To summarise this aspect of the case, in my judgment the decision in Gulati is (a) relevant, albeit strictly not binding on us as it was not a decision on the DPA, and (b) applicable by analogy, for three main reasons. First, both MPI and section 13 derive from the same core rights to privacy. Secondly, since loss of control over telephone data was held to be damage for which compensation could be awarded in Gulati, it would be wrong in principle if the represented claimants’ loss of control over BGI data could not, likewise, for the purposes of the DPA, also be compensated. Thirdly, the EU law principles of equivalence and effectiveness point to the same approach being adopted to the legal definition of damage in the two torts which both derive from a common European right to privacy.
58. Thus far, I have tried to deal with the meaning of article 23 and section 13 from first principles in the light of Gulati. As it seems to me, however, there is also some support for the approach I have adopted in a range of authorities cited by the parties.
59. In Halliday v. Creation Consumer Finance Limited [2013] EWCA Civ 333, the Court of Appeal awarded the claimant £750 for the wrongful processing of his data. Arden LJ said at [35] that it was a “general principle that, where an important European instrument such as data protection had not been complied with, there ought to be an award”, even though there was “no contemporary evidence of any manifestation of injury to feelings and distress apart from what one would normally expect from frustration at these prolonged and protracted events”.
64. There was much debate before us about the meaning of non-pecuniary or non-material damage, and whether or not those terms might include loss of control damages of the kind sought by Mr Lloyd. I accept that one cannot interpret a Directive by reference to the Regulation that replaced it. But I have, nonetheless found it helpful although not decisive to consider how the GDPR deals with damage. Article 82.1 of the GDPR provides that a person who has suffered “material or non-material damage as a result of an infringement of this Regulation” should have the right to receive compensation for the damage suffered.
65. Whilst recital 85 is actually concerned with the need to notify such data breaches within 72 hours, it is noteworthy that “loss of control” over personal data is given as an example of the kind of “physical, material or non-material damage” that might be caused to natural persons as a result of a data breach. This, as it seems to me, accords with the conclusion that I have already reached as to the EU law position on the availability of damages for non-trivial data processing breaches in respect of loss of control. It is also worth mentioning that section 169(5) of the Data Protection Act 2018, implementing the GDPR, provides that “damage” includes financial loss and damage not involving financial loss, such as distress. That too is a non-exclusive definition.
70. For the reasons, I have given, I would conclude that damages are in principle capable of being awarded for loss of control of data under article 23 and section 13, even if there is no pecuniary loss and no distress. The words in section 13 “[an] individual who suffers damage by reason of [a breach] is entitled to compensation” justify such an interpretation, when read in the context of the Directive and of article 8 of the Convention and article 8 of the Charter, and having regard to the decision in Gulati. Only by construing the legislation in this way can individuals be provided with an effective remedy for the infringement of such rights.
46. The first question that arises is whether control over data is an asset that has value. That question again should, in this context, be answered as a matter of EU law. In Your Response Limited v. Datateam Business Media Limited [2014] EWCA Civ 281, this court held that, as a matter of English law, an electronic database was not a form of property capable of possession and that, therefore, it could not be subject to a possessory lien. That question may in due course need to be revisited, but it does not, in my judgment affect the answer to the relevant question for current purposes. Even if data is not technically regarded as property in English law, its protection under EU law is clear. It is also clear that a person’s BGI has economic value: for example, it can be sold. It is commonplace for EU citizens to obtain free wi-fi at an airport in exchange for providing their personal data. If they decline to do so, they have to pay for their wifi usage. The underlying reality of this case is that Google was able to sell BGI collected from numerous individuals to advertisers who wished to target them with their advertising. That confirms that such data, and consent to its use, has an economic value. 47. Accordingly, in my judgment, a person’s control over data or over their BGI does have a value, so that the loss of that control must also have a value. In one sense, if that is right, it is sufficient to answer the question of whether, in theory, a person can recover compensation under section 13 and article 23. But it is necessary first to consider whether this kind of loss of control over data can properly be considered damage in the legal sense in which the term “damage” is used in article 23 and section 13.
57. To summarise this aspect of the case, in my judgment the decision in Gulati is (a) relevant, albeit strictly not binding on us as it was not a decision on the DPA, and (b) applicable by analogy, for three main reasons. First, both MPI and section 13 derive from the same core rights to privacy. Secondly, since loss of control over telephone data was held to be damage for which compensation could be awarded in Gulati, it would be wrong in principle if the represented claimants’ loss of control over BGI data could not, likewise, for the purposes of the DPA, also be compensated. Thirdly, the EU law principles of equivalence and effectiveness point to the same approach being adopted to the legal definition of damage in the two torts which both derive from a common European right to privacy.
58. Thus far, I have tried to deal with the meaning of article 23 and section 13 from first principles in the light of Gulati. As it seems to me, however, there is also some support for the approach I have adopted in a range of authorities cited by the parties.
59. In Halliday v. Creation Consumer Finance Limited [2013] EWCA Civ 333, the Court of Appeal awarded the claimant £750 for the wrongful processing of his data. Arden LJ said at [35] that it was a “general principle that, where an important European instrument such as data protection had not been complied with, there ought to be an award”, even though there was “no contemporary evidence of any manifestation of injury to feelings and distress apart from what one would normally expect from frustration at these prolonged and protracted events”.
64. There was much debate before us about the meaning of non-pecuniary or non-material damage, and whether or not those terms might include loss of control damages of the kind sought by Mr Lloyd. I accept that one cannot interpret a Directive by reference to the Regulation that replaced it. But I have, nonetheless found it helpful although not decisive to consider how the GDPR deals with damage. Article 82.1 of the GDPR provides that a person who has suffered “material or non-material damage as a result of an infringement of this Regulation” should have the right to receive compensation for the damage suffered.
65. Whilst recital 85 is actually concerned with the need to notify such data breaches within 72 hours, it is noteworthy that “loss of control” over personal data is given as an example of the kind of “physical, material or non-material damage” that might be caused to natural persons as a result of a data breach. This, as it seems to me, accords with the conclusion that I have already reached as to the EU law position on the availability of damages for non-trivial data processing breaches in respect of loss of control. It is also worth mentioning that section 169(5) of the Data Protection Act 2018, implementing the GDPR, provides that “damage” includes financial loss and damage not involving financial loss, such as distress. That too is a non-exclusive definition.
70. For the reasons, I have given, I would conclude that damages are in principle capable of being awarded for loss of control of data under article 23 and section 13, even if there is no pecuniary loss and no distress. The words in section 13 “[an] individual who suffers damage by reason of [a breach] is entitled to compensation” justify such an interpretation, when read in the context of the Directive and of article 8 of the Convention and article 8 of the Charter, and having regard to the decision in Gulati. Only by construing the legislation in this way can individuals be provided with an effective remedy for the infringement of such rights.
Comment