Lloyd vs Google: A Marketers' Approach

What happened?

Most of us will remember that Mr. Richard Lloyd claimed that Google secretly tracked the internet activity of millions of Apple iPhone users. It collected the data for commercial purposes (targeted advertisement), without the users’ knowledge or consent for several months in late 2011 and early 2012.

In August 2012, Google agreed to pay a civil penalty of $22.5m US to settle charges brought by the United States Federal Trade Commission. Later in November 2013, Google agreed to pay $17m US to settle consumer-based actions brought against it in the United States.

In England and Wales, three individuals sued Google in June 2013, making the same allegation and claiming compensation under the DPA 1998 and at common law for misuse of private information: see Vidal-Hall v Google Inc (Information Comr intervening) [2015] EWCA Civ 311; [2016] QB 1003.

Though the factual allegation is not new, what was new is that Mr Lloyd did not just claim damages in his own right, as the three claimants did in Vidal-Hall. He claimed to represent every resident in England and Wales who owned an Apple iPhone at the relevant time and whose data was obtained by Google without their consent, and to be entitled to recover damages on behalf of all these people.

Why it is important?

On 10 November 2021, after a long court process – the case went up to the UK’s highest court, the Supreme Court – Google won its appeal, as the UK Supreme Court handed down the much-anticipated judgment in Lloyd v Google LLC [2021] UKSC 50.

This decision is important, because it determines a few issues that will have far-reaching consequences for the future of data protection litigation, the class action landscape in England and Wales, and more generally.

For the marketing world, it is important, because although it may not be directly looking into the targeted advertisement behaviour of Google, it provides us an opportunity to see how the Supreme Court approached targeted advertisement which is, according to the claim, done with non-consented personal data.

What were the details of the case?

Mr Lloyd brought a claim as a representative action against Google on behalf of approximately four million individuals. He argued that Google had unlawfully processed browser data directly from users’ mobile devices without their consent, using what has been called the “Safari Workaround.” This bypasses privacy settings to track cookies for the purposes of targeted advertising.

It was an opt-out form class action claim that meant all members of a particular class of claimant –Safari users, whose data had been taken away and processed without their consent by Google – were the party of this case unless they opted-out.

The decision:

The Supreme Court ruled that damages for “loss of control” are not available for breach of the Data Protection Act 1998 (DPA 1998), and that even if loss of control damages had been available, the claim could not be brought as a representative action, as it would still have been necessary to assess the extent of the unlawful processing in each individual case.

This can be further explained as:

1. The claim that individuals could recover damages for “loss of control” over their personal data failed on the wording of s. 13 DPA 1998. 

The court held that on its proper interpretation, the term “damage” in s. 13 must mean material damage (such as financial loss or mental distress), and not just any unlawful processing itself.

Accordingly, claims under the DPA 1998 require proof of financial loss or distress to found a cause of action.

2. A claim for damages will not be able to be brought as a representative action unless the damages claimed can be calculated on a common basis for all of the members of the class represented. ⁱ

What does this mean?

The Supreme Court did not say what Google had possibly done is OK in terms of processing personal data for targeted advertisement, without receiving consent or having a valid lawful basis in hand.

Individuals can still sue organisations for loss of control of their personal data and claim damages, as long as they prove that their damage is a material one. This interpretation should also apply for the EU and UK GDPR cases.

But if one would like to bring a representative action on behalf of the people who are possibly affected for loss of control of their personal data, it is required to prove the same material damage that all of the members of the class have suffered. This is a rather difficult thing to prove, therefore the representative action claims may not have a future under such claim.

Data protection authorities should be willing to look at the individual cases and provide justice for those who lost the control of their data and be the subject of targeted advertisement.

Asli Yildiz
Head of Legal
DMA

i https://www.nortonrosefulbright.com/en/inside-disputes/blog/202111-good-news-for-data-controllers-lloyd-v-google-supreme-court-decision. Thank you to the NRF for the parts taken from this article.