On 2nd of October 2019, the Court of Appeal, in a unanimous decision, overturned the Judgment of Mr Justice Warby dated 8 October 2018 which had refused Mishcon de Reya’s client, Richard Lloyd, permission to serve a representative action on Google LLC. The claim relates to what is known as the “Safari Workaround” – Google’s alleged unlawful and clandestine tracking of iPhone users in 2011 and 2012 without their consent through the use of third party cookies. Mr Lloyd seeks damages against Google LLC on behalf of a class of over 4 million iPhone users alleging breaches of s.4(4) of the Data Protection Act 1998 (DPA) and claiming compensation under s.13 of the Act. The claim is brought as a representative action under CPR r19.6.
The Court of Appeal’s decision is ground breaking in that it confirms a number of important legal principles under Data Protection law and for representative actions under CPR r19.6 that could establish a new procedural framework for the conduct of mass data breach claims:
- An individual’s personal data has an economic value and loss of control of that data is a violation of their right to privacy which can, in principle, constitute damage under s.13 of the DPA, without the need to demonstrate pecuniary loss or distress. The Court, can therefore, award a uniform per capita sum to members of the class in representative actions for the loss of control of their personal data.
- That individuals who have lost control of their personal data have suffered the same loss and therefore share the “same interest” under CPR 19.6.
- That representative actions are, in practice, the only way that claims such as this can be pursued.
The text of the full court decision is available here: https://www.judiciary.uk/judgments/richard-llyod-v-google-llc/