In the briefing below, we look at the Court of Appeal's recent decision in Lloyd -v- Google [2019] EWCA CIV 1599 to allow a giant class action regarding the alleged unauthorised use of iPhone internet browsing data to proceed against Google, under 19.6 of the Civil Procedure Rules 1998 (the "CPR"). The decision may represent a landmark, where we see the courts of England and Wales smoothing the way for more 'opt-out' models of class action to be brought.
The facts
The Claimant and class representative, Mr Lloyd, was a champion of consumer protection and brought a claim against Google for the alleged unauthorised tracking of the internet browsing activity of some 4 million Apple iPhone users between 2011 and 2012. At the time, the Apple Safari browser was configured so as to block third party cookies. This configuration prevented certain applications from functioning correctly, so Apple devised exceptions to the default settings. Google used these exceptions to devise the 'Safari Workaround' which enabled it to place a cookie on an iPhone user's device, without the user's consent or knowledge.
This allowed Google to ascertain an iPhone user's browsing activity and use this browsing activity to identify patterns and place users in groups based on aggregated data, with labels such as 'football lovers' or 'current affairs enthusiasts'.
Mr Lloyd issued a claim alleging breach of statutory duty under section 4(4) of the Data Protection Act 1998 (the "DPA"). He brought the claim on behalf of a represented class in reliance on CPR 19.6 which provides that where more than one person has the same interest in a claim, the claim may be begun by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.
The first instance decision
In the context of an application for permission to serve out of the jurisdiction on Google, the judge at first instance held that the claim presented no reasonable basis for seeking compensation under the DPA. When the judge turned to the question of whether the claim should be permitted to continue as a representative action under CPR Part 19.6, he held that this course was not available unless: (a) every member of the class had suffered the same damage, and (b) different potential defences were not available in respect of claims by different members of the class. He relied on these two factors to conclude that all of the members of the class did not have the "same interest".
Secondly, the judge held that it would not be 'workable' to identify the persons in the class and that there was a risk that a person might come forward honestly to claim compensation which was not in fact due, and there might be abuse.
Finally, the judge held that the court was permitted to use its discretion to halt the continued pursuit of the claim as a representative action because he considered that: (a) the main beneficiaries of the claim would be the funders and the lawyers; (b) the litigation would generate significant costs and the amount recovered by each class member would be modest; (c) few class members had come forward to complain; (d) it was not possible to identify members of the class; and (e) the members of the class had not authorised the claim.
The Court of Appeal decision
The Court of Appeal looked at each of the issues heard at first instance. As a starting point, it found that "loss of control" of the data was a valid basis for a claim even if there is no pecuniary loss or distress. In light of this finding, the Court of Appeal found that the judge at first instance had applied too stringent a test of "same interest" and that this should be viewed in the old fashioned language of Lord Macnaghten in the The Duke of Bedford -v- Ellis [1901] AC 1 as being where the claimants have "common interest and a common grievance" and "the relief sought is in its nature beneficial to all".
As regards the ability to identify the members of the class, the Court of Appeal found that the judge at first instance ought to have held that the members were identifiable. The data held by Google was enough to establish who was and was not in the class and the Court of Appeal found that the number of claimants cannot itself affect the ability to use the representative procedure.
Finally, the Court of Appeal found that the fact that the members of the class had not authorised the claim should not have been taken into account in exercising the discretion of the court, and therefore the discretion could be exercised afresh. The Court of Appeal concluded that as a matter of discretion the claim should be allowed to proceed.
Conclusion
The Court of Appeal's findings in relation to the ability to claim damages for loss of control of data may be relied upon in future cases involving a breach of data privacy. However, what may be of wider application are the findings in relation to the test needed to be met in order to bring a representative action under CPR 19.6, which may assist those seeking to bring "opt-out" style class actions in this jurisdiction. The English courts have traditionally been reluctant to facilitate the use of class actions which operate on an "opt-out" style basis, but this case demonstrates that there may now be a willingness to allow such actions to proceed, coupled with a precedent for a more relaxed test as to what constitutes the "same interest" and what it means for a member of a class to be "identifiable". Whether or not this attitude is extended to claims outside the realms of data privacy breaches remains to be seen, but there is now a distinct possibility that we may see more representative actions permitted by the English courts in this area and beyond.
