ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
The Hon. Mr Justice Tugendhat
Strand, London, WC2A 2LL
B e f o r e :
LORD JUSTICE MCFARLANE
LADY JUSTICE SHARP
| GOOGLE INC.
|- and -
- and -
|THE INFORMATION COMMISSIONER
DTI Global A DTI Global Company
165 Fleet Street, London EC4A 2DY
Tel No: 020 7404 1400, Fax No: 020 7831 8838
Official Shorthand Writers to the Court)
Hugh Tomlinson QC and Ben Silverstone (instructed by Olswang LLP) for the Claimants
Anya Proops and Julian Milford (instructed by the Information Commissioner's Office) for the Intervener
Hearing dates : 8 December 2014, 2-3 March 2015
Crown Copyright ©
The Master of the Rolls and Lady Justice Sharp:
The claims in outline
The jurisdictional question
"3.1 The claimant may serve a claim form out of the jurisdiction with the permission of the court under CPR 6.36 where –
(2) A claim is made for an injunction ordering the defendant to do or refrain from doing an act within the jurisdiction…
(9) A claim is made in tort where – (a) damage was sustained within the jurisdiction; or (b) the damage sustained resulted from an act committed within the jurisdiction…
(11) The whole subject matter of a claim relates to property located within the jurisdiction…
(16) A claim is made for restitution where the defendant's alleged liability arises out of acts committed within the jurisdiction…"
The judge's decision in summary
(i) The judge decided he was bound by the decision in Kitechnology BV v Unicor GmbH Plastmachinen  FSR 765 to hold that breach of confidence was not a tort, but he held that misuse of private information was a tort for the purposes of the rules governing service out of the jurisdiction. He also held that 'damage' in CPR PD 6B para 3.1(9) meant damage that was recoverable for the tort in question, and included damages for distress, recoverable in a claim for misuse of personal information. It followed that the claimants' claims for misuse of private information fell within CPR PD 6B para 3.1(9)(a). In any event, the judge said this claim would have fallen within CPR PD 6B para 3.1(9)(b) because the damage resulted from an act committed within the jurisdiction, namely the publication of the advertisements on the claimants' screens. He held further that the claimants had established that there were serious issues to be tried as to whether the relevant information was "private" information;
(ii) The judge gave the claimants permission to rely on CPR PD 6B para 3.1(9) in respect of the DPA claim. There is no appeal against that order. The judge held there were serious issues to be tried (a) that the claimants' claims for compensation under section 13 of the DPA did not require proof of pecuniary loss; and therefore that there was a good arguable claim for compensation under that section; and (b) that the BGI constituted personal data for the purposes of the DPA claim;
(iii) The judge decided the claimants had a real and substantial cause of action in their claims for misuse of private information and under the DPA, and it would not be just to set aside service on the grounds that 'the game was not worth the candle';
(iv) The judge held the claimants could not bring themselves within the 'injunction' gateway under CPR PD 6B para 3.1(2) and dismissed the claimants' applications to rely on CPR PD 6B paras 3.1(11) and (16). In respect of the claim for an injunction, the defendant had stopped the conduct complained of by time the Particulars of Claim were served, and had destroyed the relevant data. The judge said the application to rely on CPR PD 6B para 3.1(11) and (16) raised difficult questions of law and had been made too late. The judge therefore declared the court had no jurisdiction to try the claims for an injunction or the claims for breach of confidence, and the claim form and Particulars of Claim, in respect of those claims were set aside. These decisions are not the subject of any appeal.
The issues on this appeal
(i) Whether misuse of private information is a tort for the purposes of CPR PD 6B para 3.1(9);
(ii) The meaning of damage in section 13 of the DPA, in particular, whether there can be a claim for compensation without pecuniary loss;
(iii) Whether there is a serious issue to be tried that the BGI is personal data under the DPA; and
(iv) Whether in relation to the claims for misuse of private information and under the DPA there is a real and substantial cause of action.
(i) Whether misuse of private information is a tort for the purposes of CPR PD 6B para 3.1(9)
"Breach of confidence: misuse of private information
13. The common law or, more precisely, courts of equity have long afforded protection to the wrongful use of private information by means of the cause of action which became known as breach of confidence. A breach of confidence was restrained as a form of unconscionable conduct, akin to a breach of trust. Today this nomenclature is misleading. The breach of confidence label harks back to the time when the cause of action was based on improper use of information disclosed by one person to another in confidence. To attract protection the information had to be of a confidential nature. But the gist of the cause of action was that information of this character had been disclosed by one person to another in circumstances 'importing an obligation of confidence' even though no contract of non-disclosure existed: see the classic exposition by Megarry J in Coco v A N Clark (Engineers) Ltd  RPC 41, 47-48. The confidence referred to in the phrase 'breach of confidence' was the confidence arising out of a confidential relationship.
14. This cause of action has now firmly shaken off the limiting constraint of the need for an initial confidential relationship. In doing so it has changed its nature. In this country this development was recognised clearly in the judgment of Lord Goff of Chieveley in Attorney-General v Guardian Newspapers Ltd (No 2)  1 AC 109, 281. Now the law imposes a 'duty of confidence' whenever a person receives information he knows or ought to know is fairly and reasonably to be regarded as confidential. Even this formulation is awkward. The continuing use of the phrase 'duty of confidence' and the description of the information as 'confidential' is not altogether comfortable. Information about an individual's private life would not, in ordinary usage, be called 'confidential'. The more natural description today is that such information is private. The essence of the tort is better encapsulated now as misuse of private information.
15. In the case of individuals this tort, however labelled, affords respect for one aspect of an individual's privacy. That is the value underlying this cause of action. An individual's privacy can be invaded in ways not involving publication of information. Strip-searches are an example. The extent to which the common law as developed thus far in this country protects other forms of invasion of privacy is not a matter arising in the present case. It does not arise because, although pleaded more widely, Miss Campbell's common law claim was throughout presented in court exclusively on the basis of breach of confidence, that is, the wrongful publication by the 'Mirror' of private information.
16. The European Convention on Human Rights, and the Strasbourg jurisprudence, have undoubtedly had a significant influence in this area of the common law for some years. The provisions of article 8, concerning respect for private and family life, and article 10, concerning freedom of expression, and the interaction of these two articles, have prompted the courts of this country to identify more clearly the different factors involved in cases where one or other of these two interests is present. Where both are present the courts are increasingly explicit in evaluating the competing considerations involved. When identifying and evaluating these factors the courts, including your Lordships' House, have tested the common law against the values encapsulated in these two articles. The development of the common law has been in harmony with these articles of the Convention: see, for instance, Reynolds v Times Newspapers Ltd  2 AC 127, 203-204.
17. The time has come to recognise that the values enshrined in articles 8 and 10 are now part of the cause of action for breach of confidence. As Lord Woolf CJ has said, the courts have been able to achieve this result by absorbing the rights protected by articles 8 and 10 into this cause of action: A v B plc  QB 195, 202, para 4. Further, it should now be recognised that for this purpose these values are of general application. The values embodied in articles 8 and 10 are as much applicable in disputes between individuals or between an individual and a non-governmental body such as a newspaper as they are in disputes between individuals and a public authority."
"As the law has developed breach of confidence, or misuse of confidential information, now covers two distinct causes of action, protecting two different interests: privacy, and secret ('confidential') information. It is important to keep these two distinct. In some cases information may qualify for protection both on grounds of privacy and confidentiality. In other instances information may be in the public domain, and not qualify for protection as confidential, and yet qualify for protection on the grounds of privacy. Privacy can be invaded by further publication of information or photographs already disclosed to the public. Conversely, and obviously, a trade secret may be protected as confidential information even though no question of personal privacy is involved. "
"8. It will be necessary to refer to the underlying law at various stages of the argument, and it would be tedious to repeat such reference more than is necessary. Since the content of that law is in some respects a matter of controversy, I set out what I understand the present state of that law to be. I start with some straightforward matters, before going on to issues of more controversy: (i) There is no English domestic law tort of invasion of privacy. Previous suggestions in a contrary sense were dismissed by Lord Hoffmann, whose speech was agreed with in full by Lord Hope of Craighead and Lord Hutton, in Wainwright v Home Office  2 AC 406 -. (ii) Accordingly, in developing a right to protect private information, including the implementation in the English courts of articles 8 and 10 of the European Convention on Human Rights, the English courts have to proceed through the tort of breach of confidence, into which the jurisprudence of articles 8 and 10 has to be "shoehorned": Douglas v Hello! (No3) QB 125 . (iii) That feeling of discomfort arises from the action for breach of confidence being employed where there was no pre-existing relationship of confidence between the parties, but the "confidence" arose from the defendant having acquired by unlawful or surreptitious means information that he should have known he was not free to use: as was the case in Douglas, and also in Campbell v MGN  2 AC 457. Two further points should however be noted: (iv) At least the verbal difficulty referred to in (iii) above has been avoided by the rechristening of the tort as misuse of private information: per Lord Nicholls of Birkenhead in Campbell  2 AC  (v) Of great importance in the present case, as will be explained further below, the complaint here is of what might be called old-fashioned breach of confidence by way of conduct inconsistent with a pre-existing relationship, rather than simply of the purloining of private information.
"The effect of this guidance is, therefore, that in order to find the rules of the English law of breach of confidence we now have to look in the jurisprudence of articles 8 and 10. Those articles are now not merely of persuasive or parallel effect but, as Lord Woolf says, are the very content of the domestic tort that the English court has to enforce…"
"The principles stated by Lord Nicholls [in Campbell] can we think be summarised in this way. (i) The right to freedom of expression enshrined in article 10 of the Convention and the right to respect for a person's privacy enshrined in article 8 are vitally important rights. Both lie at the heart of liberty in a modern state and neither has precedence over the other: see . (ii) Although the origin of the cause of action relied upon is breach of confidence, since information about an individual's private life would not, in ordinary usage, be called 'confidential', the more natural description of the position today is that such information is private and the essence of the tort is better encapsulated now as misuse of private information: see ."
"The domestic law of confidence was extended again by the House of Lords in Campbell v MGN Ltd  UKHL 21,  2 AC 457, effectively to incorporate the right to respect for private life in article 8 of the Convention, although its extension from the commercial sector to the private sector had already been presaged by decisions such as Argyll v Argyll and Hellewell v Chief Constable of Derbyshire  1 WLR 804. In the latter case, Laws J suggested (page 807) that the law recognised "a right to privacy, although the name accorded to the cause of action would be breach of confidence". It goes a little further than nomenclature in that, in Wainwright v Home Office  UKHL 53,  2 AC 406, the House of Lords held that there was no tort of invasion of privacy, even now that the Human Rights of Act 1998 is in force. Nonetheless, following its later decision in Campbell, there is now a tort of misuse of private information: as Lord Phillips of Worth Matravers MR put it in Douglas v Hello! Ltd (No 3)  EWCA Civ 595,  QB 125, a claim based on misuse of private information has been "shoehorned" into the law of confidence. "
"It was not suggested that section 9(1) of the Private International Law (Miscellaneous Provisions) Act 1995 is applicable to this case, but we have none the less considered that question. That section governs the choice of law for determining issues relating to tort. The Douglases' claim in relation to invasion of their privacy might seem most appropriately to fall within the ambit of the law of delict. We have concluded, however, albeit not without hesitation, that the effect of shoe-horning this type of claim into the cause of action of breach of confidence means that it does not fall to be treated as a tort under English law, see Kitechnology BV v Unicor GmbH  IL Pr 568;  FSR 795 at paragraph 40, and more generally Clerk & Lindsell on Torts, (18th edition, 2000) at footnotes 2 and 3 to paragraph 27-001. Nor has anyone suggested that the facts of this case give rise to a cause of action in tort under the law of New York (see below). Accordingly we have concluded that the parties were correct to have no regard to section 9(1) of the 1995 Act. "
97. Dicey & Morris on The Conflict of Laws (13th edition, 2000) Vol II suggest somewhat tentatively, at paragraph 34-029 and following, that a claim for breach of confidence falls to be categorised as a restitutionary claim for unjust enrichment and that the proper law is the law of the country where the enrichment occurred. While we find this reasoning persuasive, it does not solve the problem on the facts of this case. Even if the Douglases' claim for invasion of their privacy falls to be determined according to principles of English law, these may themselves require consideration of the law of New York. That indeed is the case advanced on behalf of Hello!"
"No civil injury is to be classed as a tort if it is only a breach of trust or some other merely equitable obligation. The reason for this exclusion is historical only. The law of torts is in its origin a part of the common law, as distinguished from equity, and it was unknown to the Court of Chancery."
"54. Judges commonly adopt one or both of two approaches to resolving issues as to the meaning of a legal term, in this case the word "tort". One approach is to look back to the history or evolution of the disputed term. The other is to look forward to the legislative purpose of the rule in which the disputed word appears. A term may have different meanings in different contexts. What is now para 3.1 of the Practice Direction has a history which includes the RSC Order 11 rule 1, and goes back to 1852, when service out of the jurisdiction was first authorised by statute (before that proceedings could only be brought if service could be effected within the jurisdiction). In cases on the meaning of terms in para 3.1 and its predecessors, the courts have adopted the historical approach. Counsel were unable to point to any instance where the court had approached the question by looking for the legislative purpose.
55. Thus in Metall & Rohstoff v. Donaldson Inc.  1 Q.B. 391at p473E Slade LJ set out the ground which was then Ord 11 r.1(1) (to which ground 3.1(12) is the current successor (claims about trusts etc)) and said that, no doubt for reasons of policy, the rules clearly contemplate that any other claim which on its proper analysis is founded on a trust shall not fall within the ambit of the rule. But he assumed the reason of policy, without identifying it. And he went to say at p474C-E:
"In our judgment, it is clear beyond argument that a claim which is founded on any of the three categories of constructive trust which we have mentioned cannot be said to be "founded on a tort" within the meaning of R.S.C., Ord. 11, r. 1(1)(f). The law of tort has nothing whatever to do with any such claim. In all such cases the wrongful conduct of the defendant occurs against the background of a pre-existing trust and the claim is founded on that trust. As is stated in Salmond & Heuston on Torts, 19th ed., p. 14, under the heading "Tort and Equity:"
'No civil injury is to be classed as a tort if it is only a breach of trust or some other merely equitable obligation. The reason for this exclusion is historical only. The law of torts is in its origin a part of the common law, as distinguished from equity, and it was unknown to the Court of Chancery.'
56. If there ever had been a reason of policy for not permitting service out of the jurisdiction in such cases, then it must have fallen away, because the legislature then introduced what is now ground (16). When I invited Mr White to assist me on what reason of policy there might be for not permitting service out of the jurisdiction in relation to claims based on equitable obligations (other than those specifically mentioned in the grounds in PD para 3.1), including claims for breach of confidence, the only suggestion that he was able to offer was that civil law jurisdictions do not recognise equitable obligations. But there are two observations to be made as to that suggestion. It would not explain a policy to exclude service out in the many common law jurisdictions in the world which do recognise equitable obligations. And civil law jurisdictions have managed to develop civil liability for breaches of an obligation of confidence in relation to personal information without the benefit of a historical equivalent of the law of equity. For example, French law recognised civil liability for interference with a right to privacy even before the Code Civil was amended to give a statutory right in Art 9 (Dicey & Morris on Conflict of Laws 15th ed para 34-092, text to note 465).
57. Moreover, history does not determine identity. The fact that dogs evolved from wolves does not mean that dogs are wolves. So the editors write that there is an argument for looking beyond the historical domestic divide between law and equity: ibid text to note 472."
(ii) The meaning of damage in section 13 of the DPA, in particular, whether there can be a claim for compensation without pecuniary loss
"personal data" means data which relate to a living individual who can be identified—
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller…"
"In this Act "the special purposes" means any one or more of the following—
(a) the purposes of journalism,
(b) artistic purposes, and
(c) literary purposes."
"(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes".
"(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals;
(7) Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their responsibilities under Community law; whereas this difference in levels of protection is due to the existence of a wide variety of national laws, regulations and administrative provisions;
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
(11) Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data…."
"Object of the Directive
In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data."
"1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered."
Johnson v MDU
" sufficient to dispose of the entire proceedings in favour of the MDU, but in view of the detailed argument that we have received about the other issues I go on to consider them."
"However, and additionally, there are substantial grounds, not affected by either of those issues, why the appeal must fail in any event. That being so, it would not be appropriate to occupy the time of the ECJ on matters that cannot affect the outcome of the litigation. "
Does "damage" in article 23 of the Directive include non-pecuniary loss?
One of the grounds on which the Commission argued that the UK had not implemented the Directive correctly was that the UK Act does not provide for "moral damages". The term "moral damages" may be unfamiliar to many UK lawyers. It is a right to compensation for breach of individual rights where the rights are non-pecuniary or non-property based. It covers rights such as business reputation or the right to privacy. There is no reference to moral damages in the Directive. Article 23 provides that Member States shall provide that any person who suffers damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered. There is no presumption in EU law that the term "damages" includes moral damages. Nothing in the recital to the Directive refers to moral damage. We have found nothing in Commission or Article 29 WP papers to suggest that the Directive requires compensation for moral damages. As there is no published material setting out the basis for the Commission's view one can only hazard the guess that her view is that "an effective remedy" must include some element of compensation for any breach of the DPA and therefore where a breach has caused a hurt to feelings or dignity but no actual loss a remedy in damages should be provided by the UK courts. On the other hand it can be strongly argued that there is no such obligation as long as the domestic legal system provides an effective set of remedies. Moreover the fact that awards can be made for distress (the moral damage equivalent) where the breach involves the literary, journalistic or artistic purposes would argue that any reputational damage is likely to be covered."
"According to settled case-law, the need for the uniform application of European Union law and the principle of equality require that the terms of a provision of European Union law which makes no express reference to the law of the Member States for the purpose of determining its meaning and scope must normally be given an autonomous and uniform interpretation throughout the European Union, which must take into account the context of that provision and the purpose of the legislation in question (see, inter alia, Flachglas Torgau, paragraph 37)."
" In view of the fact that the Directive employs the term 'damage' in a general sense without any restrictive connotation, it must be inferred - and on this point I find myself in agreement with the observations of the Commission and the Belgian Government - that the concept should be interpreted widely, that is to say in favour of the argument that, at least in principle, the scope of the Directive was intended to cover all types of damage which have any causal link with the non-performance or improper performance of the contract".
And at para 38:
"As regards Community case-law, I must point out that, albeit in respect of the Community's non-contractual liability, clear positions have been adopted in favour of extending the concept of damage to include non-material damage. On several occasions, in fact, the Court of First Instance has recognised that such liability may be extended to non-material damage provided that genuine quantifiable damage has occurred: thus, at least in principle, damage arising from the loss of the opportunity to study, and damage connected with loss of a company's image and reputation have been considered liable for compensation."
"21 It is not in dispute that, in the field of package holidays, the existence in some Member States but not in others of an obligation to provide compensation for non-material damage would cause significant distortions of competition, given that, as the Commission has pointed out, non-material damage is a frequent occurrence in that field.
22 Furthermore, the Directive, and in particular Article 5 thereof, is designed to offer protection to consumers and, in connection with tourist holidays, compensation for non-material damage arising from the loss of enjoyment of the holiday is of particular importance to consumers.
23 It is in light of those considerations that Article 5 of the Directive is to be interpreted. Although the first subparagraph of Article 5(2) merely refers in a general manner to the concept of damage, the fact that the fourth subparagraph of Article 5(2) provides that Member States may, in the matter of damage other than personal injury, allow compensation to be limited under the contract provided that such limitation is not unreasonable, means that the Directive implicitly recognises the existence of a right to compensation for damage other than personal injury, including non-material damage."
The construction of section 13(2) of the DPA
"For present purposes, it is sufficient to notice that cases such as Pickstone v Freemans plc and Litster v Forth Dry Dock & Engineering Co Ltd suggest that, in terms of section 3(1) of the 1998 Act, it is possible for the courts to supply by implication words that are appropriate to ensure that legislation is read in a way which is compatible with Convention rights. When the court spells out the words that are to be implied, it may look as if it is "amending" the legislation, but that is not the case. If the court implies words that are consistent with the scheme of the legislation but necessary to make it compatible with Convention rights, it is simply performing the duty which Parliament has imposed on it and on others. It is reading the legislation in a way that draws out the full implications of its terms and of the Convention rights. And, by its very nature, an implication will go with the grain of the legislation. By contrast, using a Convention right to read in words that are inconsistent with the scheme of the legislation or with its essential principles as disclosed by its provisions does not involve any form of interpretation, by implication or otherwise. It falls on the wrong side of the boundary between interpretation and amendment of the statute."
Article 47 of the EU Charter of Fundamental Rights ("the Charter")
"Article 47. Right to an effective remedy and to a fair trial
Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article…"
"72. As the Court said in Kükükdevici, para 51, it is for a national court, in applying national law, to provide, within the limits of its jurisdiction, the legal protection which individuals derive from European Union law and to ensure the full effectiveness of that law, disapplying if need be any provision of national legislation contrary to that principle (see, to that effect, Mangold, para 77).
In the present cases, on the assumptions (contrary to my conclusions), first, that European law recognises an individual right to vote paralleling in substance that recognised in the Strasbourg case-law of Hirst (No 2) and Scoppola, and, second, that the view taken by the majority of the Grand Chamber in Hirst (No 2) regarding standing to claim a general declaration were to be transposed into European law, the only relief that could be considered under domestic law would be a generally phrased declaration that the legislative provisions governing eligibility to vote in European Parliamentary and municipal elections in the United Kingdom were inconsistent with European Union law. Thereafter, it would be for the United Kingdom Parliament to address the position and make such legislative changes as were considered appropriate. But, for reasons paralleling those given in paras 40 – 42 above, it appears improbable that the Convention rights would, even when viewed through the prism of European Union law, involve or require the granting of declarations in the abstract at the instance of claimants like both Chester and McGeoch, detained in circumstances summarised in para 1 above, from whom the United Kingdom Parliament could legitimately, and it seems clear would, under any amended legislative scheme still withhold the vote.
73. I reject the submission that the Supreme Court could or should simply disapply the whole of the legislative prohibition on prisoner voting, in relation to European Parliamentary and municipal elections, thereby making all convicted prisoners eligible to vote pending fresh legislation found to conform with European Union law. It is clear from both Hirst (No 2) and Scoppola that, under the principles established by those cases, a ban on eligibility will be justified in respect of a very significant number of convicted prisoners.
74. Nor would it have been possible to read the RPA section 3 or EPEA section 8 compatibly with European law; the legislation is entirely clear and it would flatly contradict the evident intention of the United Kingdom, when enacting it, to read into it or to read it as subject to some unspecified scheme or set of qualifications allowing some unspecified set of convicted prisoners to vote under some unspecified conditions and arrangements. It would also be impossible for the Supreme Court itself to devise an alternative scheme of voting eligibility that would or might pass muster in a domestic or supra-national European Court. Equally, the Court could not determine or implement the practical and administrative arrangements that would need to be made to enable any convicted prisoners eligible under any such scheme to have the vote. Such matters would be beyond its jurisdiction. In the domestic constitutional scheme, any scheme conferring partial eligibility to vote on some convicted prisoners is quintessentially a matter for the United Kingdom Parliament to consider, determine and arrange. In the passage quoted in para 72 above, the Court of Justice made clear that it is only "within the limits of its jurisdiction" that a national court can be expected to provide the legal protection that European Union law requires. That being so, the creation of any new scheme must be a matter for the United Kingdom Parliament."
(iii) Whether there is a serious issue to be tried that the BGI is personal data under the DPA
""personal data" shall mean any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity."
(i) The first limb of the definition of personal data in section 1(1)(a) of the DPA cannot apply here. The BGI data on its own is anonymous, and it does not name or identify any individual. It is not therefore personal data within that first limb because a living individual cannot be identified from the data.
(ii) The judge was prepared to accept for the purpose of the hearing, that the defendant kept the BGI segregated from other data (in its hands) from which an individual could be identified, such as Gmail accounts. In those circumstances, the second limb of section 1(1) cannot apply either, because a living individual is not identifiable from the BGI "and other information which is the possession of or likely to come into the possession of, the data controller".
(iii) One of the reasons given by the judge for concluding the BGI was personal data was the potential identification of the claimants as persons having the characteristics to be inferred from the targeted advertisements by third parties viewing the claimants' screens. Mr White submits this is an impermissible third route to identification. The knowledge of a third party is not likely to come into the possession of the defendant. Such information does not therefore fall within the second limb of the definition of personal data either: see Common Services Agency v Scottish Information Commissioner  UKHL 47;  1 WLR 1550 at para 92.
The first argument
"In general terms, a natural person can be considered as "identified" when, within a group of person, he or she is "distinguished" from all other members of the group. Accordingly, the natural person is "identifiable" when, although the person has not been identified yet, it is possible to do it…
At this point, it should be noted that, while identification through the name is the most common occurrence in practice, a name may itself not be necessary in all cases to identify an individual. This may happen when other "identifiers" are used to single someone out. Indeed, computerised files registering personal data usually assign a unique identifier to the persons registered, in order to avoid confusion between two persons in the file. Also on the Web, web traffic surveillance tools make it easy to identify the behaviour of a machine, and behind the machine, that of its user. The individual's personality is pieced together in order to attribute certain decisions to him or her. Without even enquiring about the name and address of the individual it is possible to categorise this person on the basis of socio-economic, psychological, philosophical or other criteria and attribute certain decisions to him or her since the individual's contact point (a computer) no longer necessarily requires the disclosure of his or her identity in a narrow sense. In other words, the possibility of identifying an individual no longer necessarily means the ability to find out his or her name. The definition of personal data reflects that fact.
The European Court of Justice has spoken [in Criminal proceedings against Lindqvist C-101/0  QB 1014 at p27] in that sense when considering that "referring, on an internet page, to various persons and identifying them by name or other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes the processing of personal data […] within the meaning […] Directive 95/46/CE."
And at p15-16
"The Working Party has considered IP addresses as data relating to an identifiable person. It has stated that "Internet access providers and managers of local area networks can, using reasonable means, identify internet users to whom they have attributed IP addresses as they normally systematically "log" in a file the date, time, duration and dynamic IP address given to the internet user. The same can be said about Internet Service Providers that keep a logbook on the HTTP server. In these cases there is no doubt about the fact that one can talk about personal data in the sense of Article 2(a) of the Directive…"
(i) BGI information comprises two relevant elements: (a) detailed browsing histories comprising a number of elements such as the website visited, and dates and times when websites are visited; and (b) information derived from use of the 'doubleclick' cookie, which amounts to a unique identifier, enabling the browsing histories to be linked to an individual device/user; and the defendant to recognise when and where the user is online, so advertisements can be targeted at them, based on an analysis of their browsing history.
(ii) Taking those two elements together, the BGI enables the defendant to single out users because it tells the defendant (i) the unique ISP address of the device the user is using i.e. a virtual postal address; (ii) what websites the user is visiting; (iii) when the user is visiting them; (iv) and, if geo location is possible, the location of the user when they are visiting the website; (v) the browser's complete browsing history; (vi) when the user is online undertaking browser activities. The defendant therefore not only knows the user's (virtual) address; it knows when the user is at his or her (virtual) home.
"In its Opinion (WP 136) on the concept of personal data, the Working Party has clarified the definition of personal data. An individual's search history is personal data if the individual to which it relates, is identifiable. Though IP addresses in most cases are not directly identifiable by search engines, identification can be achieved by a third party. Internet access providers hold IP address data. Law enforcement and national security authorities can gain access to these data and in some Member States private parties have gained access also through civil litigation. Thus, in most cases – including cases with dynamic IP address allocation – the necessary data will be available to identify the user(s) of the IP address. The Working Party noted in its WP 136 that '… unless the Internet Service Provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side'. These considerations will apply equally to search engine operators." (p.8)
The second argument
"Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any person to identify the said person…"
The third argument
"…I am assuming the particular data which [the researcher] has requested, anonymised in such a way that neither he nor anyone else to whom he might pass them on could identify the individuals to whom they relate. The Agency may well have the key which links those data back to the individual patients. The Agency therefore could identify them and remains bound by the data protection principles when processing the data internally. But the recipient of the information will not be able to identify the individuals either from the data themselves, or from the data plus any other information held by the Agency, because the recipient will not have access to that other information. For the purpose of this particular act of processing, therefore, which is disclosure of these data in this form to these people, no living individual to whom they relate is identifiable. I am afraid that this may not be exactly the same route as that taken by either of my noble and learned friends, Lord Hope of Craighead or Lord Rodger of Earlsferry, but for practical purposes this may not matter and I have no wish to add further confusion to this already confusing case by elaborating."
(iv) Whether in relation to the claims for misuse of private information and under the DPA there is a real and substantial cause of action
Lord Justice McFarlane:
(a) the type of browser (for example, the browser known as "Safari" which is further described at paragraph 5 below);
(b) the operating system of the computer or device;
(c) the address of the website the browser is displaying;
(d) the computer or device's screen resolution; and
(e) the IP address from which the computer or device is connected to the internet.
This information is collectively known and referred to as "Browser- Generated Information". This information is used to display the website accessed to the user in optimum form.
(a) A First Party Cookie is a cookie sent by the website or webpage a browser is visiting. It is used by the browser to remember whether it has visited it before, helping to exchange information such as login information, and it can be used by the website or website to inform it that the browser has previously visited the site and to identify the user.
(b) A Third Party Cookie is a cookie sent to a browser by a website other than the website the browser is on. A Third Party Cookie may be sent to a browser via an advertisement appearing on the website. In such cases the Third Party Cookie may be used to enable the Tracking and Collation of browsing activity across all sites or advertisements in the network operating the Third Party Cookie. The purpose of such Tracking and Collation is to gather information about the sites visited by a browser over time in order to target advertising to the apparent interests demonstrated by a user's browsing history.
(a) Safari allowed Third Party Cookies to be sent to it if, during the process of exchanging information with a third party domain to load third party content, the browser submitted a form to the third party domain (the "Form Submission Rule")
(b) Safari allowed Third Party Cookies to be sent to it if one cookie from that domain was already present on the browser (the "One In, All In Rule)
The Defendant's DoubleClick advertising service
The DoubleClick ID Cookie
(a) The website visited.
(b) The date on which the website was visited.
(c) The time at which the website was visited.
(d) The duration of the visit to the website.
(e) The pages of the website visited.
(f) The time spent visiting each page of the website.
(g) The advertisement(s) viewed.
(h) Information as to where the advertisement(s) was/were placed on the website visited.
(i) The IP Address of the browser, as a result of which it is often possible to determine approximate geographical location (to the nearest town or city).
(a) the order in which websites were visited; and
(b) the frequency with which websites were visited.
(a) internet surfing habits as set out at paragraphs 7.3 and 7.4 above;
(b) interests, hobbies and pastimes;
(c) news reading habits;
(d) shopping habits;
(e) social class;
(f) racial or ethnic origin;
(g) political affiliation or opinion;
(h) religious beliefs or beliefs of a similar nature;
(i) trade union membership;
(j) physical health;
(k) mental health;
(m) sexual interests;
(p) financial situation;
(q) geographical location.
The "Opt Out Cookie"
"After you opt out, Google will not collect interest category information and you will not receive interest based ads"
"If you select the DoubleClick opt-out cookie, ads delivered to your browser by our ad-serving technology will not be based on the DoubleClick cookie".
The Intermediary Cookie
INFORMATION OBTAINED BY THE DEFENDANT
THE CLAIMANTS' CLAIMS
Misuse of private information
(a) the existence and intended operation of Safari's default settings in relation to the Third Party Cookies referred to at paragraph 5.2 above;
(b) the exceptions created by Apple referred to at paragraphs 5.3 above;
(c) the public statement of the Defendant referred to at paragraph 8.4 above.
Data Protection Act 1988
(a) The Private Information is or was at all material times 'data' within the meaning of section 1(1) of the DPA.
(b) The Defendant was a 'data controller' within the meaning of section 1(1) of the DPA.
(c) The Claimants were 'data subjects' within the meaning of section 1(1) of the DPA.
(d) A substantial proportion of the Private Information was 'personal data' within the meaning of section 1(1) of the DPA.
(e) Some of the Private Information was 'sensitive personal data' within the meaning of section 2 of the DPA.
PARTICULARS OF BREACH
(a) Contrary to the first data protection principle the Private Information was not processed fairly and lawfully:
(i) Contrary to Schedule 1, Part 11 paragraph 2(1)(a), the Claimants were not provided with and nor did they have made readily available to them the information referred to at paragraph 2(3) therein.
(ii) The Private Information was obtained without the knowledge or consent of the Claimants and in circumstances where the Defendant had made public statements to the effect that it would not obtain the Private Information from them: see Schedule 1, Part 11, paragraph 1(1).
(iii) None of the conditions in Schedule 2 was met.
(iv) Further, in the case of the Private Information constituting sensitive personal data, none of the conditions in Schedule 3 was also met.
(b) Contrary to the second data protection principle, the Private Information was not obtained only for one or more specified and lawful purposes, or alternatively was further processed in a manner incompatible with that purpose or those purposes.
(c) Contrary to the sixth data protection principle, the Private Information was not processed in accordance with the rights of the Claimants under the DPA (see sections 7, 10, 11, 12 and 14), because the Claimants did not know and the Defendant took no steps to make them aware of the fact that it was processing their data by means of the Safari Workaround. Further, the Defendant made the public statement to the effect that it would not process the Claimants' Private Information in that way.
(d) Contrary to the seventh data protection principle, the Defendant failed to ensure that appropriate technical and organisational measures were taken against unauthorised or unlawful processing of the Claimants' Private Information. Sub-paragraph (a) herein is repeated.
DAMAGES AND ACCOUNT OF PROFITS
(a) The Defendant ought to have been aware of the Safari Workaround from at least a very early stage during the Relevant Period. The Claimants rely in support of this contention upon the fact that as a result of the operation of the Safari Workaround, the Defendant Tracked and Collated information regarding the internet usage of may millions of Safari users which could not have been Tracked and Collated but for its operation. In the circumstances it should have been apparent to the Defendant that the volume of information it was collecting from Safari users was way in excess of that which it would have expected to collect given the existence of the default privacy settings.
(b) Further or alternatively, it is to be inferred from the matters set out at paragraph 20(a) above that the Defendant was at all material times in fact aware of the Safari Workaround or became aware of it during the Relevant Period but chose to do nothing about it until the effect of the Safari Workaround came into the public domain as a result of the investigations on an independent third party.
(c) The failure by the Defendant to answer in pre-action correspondences a number of reasonable questions put forward by the Claimants which, if answered, would clearly have helped clarify the issues in dispute between the parties and further the overriding objective, namely questions as to:
(i) The extent to which and the manner in which the Defendant tracked the Claimants activities via the Safari Workaround;
(ii) What information was obtained by the Defendant about the Claimants during the operation of the Safari Workaround and how it was obtained;
(iii) How long the Safari Workaround was operational;
(iv) Where and how information obtained through the Safari Workaround was shared;
(v) The identities of third parties to whom information, or any part of information, obtained through the Safari Workaround was provided, an if so, on what terms and over what period was it provided;
(vi) The fact of and extent of the Defendant employees' knowledge and/or awareness of and/or authorisation of the Safari Workaround, both prior to implementation and subsequent to implementation but prior to its discovery and revelation to the public at large by a third party.
(vii) General instructions and/or guidance given by the Defendant to its employees and others engaged by it in connection with tracking regarding respecting default privacy settings on browsers or on the contrary seeking to circumvent them.
Note 1 Section 9 of the 1995 Act provides in part that: “(1) The rules in this Part apply for choosing the law (in this Part referred to as ‘the applicable law’) to be used for determining issues relating to tort or (for the purposes of the law of Scotland) delict.
(2) The characterisation for the purposes of private international law of issues arising in a claim as issues relating to tort or delict is a matter for the courts of the forum…
(4) The applicable law shall be used for determining the issues arising in a claim, including in particular the question whether an actionable tort or delict has occurred.” [Back]
Note 1 Section 9 of the 1995 Act provides in part that: “(1) The rules in this Part apply for choosing the law (in this Part referred to as ‘the applicable law’) to be used for determining issues relating to tort or (for the purposes of the law of Scotland) delict. (2) The characterisation for the purposes of private international law of issues arising in a claim as issues relating to tort or delict is a matter for the courts of the forum… (4) The applicable law shall be used for determining the issues arising in a claim, including in particular the question whether an actionable tort or delict has occurred.” [Back]