Appellant
Antony White QC
Edward Craven
(Instructed by Pinsent Masons LLP (London))
Respondent
Hugh Tomlinson QC
Oliver Campbell QC
Victoria Wakefield QC
(Instructed by Milberg London LLP)
1st Intervener (Information Commissioner)
Gerry Facenna QC
Nikolaus Grubeck
(Instructed by Information Commissioner’s Office)
2nd Intervener (Open Rights Group)
(written submissions only)
Robert Palmer QC
Julianne Kerr Morrison
(Instructed by AWO)
3rd Intervener (Association of the British Pharmaceutical Industry and Association of British HealthTech Industries (ABPI and ABHI))
(written submissions only)
Lord Anderson of Ipswich KBE QC
Robin Hopkins
Rupert Paines
(Instructed by CMS Cameron McKenna Nabarro Olswang LLP (London))
4th Intervener (Liberty, Coram Children’s Legal Centre and Inclusion London)
(written submissions only)
Dan Squires QC
Aidan Wills
Tim James-Matthews
(Instructed by Liberty, Coram Children’s Legal Centre and Deighton Pierce Glynn)
5th Intervener (Internet Association)
(written submissions only)
Christopher Knight
(Instructed by Linklaters LLP (London))
6th Intervener (TECHUK Ltd (trading as techUK))
(written submissions only)
Catrin Evans QC
Ian Helme
(Instructed by RPC LLP (London))
- Mr Richard Lloyd - with financial backing from Therium Litigation Funding IC, a commercial litigation funder - has issued a claim against Google LLC, alleging breach of its duties as a data controller under section 4(4) of the Data Protection Act 1998 (“the DPA 1998”). The claim alleges that, for several months in late 2011 and early 2012, Google secretly tracked the internet activity of millions of Apple iPhone users and used the data collected in this way for commercial purposes without the users’ knowledge or consent.
- The factual allegation is not new. In August 2012, Google agreed to pay a civil penalty of US$22.5m to settle charges brought by the United States Federal Trade Commission based upon the allegation. In November 2013, Google agreed to pay US$17m to settle consumer-based actions brought against it in the United States. In England and Wales, three individuals sued Google in June 2013 making the same allegation and claiming compensation under the DPA 1998 and at common law for misuse of private information: see Vidal-Hall v Google Inc (Information Comr intervening) [2015] EWCA Civ 311; [2016] QB 1003. Following a dispute over jurisdiction, their claims were settled before Google had served a defence. What is new about the present action is that Mr Lloyd is not just claiming damages in his own right, as the three claimants did in Vidal-Hall. He claims to represent everyone resident in England and Wales who owned an Apple iPhone at the relevant time and whose data were obtained by Google without their consent, and to be entitled to recover damages on behalf of all these people. It is estimated that they number more than 4m.
- Class actions, in which a single person is permitted to bring a claim and obtain redress on behalf of a class of people who have been affected in a similar way by alleged wrongdoing, have long been possible in the United States and, more recently, in Canada and Australia. Whether legislation to establish a class action regime should be enacted in the UK has been much discussed. In 2009, the Government rejected a recommendation from the Civil Justice Council to introduce a generic class action regime applicable to all types of claim, preferring a “sector based approach”. This was for two reasons:
- Since then, the only sector for which such a regime has so far been enacted is that of competition law. Parliament has not legislated to establish a class action regime in the field of data protection.
- Mr Lloyd has sought to overcome this difficulty by what the Court of Appeal in this case described as “an unusual and innovative use of the representative procedure” in rule 19.6 of the Civil Procedure Rules: see [2019] EWCA Civ 1599; [2020] QB 747, para 7. This is a procedure of very long standing in England and Wales whereby a claim can be brought by (or against) one or more persons as representatives of others who have “the same interest” in the claim. Mr Lloyd accepts that he could not use this procedure to claim compensation on behalf of other iPhone users if the compensation recoverable by each user would have to be individually assessed. But he contends that such individual assessment is unnecessary. He argues that, as a matter of law, compensation can be awarded under the DPA 1998 for “loss of control” of personal data without the need to prove that the claimant suffered any financial loss or mental distress as a result of the breach. Mr Lloyd further argues that a “uniform sum” of damages can properly be awarded in relation to each person whose data protection rights have been infringed without the need to investigate any circumstances particular to their individual case. The amount of damages recoverable per person would be a matter for argument, but a figure of £750 was advanced in a letter of claim. Multiplied by the number of people whom Mr Lloyd claims to represent, this would produce an award of damages of the order of £3 billion.
- Because Google is a Delaware corporation, the claimant needs the court’s permission to serve the claim form on Google outside the jurisdiction. The application for permission has been contested by Google on the grounds that the claim has no real prospect of success as: (1) damages cannot be awarded under the DPA 1998 for “loss of control” of data without proof that it caused financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action. In the High Court Warby J decided both issues in Google’s favour and therefore refused permission to serve the proceedings on Google: see [2018] EWHC 2599 (QB); [2019] 1 WLR 1265. The Court of Appeal reversed that decision, for reasons given in a judgment of the Chancellor, Sir Geoffrey Vos, with which Davis LJ and Dame Victoria Sharp agreed: [2019] EWCA Civ 1599; [2020] QB 747.
- On this further appeal, because of the potential ramifications of the issues raised, as well as hearing the claimant and Google, the court has received written and oral submissions from the Information Commissioner and written submissions from five further interested parties.
- In this judgment I will first summarise the facts alleged and the relevant legal framework for data protection before considering the different methods currently available in English procedural law for claiming collective redress and, in particular, the representative procedure which the claimant is seeking to use. Whether that procedure is capable of being used in this case critically depends, as the claimant accepts, on whether compensation for the alleged breaches of data protection law would need to be individually assessed. I will then consider the claimant’s arguments that individual assessment is unnecessary. For the reasons given in detail below, those arguments cannot in my view withstand scrutiny. In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result. The claimant’s attempt to recover compensation under the Act without proving either matter in any individual case is therefore doomed to fail.
- The relevant events took place between 9 August 2011 and 15 February 2012 and involved the alleged use by Google of what has been called the “Safari workaround” to bypass privacy settings on Apple iPhones.
- Safari is an internet browser developed by Apple and installed on its iPhones. At the relevant time, unlike most other internet browsers, all relevant versions of Safari were set by default to block third party cookies. A “cookie” is a small block of data that is placed on a device when the user visits a website. A “third party cookie” is a cookie placed on the device not by the website visited by the user but by a third party whose content is included on that website. Third party cookies are often used to gather information about internet use, and in particular web pages visited over time, to enable the delivery to the user of advertisements tailored to interests inferred from the user’s browsing history.
- Google had a cookie known as the “DoubleClick Ad cookie” which could operate as a third party cookie. It would be placed on a device if the user visited a website that included DoubleClick Ad content. The DoubleClick Ad cookie enabled Google to identify visits by the device to any website displaying an advertisement from its vast advertising network and to collect considerable amounts of information. It could tell the date and time of any visit to a given website, how long the user spent there, which pages were visited for how long, and what advertisements were viewed for how long. In some cases, by means of the IP address of the browser, the user’s approximate geographical location could be identified.
- Although the default settings for Safari blocked all third party cookies, a blanket application of these settings would have prevented the use of certain popular web functions; so Apple devised some exceptions to them. These exceptions were in place until March 2012, when the system was changed. But in the meantime the exceptions made it possible for Google to devise and implement the Safari workaround. Its effect was to place the DoubleClick Ad cookie on an Apple device, without the user’s knowledge or consent, immediately, whenever the user visited a website that contained DoubleClick Ad content.
- It is alleged that, in this way, Google was able to collect or infer information relating not only to users’ internet surfing habits and location, but also about such diverse factors as their interests and pastimes, race or ethnicity, social class, political or religious beliefs or affiliations, health, sexual interests, age, gender and financial situation.
- Further, it is said that Google aggregated browser generated information from users displaying similar patterns, creating groups with labels such as “football lovers”, or “current affairs enthusiasts”. Google’s DoubleClick service then offered these group labels to subscribing advertisers to choose from when selecting the type of people at whom they wanted to target their advertisements.
- The DPA 1998 was enacted to implement Parliament and Council Directive 95/46/EC of 24 October 1995 “on the protection of individuals with regard to the processing of personal data and on the free movement of such data” (OJ 1995 L281, p 31) (the “Data Protection Directive”). The Data Protection Directive has been superseded by the General Data Protection Regulation, which became law in the UK in May 2018, supplemented by the Data Protection Act 2018 (“the DPA 2018”). The DPA 2018 repealed and replaced the DPA 1998 except in relation to acts or omissions which occurred before it came into force.
- Because the acts and omissions giving rise to the present claim occurred in 2011 and 2012, the claim is governed by the old law contained in the DPA 1998 and the Data Protection Directive. The parties and interveners in their submissions on this appeal nevertheless made frequent references to provisions of the General Data Protection Regulation and the DPA 2018. In principle, the meaning and effect of the DPA 1998 and the Data Protection Directive cannot be affected by legislation which has been enacted subsequently. The later legislation therefore cannot help to resolve the issues raised on this appeal, and I shall leave it to one side.
- Section 4(4) of the DPA 1998 imposed a duty on a data controller to comply with “the data protection principles” set out in Schedule 1 “in relation to all personal data with respect to which he is the data controller”. As defined in section 1(1) of the Act, “personal data” are, in effect, all recorded information which relate to an identifiable individual. An individual who is the subject of personal data is referred to as the “data subject”. A “data controller” is a person who (either alone or with others) “determines the purposes for which and the manner in which any personal data are, or are to be, processed.” The term “processing” is defined very broadly to mean “obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data …”. Section 2 of the Act establishes a category of “sensitive personal data” consisting of information about certain specified matters, which include the racial or ethnic origin, political opinions, religious beliefs, physical or mental health or sexual life of the data subject.
- The first of the eight “data protection principles” set out in Schedule 1 is that:
- As discussed in more detail below, section 13 of the DPA 1998 gives an individual who suffers damage “by reason of any contravention by a data controller of any of the requirements of this Act” a right to compensation from the data controller for that damage.
- The claimant, Mr Lloyd, contends that Google processed personal data of each member of the represented class in breach of the first, second and seventh data protection principles. The represented class consists in essence of everyone in England and Wales who at the relevant time had an Apple iPhone on which Google’s DoubleClick Ad cookie was placed through the Safari workaround. (The precise definition of the class is set out at para 19 of Warby J’s judgment.) Two principal allegations made are that, in breach of the first data protection principle, (i) the data obtained by placing the DoubleClick Ad cookie on each class member’s device were not processed fairly and (ii) none of the conditions in Schedule 2 (or 3) was met.
- Schedule 1, Part II, paragraph 2, provides, in substance, that personal data obtained from the data subject are not to be treated as processed fairly unless the data controller informs the data subject of the purpose for which the data are intended to be processed - a requirement with which it is said that Google failed to comply in this case.
- Schedule 2 contains a list of conditions capable of justifying the processing of data. To comply with the first data protection principle, at least one of these conditions must be satisfied. The first condition in Schedule 2 is that “the data subject has given his consent to the processing”. Other conditions are that the processing is necessary for (amongst other things): the performance of a contract to which the data subject is a party; or compliance with a legal obligation (other than a contractual obligation) of the data controller; or to protect the vital interests of the data subject; or for the exercise of any functions of a public nature exercised in the public interest by any person. The claimant asserts that the members of the represented class whose personal data Google processed had not given their consent to the processing, nor was any of the other conditions capable of justifying the processing met. Hence for this reason too Google was in breach of the first data protection principle.
- There is no doubt that the claimant is entitled to advance a claim against Google on this basis in his own right which has a real prospect of success. The issue is whether he can also do so on behalf of all other iPhone users who fall within the represented class. This depends on the scope of the representative procedure available under the Civil Procedure Rules (“CPR”). Before I come to that procedure, I will mention in order to compare them the two other methods of claiming collective redress currently available in English procedural law.
- A group of people who wish to bring claims which give rise to common or related issues of fact or law can apply to the court for a Group Litigation Order to be made under CPR rule 19.11, providing for the claims to be managed together, usually by a single designated judge. The Group Litigation Order will establish a register of the claims included in the group, which is maintained by the claimants’ lead solicitor. The order may also make provision for how the litigation costs are to be shared among the claimants. How the claims are managed is a matter for the designated judge, but procedures typically used are to select one or more claims to be tried as test claims while the remaining claims are stayed and to decide as preliminary issues common issues of law or fact which are potentially dispositive of the litigation. Unless the court orders otherwise, a judgment given or order made in the litigation is binding on all the claimants included in the group register: see CPR rule 19.12(1)(a).
- Where the individual claims are of sufficiently high value, group actions can be an effective way of enabling what are typically several hundred or thousands of claims to be litigated and managed together, avoiding duplication of the court’s resources and allowing the claimants to benefit from sharing costs and litigation risk and by obtaining a single judgment which is binding in relation to all their claims. However, the group action procedure suffers from the drawback that it is an “opt-in” regime: in other words, claimants must take active steps to join the group. This has an administrative cost, as a solicitor conducting the litigation has to obtain sufficient information from a potential claimant to determine whether he or she is eligible to be added to the group register, give appropriate advice and enter into a retainer with the client. For claims which individually are only worth a few hundred pounds, this process is not economic as the initial costs alone may easily exceed the potential value of the claim.
- Another limitation of opt-in proceedings is that experience has shown that only a relatively small proportion of those eligible to join the group are likely to do so, particularly if the number of people affected is large and the value of each individual claim relatively small. For example, a group action was recently brought against the Morrisons supermarket chain for compensation for breach of the DPA 1998 arising from the disclosure on the internet by a Morrisons’ employee of personal data relating to other employees. Of around 100,000 affected employees, fewer than 10,000 opted to join the group action: see Various Claimants v Wm Morrisons Supermarkets plc [2017] EWHC 3113 (QB); [2019] QB 772 (reversed on the issue of vicarious liability by the Supreme Court: [2020] UKSC 12; [2020] AC 989). During the period of more than 12 years in which collective proceedings under the Competition Act 1998 (discussed below) could be brought only on an opt-in basis just one action was commenced, based on a finding of price fixing in the sale of replica football shirts. Although around 1.2 - 1.5m people were affected, despite widespread publicity only 130 people opted into the proceedings: see The Consumers' Association v JJB Sports Plc [2009] CAT 2, para 5; Civil Justice Council Report “Improving Access to Justice through Collective Actions” (2008), Part 6, para 22; and Grave D, McIntosh M and Rowan G (eds), Class Actions in England and Wales, 1st ed (2018), para 1-068.
- Likely explanations for the low participation rates typically experienced in opt-in regimes include lack of awareness of the opportunity to join the litigation and the natural human tendency to do nothing when faced with a choice which requires positive action - particularly if there is no immediate benefit to be gained and the consequences are uncertain and not easy to understand: see eg Thaler R and Sunstein C, Nudge: The Final Edition (2021), pp 36-38; Samuelson W and Zeckhauser R, “Status Quo Bias in Decision Making” (1988) 1 Journal of Risk and Uncertainty 7-59. As the New Zealand Court of Appeal has recently said of opt-in class actions:
- A further factor which makes group litigation impractical in cases where the loss suffered by each individual is small, even if in aggregate it may amount to a very large sum of money, is the need to prove the quantum of loss in each individual case. Not only are eligible individuals less likely to opt into the proceedings where the potential gain to them is small, but the costs of obtaining evidence from each individual to support their claim is again likely to make group litigation uneconomic in such cases.
- Compared to group actions, the method of collective redress which is now available in the field of competition law offers significant advantages for claimants, particularly where many people have been affected by the defendant’s conduct but the value of each individual claim is small. Section 47B of the Competition Act 1998 (added by the Enterprise Act 2002 and as amended by the Consumer Rights Act 2015) makes provision for bringing “collective proceedings” in the Competition Appeal Tribunal (“CAT”) combining two or more claims to which section 47A applies (essentially, claims in respect of an infringement or alleged infringement of competition law). Such proceedings must be commenced by a person who proposes to be the representative of a specified class of persons, and the proceedings may only be continued if they are certified by the CAT as satisfying criteria set out in section 47B and in the CAT Rules. Two features of this regime may be noted.
- First, unlike group litigation, collective proceedings may be brought on either an “opt-in” or “opt-out” basis. “Opt-out” collective proceedings are proceedings brought on behalf of each class member except any member who opts out by notifying the class representative that their claim should not be included in the proceedings: see section 47B(11). Where “opt-out” collective proceedings are permitted, a person may therefore have a claim brought on their behalf without taking any affirmative step and, potentially, without even knowing of the existence of the proceedings and the fact that he or she is represented in them.
- A second significant feature of the collective proceedings regime is that it enables liability to be established and damages recovered without the need to prove that members of the class have individually suffered loss: it is sufficient to show that loss has been suffered by the class viewed as a whole. This is the effect of section 47C(2) of the Competition Act, which provides:
- As Lord Briggs explained in Merricks v Mastercard [2020] UKSC 51; [2021] Bus LR 25, at para 76, section 47C(2) of the Competition Act “radically alters the established common law compensatory principle by removing the requirement to assess individual loss”. This is so for the purposes both of making and of paying out an aggregate award of damages. How an aggregate award of damages is distributed among the members of the class is subject to the control of the CAT and, as this court held in Merricks v Mastercard, the only requirement is that the distribution should be just: see paras 76-77, 149. No doubt in many cases a just method of distribution will be one which divides up an aggregate award of damages in a way which takes account of individual loss. But particularly where the size of the class is large and the amount of damages awarded small considered on a per capita basis, it may be impractical or disproportionate to adopt such a method. In such cases some other method of distribution, such as an equal division among all the members of the class, may be justified.
- Collective proceedings are a recent phenomenon in English law. By contrast, the representative procedure which the claimant is seeking to use in this case has existed for several hundred years. The current version of the representative rule is CPR rule 19.6, which states:
- This rule has its origins in the procedure of the Court of Chancery before the Judicature Act of 1873. The general rule was that all persons materially interested in the subject-matter of a suit should be made parties to it, either as claimants or defendants, so as to ensure that the rights of all persons interested were settled by a single judgment of the court: see eg Adair v New River Co (1805) 11 Ves Jr 429; 32 ER 1153; Cockburn v Thompson (1809) 16 Ves Jr 321; 33 ER 1005. However, to join all interested persons as parties was not always practically convenient - particularly if they were very numerous. The solution devised was not to abandon the aim of settling the rights of all interested persons in a single proceeding; rather, it was to relax the “complete joinder rule” by allowing one or more claimants or defendants to represent all others who had the same interest as them: see Sorabji J, “The hidden class action in English civil procedure” (2009) 28 CJQ 498. All persons represented in this way, as well as the parties actually before the court, were bound by the court’s decision.
- In the very early cases in the 16th and 17th centuries in which this procedure was adopted, the persons represented were invariably a cohesive communal group, such as parishioners or manorial tenants, whose members had agreed to be represented; and the representatives were often required to show proof of their authority to represent the group. But as the nature of society changed and new, more impersonal institutions such as friendly societies and joint stock companies with multiple investors emerged, this requirement was dropped. The court allowed persons to be represented whether or not they had consented to such representation or even knew of the action, relying on community of interest among the members of the group to ensure that the interests of all were adequately protected: see Yeazell, “From Group Litigation to Class Action, Part I: The Industrialization of Group Litigation” (1980) 27 UCLA Law Review 514.
- Many of the formative cases involved joint stock companies at a time (before the Joint Stock Companies Acts 1844 to 1858) when such companies were not yet recognised as separate legal entities which could sue or be sued. An action had therefore to be brought by (or against) the members themselves. In Chancey v May (1722) Precedents in Chancery 592; 24 ER 265, the treasurer and manager of a brass-works brought an action on behalf of themselves and all other proprietors of the undertaking, of whom there were 800 in total, except for the defendants, who were its former managers, to call the defendants to account for alleged mismanagement and embezzlement. The defendants objected that the claim should not be allowed to proceed as the rest of the proprietors had not been made parties. The court dismissed that objection on the grounds that, first, the action had been brought on behalf of all the other proprietors, so that “all the rest were in effect parties”, and secondly:
- Another notable case involving a joint stock company was Meux v Maltby (1818) 2 Swanston 277; 36 ER 621. In this case the treasurer and directors of the company were sued as representative defendants on a contract made on behalf of all the members of the company to grant a lease. In rejecting an argument that the claim was defective because not all the proprietors were before the court, Plumer MR explained, at pp 281-282:
- In Duke of Bedford v Ellis [1901] AC 1, 8, Lord Macnaghten summarised the practice of the Court of Chancery in this way:
- By the Supreme Court of Judicature Act 1873, all the jurisdiction previously exercised by the Court of Chancery and the courts of common law was transferred to and vested in the new High Court of Justice. Rules of procedure for the High Court were scheduled to the Act, which included as rule 10:
- At first after the enactment of the Judicature Act the courts construed the new rule narrowly. In Temperton v Russell [1893] 1 QB 435, 438, Lindley LJ, who gave the judgment of the Court of Appeal, expressed the view that the rule only applied to “persons who have or claim some beneficial proprietary right” which they are asserting or defending in an action that would have come within the jurisdiction of the old Court of Chancery; hence the rule did not apply to a claim for damages in tort. That view, however, was repudiated by the House of Lords in Duke of Bedford v Ellis [1901] AC 1. Six individuals sued the Duke of Bedford, who owned Covent Garden Market, on behalf of themselves and all other growers of fruit, flowers, vegetables, roots and herbs, to enforce certain preferential rights claimed under the Covent Garden Market Act 1828 to stands in the market. They sought declarations of the rights of the growers and an injunction to restrain the Duke from acting inconsistently with those rights. They also claimed - though only for themselves and not on behalf of other growers - an account and repayment of sums charged to them for selling at the market in excess of what they would have paid if afforded their alleged preferential rights. The Duke applied to have the action stayed either on the ground that the claimants had no beneficial proprietary right, or on the ground that the joinder in one action of parties claiming separate and different rights under the Act, both personally and as representing a class, would embarrass or delay the trial. The House of Lords rejected both grounds (the first unanimously and the second by a majority of 3 to 2) and held that the action could be maintained.
- Lord Macnaghten, who gave the leading speech, expressly disapproved the restrictive view of the representative rule expressed in Temperton v Russell and confirmed that its purpose was simply to apply the practice of the Court of Chancery to all divisions of the High Court. The only change was therefore that the rule was now applicable in actions which, before the Judicature Act, could only have been brought in a court of common law. He said, at pp 10-11, that:
- In Taff Vale Railway Co v Amalgamated Society of Railway Servants [1901] AC 426, 443, Lord Lindley (as he had become) went out of his way to endorse this view and to retract his earlier observations in Temperton v Russell, stating:
- The subsequent decision of the Court of Appeal in Markt & Co Ltd v Knight Steamship Co Ltd [1910] 2 KB 1021 has sometimes been seen as undermining the broad and flexible view of the representative rule adumbrated by the House of Lords in these two cases by imposing significant constraints on its use: see eg Esanda Finance Corpn Ltd v Carnie (1992) 29 NSWLR 382, 395; Mulheron R, The Class Action in Common Law Legal Systems (2004) pp 78-82; Sorabji J, “The hidden class action in English civil procedure” (2009) 28 CJQ 498. I do not think, however, that the decision should be understood in this way. Markt was heard together with another action also brought against the owners of a cargo vessel which was intercepted by a Russian cruiser on a voyage to Japan during the Russo-Japanese war, on suspicion of carrying contraband of war, and sunk. Just before the limitation period expired, two cargo-owners issued writs “on behalf of themselves and others owners of cargo lately laden on board” the vessel, claiming “damages for breach of contract and duty in and about the carriage of goods by sea”. No further particulars of the claims were given.
- All three members of the Court of Appeal agreed that the claims as formulated could not be pursued as representative actions as there was no basis for asserting that all the cargo owners had the same interest in the actions. That was so if only because a claim that the shipowners were in breach of duty in carrying contraband goods plainly could not be maintained on behalf of any cargo-owners who had themselves shipped such goods; furthermore, each cargo owner would need to prove their individual loss. Buckley LJ would have allowed the claimants to amend their writs and continue the proceedings on behalf of themselves and all cargo-owners who were not shippers of contraband goods, claiming a declaration that the defendants were in breach of contract and duty in shipping contraband of war. The other judges, however, did not agree to this course. Vaughan Williams LJ, at p 1032, rejected it on the grounds that the proposed amendment had not been brought before the court in a way which gave a proper opportunity for argument and doubted anyway whether the amendment could be so framed as to disclose a common purpose of the shippers or any class of the shippers. Fletcher Moulton LJ, at p 1042, considered that making a declaration of the type suggested would be contrary to the practice of the courts and that subsequent claims by individual cargo-owners relying on such a declaration to recover damages would constitute new claims which would be time-barred, as the limitation period had now expired.
- The readiness of English courts to give judgments declaring legal rights where it would serve a useful purpose has much increased since 1910. An important step was the decision of the Court of Appeal in Guaranty Trust Co of New York v Hannay & Co [1915] 2 KB 536, which held that a declaration can be granted at the instance of a claimant even if the claimant has no cause of action against the defendant. Two cases decided together by the Court of Appeal in 1921 showed that there is no reason in principle why a claim for a declaration of the kind suggested by Buckley LJ in Markt cannot be brought as a representative action. In David Jones v Cory Bros & Co Ltd (1921) 56 LJ 302; 152 LT Jo 70, five individuals sued on their own behalf and on behalf of all other underground and surface workmen employed at the defendant’s colliery on three specified days in September 1919. They alleged that on those three days the safety lamps in use at the colliery were not in accordance with statutory requirements, were insufficient in number and were not properly examined; and that in consequence the workmen justifiably refused to go to work and lost the wages they would otherwise have earned and were entitled to damages. In Thomas v Great Mountain Collieries Co, which was heard at the same time, two claimants sued the owner of another colliery for loss of wages, alleging breach of statutory duty in not having a weighing machine to weigh coal as near the pit mouth as was reasonably practicable. The workmen were divided into two classes - one comprising all workmen whose wages depended on the amount of coal gotten and the other comprising all other underground and surface workmen. The claimants sued on their own behalf and on behalf of the class they respectively represented.
- In each action the claims were divisible under three heads: (1) claims for declarations upon matters in which the classes represented were alleged to have a common interest; (2) claims for damages by the individual named claimants; and (3) claims for damages by the individual members of the classes represented. Unfortunately, only a bare summary of the judgments is reported. But this records that the Court of Appeal by a majority (Bankes and Atkin LJJ, with Scrutton LJ dissenting) held that the claimants were entitled to sue in a representative capacity as regards claims that came within (1) and (2), but not as regards claims for damages by the individual members of the classes represented.
- In Prudential Assurance Co Ltd v Newman Industries Ltd [1981] Ch 229 the claimant brought a derivative action as a minority shareholder of the first defendant company claiming damages on behalf of the company against two of its directors for breach of duty and conspiracy. At the start of the hearing the claimant applied to amend its statement of claim to add a personal claim against the directors and the company, brought in a representative capacity on behalf of all the shareholders. The relief sought was a declaration that those shareholders who had suffered loss as a result of the alleged conspiracy were entitled to damages. The judge (Vinelott J) allowed the amendment. He distinguished Markt and followed David Jones v Cory Bros in holding that a representative claim for a declaration could be pursued notwithstanding that each member of the class of persons represented had a separate cause of action. Although the personal claim was later held by the Court of Appeal in Prudential Assurance Co Ltd v Newman Industries Ltd (No 2) [1981] Ch 204 at 222 to be misconceived as a matter of substantive law, the Court of Appeal cast no doubt on the use of the representative procedure.
- This decision was important in demonstrating the potential for a bifurcated process whereby issues common to the claims of a class of persons may be decided in a representative action which, if successful, can then form a basis for individual claims for redress. More generally, the Prudential case marked a welcome revival of the spirit of flexibility which characterised the old case law.
- In the cases so far mentioned where claims were held to come within the scope of the representative rule, the relief claimed on behalf of the represented class was limited to a declaration of legal rights. It was accepted or held that the named claimants could only claim damages or other monetary relief in their personal capacity. In Markt Fletcher Moulton LJ expressed the view, at pp 1035 and 1040-1041, that damages are “a personal relief” and that:
- In many cases, of which Markt was one, it is clearly correct that the assessment of damages depends on circumstances personal to each individual claimant. In such cases it is unlikely to be practical or fair to assess damages on a common basis and without each individual claimant’s participation in the proceedings. However, this is not always so, and representative actions for damages have sometimes been allowed. For example, in the case of insurance underwritten by Lloyd’s syndicates, which are not separate legal entities, it is standard practice for a single member of the syndicate (usually the leading underwriter) to be named as a representative claimant or defendant suing, or being sued, for themselves and all the other members. There is no difficulty in awarding damages for or against the representative in such proceedings, as the calculation of any damages which the members of the syndicate are collectively entitled to recover or liable to pay does not depend on how the risk is divided among the members of the syndicate.
- In Pan Atlantic Insurance Co Ltd v Pine Top Insurance Co Ltd [1989] 1 Lloyd’s Rep 568 the claimant companies sued on behalf of themselves and members of a syndicate which had reinsured on a quota share basis a proportion of the risks they had underwritten, claiming under contracts which provided excess of loss reinsurance cover for the claimants and their quota share reinsurers. The Court of Appeal rejected an argument that the claimants were not entitled to sue in a representative capacity. It made no difference that there was a dispute between one of the claimants and some members of the syndicate about the validity of the quota share reinsurance, since as Lloyd LJ said, at p 571: “the question is whether the parties have the same interest as against the defendants; not whether they have the same interest as between themselves”.
- In Irish Shipping Ltd v Commercial Union Assurance Co plc (The “Irish Rowan”) [1991] 2 QB 206 numerous insurers had subscribed in various proportions to a policy of marine insurance. The Court of Appeal accepted that, as a matter of law, each subscription constituted a separate contract of insurance (of which there were said to be 77 in all). Claims for losses allegedly covered by the policy were made by suing two of the insurers as representative defendants. The Court of Appeal rejected an argument that claims for debt or damages could not be included in a representative action, merely because they are made by numerous claimants individually or resisted by numerous defendants individually, and held that the action could continue as a representative action. While the policy terms contained a broadly worded leading underwriter clause, the presence of this clause was not essential to the decision: see Bank of America National Trust and Savings Association v Taylor (The Kyriaki) [1992] 1 Lloyd’s Rep 484, 493-494; National Bank of Greece SA v Outhwaite [2001] CLC 591, para 31.
- In EMI Records Ltd v Riley [1981] 1 WLR 923, and in Independiente Ltd v Music Trading On-Line (HK) Ltd [2003] EWHC 470 (Ch), the claimants sued in a representative capacity on behalf of all members of the British Phonographic Industry Ltd (“BPI”), a trade association for the recorded music industry (and also in the latter case on behalf of Phonographic Performance Ltd), claiming damages for breach of copyright in selling pirated sound recordings. In each case the claims were allowed to proceed as representative actions. Because it was accepted or could safely be assumed that the owner of the copyright in any pirated recording was a member of the represented class, this procedure enabled breach of copyright to be proved and damages to be awarded without the need to prove which particular pirated recordings had been sold in what quantities. Again, what mattered was that the members of the class had a community of interest in suing the defendant.
- In EMI Records it was asserted, and not disputed by the defendants, that the members of the BPI had consented to all sums recovered in actions for breach of copyright being paid to the BPI: see [1981] 1 WLR 923, 925. In Independiente, however, this assertion was disputed and Morritt V-C found that there was no binding agreement that any money recovered should go to the BPI: see [2003] EWHC 470 (Ch), paras 16 and 28. He nevertheless held, at paras 28 and 39, that the claim was properly brought as a representative action, observing that what the claimants did with any damages recovered was a matter for them or between them, the BPI and the class members, and not between them and the defendants.
- Although not cited in these cases, the same point had been made long before in Warrick v Queen’s College Oxford (No 4) (1871) LR 6 Ch App 716, 726, where Lord Hatherley LC gave an example of:
- In giving the Court of Appeal’s judgment in the present case, the Chancellor, at [2020] QB 747, para 73, focused on Emerald Supplies Ltd v British Airways plc [2010] EWCA Civ 1284; [2011] Ch 345 as providing the latest authoritative interpretation of the representative rule. The decision in that case turned, however, on the particular way in which the class of represented persons had been defined. The claimants alleged that the defendant airline was a party to agreements or concerted practices with other airlines to fix prices for air freight charged for importing cut flowers into the UK. They claimed on behalf of all “direct or indirect purchasers of air freight services, the prices for which were inflated by the agreements or concerted practices”, a declaration that damages were recoverable in principle from the defendant by those purchasers. The Court of Appeal upheld a decision to strike out the representative claim on the basis that, in the way the class had been defined, the issue of liability would have to be decided before it could be known whether or not a person was a member of the represented class and therefore bound by the judgment: see paras 62-63 and 65. Such an approach would not be just, not least because, if the claim failed, no purchasers of air freight services apart from the named claimants would be bound by the result.
- The Court of Appeal in Emerald Supplies also considered that a second difficulty with the class definition was that the members of the represented class did not all have the same interest in the claim, as there was a conflict of interest between direct and indirect purchasers of air freight services: see paras 28-29 and 64. If it was shown that prices had been inflated by agreements or concerted practices to which the defendant was a party, it would be in the interests of direct purchasers to seek to prove that they had absorbed the higher prices in order to avoid a potential defence that they had suffered no loss because the higher prices had been passed on to “indirect purchasers” (understood to include sub-purchasers). On the other hand, it would be in the interests of such indirect purchasers to seek to prove that the higher prices had indeed been passed on to them.
- It seems to me that this second difficulty might have been avoided either by altering the class definition to exclude sub-purchasers or by following the approach adopted in Prudential of claiming a declaration that those members of the class who had suffered damage as a result of the alleged price fixing were entitled to damages. However, those possibilities do not appear to have been considered. I think that the judge in Rendlesham Estates plc v Barr Ltd [2014] EWHC 3968 (TCC); [2015] 1 WLR 3663 - a case relied on by Google on this appeal - was therefore wrong to conclude from Emerald Supplies, at para 90, that “if damage is an ingredient of the cause of action a representative claim could not be maintained”. The Court of Appeal in Emerald Supplies did not doubt the correctness of the Prudential decision, where a representative claim was allowed to proceed although damage was an ingredient of the cause of action. As Professor Rachael Mulheron, a leading expert in this field, has persuasively argued, it should likewise have been possible in Emerald Supplies to adopt a bifurcated process in which the questions whether prices had been inflated by agreements or concerted practices and whether passing on was in principle available as a defence were decided in a representative action. If successful, this action could then have formed the basis for further proceedings to prove the fact and amount of damage in individual cases: see Mulheron R, “Emerald Supplies Ltd v British Airways plc; A Century Later, The Ghost of Markt Lives On” [2009] Comp Law 159, 171.
- The highest courts of Australia, Canada and New Zealand have all adopted a broad and flexible approach in interpreting representative rules derived from the English rule.
- In Carnie v Esanda Finance Corpn Ltd (1995) 127 ALR 76 the High Court of Australia held that the fact that the claims arose under separate contracts did not prevent the named claimants and the persons represented from having “the same interest” in proceedings. It was enough to satisfy this requirement that there was a community of interest in the determination of a substantial question of law or fact that arose in the proceedings. Commenting on an argument that the representative rule was an inadequate basis for a “class action”, which required a comprehensive legislative regime, Toohey and Gaudron JJ (with whom Mason CJ, Deane and Dawson JJ generally agreed) said, at p 91:
- In Western Canadian Shopping Centres Inc v Dutton [2001] 2 SCR 534, paras 38-48, the Supreme Court of Canada held that representative actions should be allowed to proceed where the following conditions are met: (1) the class is capable of clear definition; (2) there are issues of fact or law common to all class members; (3) success for one class member means success for all (although not necessarily to the same extent); and (4) the proposed representative adequately represents the interests of the class. If these conditions are met the court must also be satisfied, in the exercise of its discretion, that there are no countervailing considerations that outweigh the benefits of allowing the representative action to proceed. The Supreme Court held that the conditions were met by the claimants in Dutton, who sued as representatives of a group of investors complaining that the defendant had breached fiduciary duties to the investors by mismanaging their funds.
- Giving the judgment of the court, McLachlin CJ, at para 47, distinguished its earlier decision in General Motors of Canada Ltd v Naken [1983] 1 SCR 72, where a representative action had been disallowed. In Naken the action was brought on behalf of purchasers of new Firenza motor vehicles against the manufacturer, complaining that the quality of the vehicles had been misrepresented or was not as warranted in advertisements, other published materials and contracts which were partly oral and partly written. Damages were claimed limited to $1,000 per person. The claims were held to be unsuitable for resolution through a representative action, principally because determining both liability and damages would have required particularised evidence and fact-finding in relation to each individual purchaser.
- McLachlin CJ also commented, at para 46, that over the period since Naken was decided the benefits of class actions had become manifest. She identified, at paras 27-29, three important advantages which such actions offer over a multiplicity of individual suits: (1) avoiding unnecessary duplication in fact-finding and legal analysis; (2) making economical the prosecution of claims that would otherwise be too costly to prosecute individually; and (3) serving efficiency and justice by ensuring that actual and potential wrongdoers who cause widespread but individually minimal harm take into account the full costs of their conduct.
- McLachlin CJ further observed, at para 34, that, while it would clearly be advantageous if there existed a comprehensive legislative framework regulating class actions, in its absence “the courts must fill the void”.
- The Supreme Court of New Zealand has recently considered the use of the representative procedure in Southern Response Earthquake Services Ltd v Ross [2020] NZSC 126. This was a representative action brought on behalf of some 3,000 policyholders who had settled insurance claims for damage to their homes caused by earthquakes in the Canterbury region of New Zealand. The claimants alleged that the policyholders had been misled by the insurers about the cost of remedying the damage, with the result that they had settled their claims on a less favourable basis than otherwise would have been the case. The insurers did not oppose the action being brought on a representative basis, but argued that the class represented should be limited to policyholders who completed a form electing to opt into the proceedings. It was agreed that the proceedings would need to be heard in two stages. The first stage would deal with issues common to all members of the represented class. If the claimants succeeded at that stage in whole or in part, there would need to be a second stage, in which questions of relief were addressed. It was also agreed that, at the second stage, it would be necessary for all of the policyholders represented to take active steps - that is, to opt in - if they wished to establish their individual claims.
- The New Zealand Supreme Court affirmed the decision of the Court of Appeal that the claim should be allowed to continue on an opt out basis. In doing so, the Supreme Court rejected an argument that it should not develop an opt out regime in the absence of a statutory framework and gave guidance on various matters relating to supervision of opt out representative proceedings.
- Although the world has changed out of all recognition since the representative procedure was devised by the Court of Chancery, it has done so in ways which have made the problems to which the procedure provided a solution more common and often vastly bigger in scale. The mass production of goods and mass provision of services have had the result that, when legally culpable conduct occurs, a very large group of people, sometimes numbering in the millions, may be affected. As the present case illustrates, the development of digital technologies has added to the potential for mass harm for which legal redress may be sought. In such cases it is necessary to reconcile, on the one hand, the inconvenience or complete impracticality of litigating multiple individual claims with, on the other hand, the inconvenience or complete impracticality of making every prospective claimant (or defendant) a party to a single claim. The only practical way to “come at justice” is to combine the claims in a single proceeding and allow one or more persons to represent all others who share the same interest in the outcome. When trying all the individual claims is not feasible, the adages of Lord Eldon quoted by Lord Macnaghten in Ellis remain as pertinent as ever: that it is better to go as far as possible towards justice than to deny it altogether and that, if you cannot realistically make everybody interested a party, you should ensure that those who are parties will “fairly and honestly try the right”.
- I agree with the highest courts of Australia, Canada and New Zealand that, while a detailed legislative framework would be preferable, its absence (outside the field of competition law) in this country is no reason to decline to apply, or to interpret restrictively, the representative rule which has long existed (and has had a legislative basis since 1873). I also agree with the view expressed in Carnie that the very simplicity of the representative rule is in some respects a strength, allowing it to be treated as “a flexible tool of convenience in the administration of justice” and “applied to the exigencies of modern life as occasion requires”.
- In its current form in CPR rule 19.6 the rule imposes no limit (either as a minimum or maximum) on the number of people who may be represented. Only one condition must be satisfied before a representative claim may be begun or allowed to continue: that is, that the representative has “the same interest” in the claim as the person(s) represented.
- The phrase “the same interest” is capable of bearing a range of meanings and requires interpretation. In interpreting the phrase, reference has often been made to Lord Macnaghten’s statement in Ellis (quoted at para 38 above) that: “Given a common interest and a common grievance, a representative suit was in order if the relief sought was in its nature beneficial to all whom the plaintiff proposed to represent.” This statement has sometimes been treated as if it were a definition imposing a tripartite test: see eg Smith v Cardiff Corpn [1954] 1 QB 210. Such an approach seems to me misguided. It is clear from the context that Lord Macnaghten was not attempting to define “the same interest”, but to convey how limiting the rule to persons having a beneficial proprietary interest in the claim would be contrary to the old practice in the Court of Chancery. More profoundly, such a reading of Lord Macnaghten’s speech shows precisely the rigidity of approach to the application of the representative rule which he disparaged.
- The phrase “the same interest”, as it is used in the representative rule, needs to be interpreted purposively in light of the overriding objective of the civil procedure rules and the rationale for the representative procedure. The premise for a representative action is that claims are capable of being brought by (or against) a number of people which raise a common issue (or issues): hence the potential and motivation for a judgment which binds them all. The purpose of requiring the representative to have “the same interest” in the claim as the persons represented is to ensure that the representative can be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all the members of the represented class. That plainly is not possible where there is a conflict of interest between class members, in that an argument which would advance the cause of some would prejudice the position of others. Markt and Emerald Supplies are both examples of cases where it was found that the proposed representative action, as formulated, could not be maintained for this reason.
- As Professor Adrian Zuckerman has observed in his valuable book on civil procedure, however, a distinction needs to be drawn between cases where there are conflicting interests between class members and cases where there are merely divergent interests, in that an issue arises or may well arise in relation to the claims of (or against) some class members but not others. So long as advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person: see Zuckerman on Civil Procedure: Principles of Practice, 4th ed (2021), para 13.49. As Professor Zuckerman also points out, concerns which may once have existed about whether the representative party could be relied on to pursue vigorously lines of argument not directly applicable to their individual case are misplaced in the modern context, where the reality is that proceedings brought to seek collective redress are not normally conducted and controlled by the nominated representative, but rather are typically driven and funded by lawyers or commercial litigation funders with the representative party merely acting as a figurehead. In these circumstances, there is no reason why a representative party cannot properly represent the interests of all members of the class, provided there is no true conflict of interest between them.
- This purposive and pragmatic interpretation of the requirement is exemplified by The “Irish Rowan”, where Staughton LJ, at pp 227-228, noted that some of the insurers might wish to resist the claim on a ground that was not available to others. He rightly did not regard that circumstance as showing that all the insurers did not have “the same interest” in the action, or that it was not within the rule, and had “no qualms about a proceeding which allows that ground to be argued on their behalf by others”.
- Even if it were considered inconsistent with the “same interest” requirement, or otherwise inappropriate, for a single person to represent two groups of people in relation to whom different issues arise although there is no conflict of interest between them, any procedural objection could be overcome by bringing two (or more) representative claims, each with a separate representative claimant or defendant, and combining them in the same action.
- Where the same interest requirement is satisfied, the court has a discretion whether to allow a claim to proceed as a representative action. As with any power given to it by the Civil Procedure Rules, the court must in exercising its discretion seek to give effect to the overriding objective of dealing with cases justly and at proportionate cost: see CPR rule 1.2(a). Many of the considerations specifically included in that objective (see CPR rule 1.1(2)) - such as ensuring that the parties are on an equal footing, saving expense, dealing with the case in ways which are proportionate to the amount of money involved, ensuring that the case is dealt with expeditiously and fairly, and allotting to it an appropriate share of the court’s resources while taking into account the need to allot resources to other cases - are likely to militate in favour of allowing a claim, where practicable, to be continued as a representative action rather than leaving members of the class to pursue claims individually.
- Four further features of the representative rule deserve mention.
- First, as the ability to act as a representative under the rule does not depend on the consent of the persons represented but only on community of interest between them, there is ordinarily no need for a member of the represented class to take any positive step, or even to be aware of the existence of the action, in order to be bound by the result. The rule does not confer a right to opt out of the proceedings (though a person could, at least in theory, apply to the court for a direction under rule 19.6(3) that the named claimant (or defendant) may not represent them or under rule 19.6(4) that any judgment given will not be binding on them). It is, however, always open to the judge managing the case to impose a requirement to notify members of the class of the proceedings and establish a simple procedure for opting out of representation, if this is considered desirable. Equally, if there are circumstances which make it appropriate to limit the represented class to persons who have positively opted into the litigation, it is open to the judge to make this a condition of representation. The procedure is entirely flexible in these respects.
- Second, while it is plainly desirable that the class of persons represented should be clearly defined, the adequacy of the definition is a matter which goes to the court’s discretion in deciding whether it is just and convenient to allow the claim to be continued on a representative basis rather than being a precondition for the application of the rule. Emerald Supplies illustrates a general principle that membership of the class should not depend on the outcome of the litigation. Beyond that, whether or to what extent any practical difficulties in identifying the members of the class are material must depend on the nature and object of the proceedings. In Duke of Bedford v Ellis, for example, it did not matter that the number and identities of growers of fruit etc would have been difficult if not impossible to ascertain or that the class was a fluctuating one: given that the aim was to establish whether anyone who was a grower had preferential rights, all that mattered was that there would be no real difficulty in determining whether a particular person who claimed a preferential right to a vacant stand at Covent Garden was a grower or not: see [1901] AC 1 at 11. In some cases, however, for example where the viability of a claim for damages depends on demonstrating the size of the class or who its members are, such practical difficulties might well be significant.
- Third, as persons represented by a representative claimant or defendant will not normally themselves have been joined as parties to the claim, they will not ordinarily be liable to pay any costs incurred by the representative in pursuing (or defending) the claim. That does not prevent the court, if it is in the interests of justice to do so, from making an order requiring a represented person to pay or contribute to costs and giving permission for the order to be enforced against that person pursuant to CPR rule 19.6(4)(b). Alternatively, such an order could be made pursuant to the general jurisdiction of the court to make costs orders against non-parties. It is difficult, however, to envisage circumstances in which it could be just to order a represented person to contribute to costs incurred by a claimant in bringing a representative claim which the represented person did not authorise. On the other hand, a commercial litigation funder who finances unsuccessful proceedings is likely to be ordered to pay the successful party’s costs at least to the extent of the funding: see Davey v Money [2020] EWCA Civ 246; [2020] 1 WLR 1751. That principle is no less applicable where the proceedings financed are a representative action.
- Finally, as already discussed, it is not a bar to a representative claim that each represented person has in law a separate cause of action nor that the relief claimed consists of or includes damages or some other monetary relief. The potential for claiming damages in a representative action is, however, limited by the nature of the remedy of damages at common law. What limits the scope for claiming damages in representative proceedings is the compensatory principle on which damages for a civil wrong are awarded with the object of putting the claimant - as an individual - in the same position, as best money can do it, as if the wrong had not occurred. In the ordinary course, this necessitates an individualised assessment which raises no common issue and cannot fairly or effectively be carried out without the participation in the proceedings of the individuals concerned. A representative action is therefore not a suitable vehicle for such an exercise.
- In cases where damages would require individual assessment, there may nevertheless be advantages in terms of justice and efficiency in adopting a bifurcated process - as was done, for example, in the Prudential case - whereby common issues of law or fact are decided through a representative claim, leaving any issues which require individual determination - whether they relate to liability or the amount of damages - to be dealt with at a subsequent stage of the proceedings. In Prudential [1981] Ch 229, 255, Vinelott J expressed the view (obiter) that time would continue to run for the purpose of limitation until individual claims for damages were brought by the persons represented; see also the dicta of Fletcher Moulton LJ in Markt [1910] 2 KB 1021, 1042, referred to at para 44 above. The court in Prudential did not have cited to it, however, the decision of the Court of Appeal in Moon v Atherton [1972] 2 QB 435. In that case a represented person applied to be substituted for the named claimant after the limitation period had expired when the claimant (and all the other represented persons) no longer wished to continue the action. The Court of Appeal, in allowing the substitution, held that the defendant was not thereby deprived of a limitation defence, as for the purpose of limitation the represented person was already a party to the action, albeit not a “full” party. It might be clearer to say that, although the represented person did not become a “party” until substituted as the claimant, an action was brought within the meaning of the statute of limitation by that person when the representative claim was initiated. Such an analysis has been adopted in Australia, including by the New South Wales Court of Appeal in Fostif Pty Ltd v Campbells Cash & Carry Pty Ltd [2005] NSWCA 83; (2005) 63 NSWLR 203, and by the New Zealand Supreme Court in Credit Suisse Private Equity v Houghton [2014] NZSC 37.
- There is no reason why damages or other monetary remedies cannot be claimed in a representative action if the entitlement can be calculated on a basis that is common to all the members of the class. Counsel for the claimant, Hugh Tomlinson QC, gave the example of a claim alleging that every member of the class was wrongly charged a fixed fee; another example might be a claim alleging that all the class members acquired the same product with the same defect which reduced its value by the same amount. In such cases the defendant’s monetary liability could be determined as a common issue and no individualised assessment would be needed. The same is true where loss suffered by the class as a whole can be calculated without reference to the losses suffered by individual class members - as in the cases mentioned at para 53 above. Such an assessment of loss on a global basis is sometimes described as a “top down” approach, in contrast to a “bottom up” approach of assessing a sum which each member of the class is individually entitled to recover.
- The recovery of money in a representative action on either basis may give rise to problems of distribution to the members of the class, about which the representative rule is silent. Although in Independiente Morritt V-C was untroubled by such problems, questions of considerable difficulty would arise if in the present case the claimant was awarded damages in a representative capacity with regard to how such damages should be distributed, including whether there would be any legal basis for paying part of the damages to the litigation funders without the consent of each individual entitled to them: see Mulheron R, “Creating and Distributing Common Funds under the English Representative Rule” (2021) King’s Law Journal 1-33. Google has not relied on such difficulties as a reason for disallowing a representative action, however, and as these matters were only touched on in argument, I will say no more about them.
- In the present case I could see no legitimate objection to a representative claim brought to establish whether Google was in breach of the DPA 1998 and, if so, seeking a declaration that any member of the represented class who has suffered damage by reason of the breach is entitled to be paid compensation. The individual claims that could theoretically have been brought by each iPhone user who was affected by the Safari workaround clearly raise common issues; and it is not suggested that there is any conflict of interest among the members of the represented class. For the purpose of CPR rule 19.6(1), all would therefore have the same interest in such a claim as the representative claimant. There is no suggestion that Mr Lloyd is an unsuitable person to act in that capacity. Although Google has argued that there would be practical difficulties in identifying whether an individual falls within the class definition, even on Google’s evidence it is evident that the number of people affected by the Safari workaround was extremely large and it is unclear at this stage of the litigation how serious the difficulties of proof would actually be. Moreover, even if only a few individuals were ultimately able to obtain compensation on the basis of a declaratory judgment, I cannot see why that should provide a reason for refusing to allow a representative claim to proceed for the purpose of establishing liability.
- The claimant has not proposed such a bifurcated process, however. That is doubtless because success in the first, representative stage of such a process would not itself generate any financial return for the litigation funders or the persons represented. Funding the proceedings could therefore only be economic if pursuing separate damages claims on behalf of those individuals who opted into the second stage of the process would be economic. For the reasons discussed at paras 25-28 above and emphasised in argument by counsel for the claimant, it clearly would not. In practice, therefore, as both courts below accepted, a representative action for damages is the only way in which the claims can be pursued.
- In formulating the claim made in this action, the claimant has not adopted the “top down” approach of claiming compensation for damage suffered by the class as a whole without reference to the entitlements of individual class members. The claim advanced is for damages calculated from the “bottom up”. The way in which the claimant seeks to obviate the need for individualised assessment is by claiming damages for each class member on what is described as a “uniform per capita basis”.
- The difficulty facing this approach is that the effect of the Safari workaround was obviously not uniform across the represented class. No challenge is or could reasonably be made to the judge’s findings, at [2018] EWHC 2599 (QB); [2019] 1 WLR 1265, para 91, that:
- The claimant seeks to overcome this difficulty in one or other of two ways. Both rely on the proposition that an individual is entitled to compensation for any (non-trivial) contravention of the DPA 1998 without the need to prove that the individual suffered any financial loss or distress. On that footing it is argued, first of all, that general damages can be awarded on a uniform per capita basis to each member of the represented class without the need to prove any facts particular to that individual. The draft particulars of claim plead that the uniform sum awarded should reflect “the serious nature of the breach, in particular (but non-exhaustively):
- The alternative case pleaded is that each member of the class is entitled to damages assessed as an amount which they could reasonably have charged for releasing Google from the duties which it breached. Again, it is contended that such damages should be assessed on a uniform per capita basis, “reflecting the generalised standard terms (rather than individuated basis) on which [Google] does business”.
- The claim for compensation made in the present case is founded (exclusively) on section 13 of the DPA 1998. This provides:
- Section 13 was intended to implement article 23 of the Data Protection Directive. This stated:
- Two initial points can be made about the wording and structure of section 13. First, to recover compensation under this provision it is not enough to prove a breach by a data controller of its statutory duty under section 4(4) of the Act: an individual is only entitled to compensation under section 13 where “damage” - or in some circumstances “distress” - is suffered as a consequence of such a breach of duty. Second, it is plain from subsection (2) that the term “damage” as it is used in section 13 does not include “distress”. The term “material damage” is sometimes used to describe any financial loss or physical or psychological injury, but excluding distress (or other negative emotions not amounting to a recognised psychiatric illness): see eg Watkins v Secretary of State for the Home Department [2006] UKHL 17; [2006] 2 AC 395, para 7. Adopting this terminology, on a straightforward interpretation the term “damage” in section 13 refers only to material damage and compensation can only be recovered for distress if either of the two conditions set out in subsection (2) is met.
- The effect of section 13 was considered by the Court of Appeal in Vidal-Hall v Google Inc [2016] QB 1003 on facts which, in terms of the generic allegations made, were identical to those on which the present claim is based. The three claimants sought damages arising out of the Safari workaround on two alternative bases: (1) at common law for misuse of private information; and (2) under section 13 of the DPA 1998. As in the present case, permission to serve the proceedings outside the jurisdiction was opposed by Google. The main issues raised were: (1) whether misuse of private information is a tort for the purpose of the rules providing for service out of the jurisdiction; and (2) whether compensation can be recovered for distress under section 13 of the DPA 1998 in the absence of financial loss. The judge decided both issues in the claimants’ favour and the Court of Appeal affirmed that decision, for reasons given in a judgment written by Lord Dyson MR and Sharp LJ, with which Macfarlane LJ agreed.
- On the second issue Google submitted that, as discussed above, the term “damage” in section 13 must mean material damage, which for practical purposes limits its scope to financial loss. Hence section 13(2) has the effect that an individual may only recover compensation for distress suffered by reason of a contravention by a data controller of a requirement of the Act if either (a) the contravention also causes the individual to suffer financial loss or (b) the contravention relates to the processing of personal data for “special purposes” - which are defined as journalistic, artistic or literary purposes (see section 3). It was not alleged that either of those conditions was satisfied in the Vidal-Hall case.
- The Court of Appeal accepted that section 13(2) does indeed have this meaning but held that this makes it incompatible with article 23 of the Data Protection Directive, which section 13 of the DPA 1998 was meant to implement. This is because the word “damage” in article 23 is to be interpreted as including distress, which is the primary form of damage likely to be caused by an invasion of data privacy; and article 23 does not permit national laws to restrict the right to receive compensation for “damage” where it takes the form of distress. The Court of Appeal considered whether it is possible to interpret section 13 in a way which achieves the result sought by the Directive, but concluded that the words of section 13 are not capable of being interpreted in such a way and that the limits set by Parliament to the right to compensation for breaches of the DPA 1998 are a fundamental feature of the UK legislative scheme. In the words of Lord Dyson MR and Sharp LJ in their joint judgment, at para 93, if the court were to disapply the limits on the right to compensation for distress set out in section 13(2), “the court would, in effect, be legislating against the clearly expressed intention of Parliament on an issue that was central to the scheme as a whole”.
- The Court of Appeal nevertheless held that section 13(2) should be disapplied on the ground that it conflicts with articles 7 and 8 of the Charter of Fundamental Rights of the European Union (“the EU Charter”). Article 7 of the EU Charter is in materially similar terms to article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) and provides that “[e]veryone has the right to respect for his or her private and family life, home and communications”. Article 8(1) provides that “[e]veryone has the right to the protection of personal data concerning him or her”. In addition, article 47 requires that “[e]veryone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal …”. The Court of Appeal decided that, in order to provide an effective remedy for the rights guaranteed by articles 7 and 8 of the EU Charter, it was necessary that national law should give effect to the obligation under article 23 of the Data Protection Directive to provide a right to receive compensation from the data controller for any damage, including distress, suffered as a result of an unlawful processing operation. That result could and should be achieved by disapplying section 13(2) of the DPA 1998, thus enabling section 13(1) to be interpreted compatibly with article 23: see [2016] QB 1003, para 105.
- The Court of Appeal in Vidal-Hall also held that the claims for damages for misuse of private information made by the claimants in that case were properly classified as claims in tort for the purpose of service out of the jurisdiction and had a real prospect of success. As described at paras 18-25 of the judgment, the tort of misuse of private information evolved out of the equitable action for breach of confidence, influenced by the protection of the right to respect for private life guaranteed by article 8 of the Convention. The critical step in its emergence as a distinct basis for a claim was the identification of privacy of information as worthy of protection in its own right, irrespective of whether the information was imparted in circumstances which give rise to a duty of confidence: see Campbell v MGN Ltd [2004] UKHL 22; [2004] 2 AC 457. As Lord Hoffmann put it in Campbell, at para 50:
- The complaint in Campbell was about the publication of private information. Lord Nicholls of Birkenhead described the “essence of the tort”, at para 14, as “misuse of private information”. He also noted, however, at para 15, that an individual’s privacy can be invaded in ways not involving publication of information, and subsequent cases have held that intrusion on privacy, without any misuse of information, is actionable: see PJS v News Group Newspapers Ltd [2016] UKSC 26; [2016] AC 1081, paras 58-60. It is misuse of information, however, which is primarily relevant in this case, and I shall generally - as counsel did in argument - use the label for the tort of “misuse of private information”.
- To establish liability for misuse of private information (or other wrongful invasion of privacy), it is necessary to show that there was a reasonable expectation of privacy in the relevant matter. As the Court of Appeal (Sir Anthony Clarke MR, Laws and Thomas LJJ) explained in upholding a claim to restrain the publication of photographs taken in a public place of the child of the well-known author, JK Rowling, in Murray v Express Newspapers plc [2008] EWCA Civ 446; [2009] Ch 481, para 36:
- The measure of damages for wrongful invasion of privacy was considered in depth in Gulati v MGN Ltd [2015] EWHC 1482 (Ch); [2016] FSR 12 and [2015] EWCA Civ 1291; [2017] QB 149 by Mann J and by the Court of Appeal. The eight test claimants in that case were individuals in the public eye whose mobile phones were hacked by newspapers, leading in some instances to the publication of articles containing information obtained by this means. The newspapers admitted liability for breach of privacy but disputed the amount of damages. Their main argument of principle was that (in the absence of material damage) all that could be compensated for was distress caused by their unlawful activities: see [2016] FSR 12, para 108. The judge rejected that argument. He said, at para 111, that he did not see why “distress (or some similar emotion), which would admittedly be a likely consequence of an invasion of privacy, should be the only touchstone for damages”. In his view:
- The judge referred to cases in which damages have been awarded to very young children (only ten months or one year old) for misuse of private information by publishing photographs of them even though, because of their age, they could not have suffered any distress: see AAA v Associated Newspapers Ltd [2012] EWHC 2103 (QB); [2013] EMLR 2; and Weller v Associated Newspapers Ltd [2014] EWHC 1163 (QB); [2014] EMLR 24. He concluded, at para 144:
- The Court of Appeal affirmed this decision: [2015] EWCA Civ 1291; [2017] QB 149. Arden LJ (with whom Rafferty and Kitchin LJJ agreed) held, at para 45, that:
- The Court of Appeal in Gulati rejected a submission, also rejected by the judge, that granting damages for the fact of intrusion into a person’s privacy independently of any distress caused is inconsistent with the holding of this court in R (WL (Congo)) v Secretary of State for the Home Department [2011] UKSC 12; [2012] 1 AC 245, paras 97-100, that vindicatory damages are not available as a remedy for violation of a private right. As Arden LJ pointed out at para 48, no question arose of awarding vindicatory damages of the kind referred to in WL (Congo), which have been awarded in some constitutional cases appealed to the Privy Council “to reflect the sense of public outrage, emphasise the importance of the constitutional right and the gravity of the breach, and deter further breaches”: see WL (Congo), para 98; Attorney General of Trinidad and Tobago v Ramanoop [2005] UKPC 15; [2006] 1 AC 328, para 19. Rather, the purpose of the relevant part of the awards made in Gulati was “to compensate for the loss or diminution of a right to control formerly private information”.
- Mann J’s reference to “loss of privacy or autonomy” and the Court of Appeal’s explanation that the claimants could be compensated for misuse of their private information itself because they were deprived of “their right to control [its] use” convey the point that English common law now recognises as a fundamental aspect of personal autonomy a person’s freedom to choose and right to control whether and when others have access to his or her private affairs: see on this point the helpful discussion by NA Moreham, “Compensating for Loss of Dignity and Autonomy” in Varuhas J and Moreham N (eds), Remedies for Breach of Privacy (2018) ch 5.
- On the basis of the decisions of the Court of Appeal in Vidal-Hall and Gulati, neither of which is challenged by either party on this appeal, it would be open to Mr Lloyd to claim, at least in his own right: (1) damages under section 13(1) of the DPA 1998 for any distress suffered by reason of any contravention by Google of any of the requirements of the Act; and/or (2) damages for the misuse of private information without the need to show that it caused any material damage or distress.
- Neither of these claims, however, is made in this case. The reasons why no claim is made in tort for misuse of private information have not been explained; but the view may have been taken that, to establish a reasonable expectation of privacy, it would be necessary to adduce evidence of facts particular to each individual claimant. In Vidal-Hall, the claimants produced confidential schedules about their internet use, showing that the information tracked and collected by Google in their cases was, in the Court of Appeal’s words at [2016] QB 1003, para 137, “often of an extremely private nature”. As discussed earlier, the need to obtain evidence in relation to individual members of the represented class would be incompatible with the representative claim which Mr Lloyd is seeking to bring.
- Similarly, to recover damages for distress under section 13(1) of the DPA 1998 would require evidence of such distress from each individual for whom such a claim was made. Again, this would be incompatible with claiming damages on a representative basis.
- Instead of making either of these potential claims, the claimant seeks to break new legal ground by arguing that the principles identified in Gulati as applicable to the assessment of damages for misuse of private information at common law also apply to the assessment of compensation under section 13(1) of the DPA 1998. The case advanced, which is also supported by the Information Commissioner, is that the word “damage” in section 13(1) not only extends beyond material damage to include distress, as decided in Vidal-Hall, but also includes “loss of control” over personal data.
- There is potential for confusion in the use of this description. “Loss of control” is not an expression used in the DPA 1998 and, as the third interveners (the Association of the British Pharmaceutical Industry and Association of British HealthTech Industries) pointed out in their helpful written submissions, none of the requirements of the Act is predicated on “control” over personal data by the data subject. Under the legislative scheme the relevant control is that of the data controller: the entity which “determines the purposes for which and the manner in which any personal data are, or are to be, processed.” The nearest analogue to control as regards the data subject is his or her “consent to the processing”, being the first condition in Schedule 2 (see para 22 above). Such consent, however, is neither necessary nor sufficient to render the processing of personal data compliant with the Act.
- It was made clear in submissions, however, that, in describing the basis for the compensation claimed as “loss of control” of personal data, the claimant is not seeking to single out a particular category of breaches of the DPA 1998 by a data controller as breaches in respect of which the data subject is entitled to compensation without proof of material damage or distress. The claimant’s case, which was accepted by the Court of Appeal, is that an individual is entitled to recover compensation under section 13 of the DPA 1998 without proof of material damage or distress whenever a data controller fails to comply with any of the requirements of the Act in relation to any personal data of which that individual is the subject, provided only that the contravention is not trivial or de minimis. Any such contravention, on the claimant’s case, ipso facto involves “loss of control” of data for which compensation is payable. Only where the individual claiming compensation is not the data subject is it necessary on the claimant’s case to show that the individual has suffered material damage or distress.
- The claimant’s core argument for this interpretation is that, as a matter of principle, the same approach to the damage for which compensation can be awarded should apply under the data protection legislation as where the claim is brought in tort for misuse of private information because the two claims, although not coterminous, have a common source. Both seek to protect the same fundamental right to privacy guaranteed by article 8 of the Convention. This objective is expressly referred to in recital (10) of the Data Protection Directive, which states:
- The claimant argues that, given that the tort of misuse of private information and the data protection legislation are both rooted in the same fundamental right to privacy, it would be wrong in principle to adopt a different approach to the nature of the damage which can be compensated under the two regimes. The conclusion should therefore be drawn that, in each case, damages can be recovered for interference with the claimant’s right, without the need to prove that the interference resulted in any material damage or distress.
- I cannot accept this argument for two reasons. First, even if the suggested analogy between the privacy tort and the data protection regime were persuasive, section 13(1) of the DPA 1998 cannot, in my opinion, properly be interpreted as having the meaning for which the claimant contends. Second, the logic of the argument by analogy is in any event flawed.
- I do not accept a submission made by counsel for Google that the interpretation of section 13 of the DPA 1998 should be approached on the basis of a general rule that breaches of statutory duty are not actionable without proof of material damage. The question in Cullen v Chief Constable of the Royal Ulster Constabulary [2003] UKHL 39; [2003] 1 WLR 1763, relied on to support this submission, was whether a statute which did not expressly confer a right to compensation on a person affected by a breach of statutory duty nevertheless conferred such a right impliedly. That is not the question raised in this case, where there is an express entitlement to compensation provided by section 13 of the DPA 1998. The only question in this case is what the words of the relevant statutory provision mean.
- Those words, however, cannot reasonably be interpreted as giving an individual a right to compensation without proof of material damage or distress whenever a data controller commits a non-trivial breach of any requirement of the Act in relation to any personal data of which that individual is the subject. In the first place, as discussed above, the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention. This wording is inconsistent with an entitlement to compensation based solely on proof of the contravention. To say, as the claimant does in its written case, that what is “damaged” is the data subject’s right to have their data processed in accordance with the requirements of the Act does not meet this point, as it amounts to an acknowledgement that on the claimant’s case the damage and the contravention are one and the same.
- Nor is the claimant’s case assisted by section 14 of the DPA 1998, on which reliance is placed. Section 14(1) gives the court power, on the application of a data subject, to order a data controller to rectify, block, erase or destroy personal data if satisfied that the data are inaccurate. Section 14(4) states:
- Counsel for the claimant submitted that, if Google’s case on what is meant by “damage” is correct, a data subject who does not suffer material damage or distress as a result of a breach of duty by a data controller cannot claim rectification, blocking, erasure or destruction of data, unless those data are inaccurate, however egregious the breach. This is true, but I can see nothing unreasonable in such a result. Indeed, section 14 seems to me positively to confirm that “damage” means something distinct from a contravention of the Act itself. If a contravention by a data controller of the Act could by itself constitute “damage”, section 14(4)(a) would be otiose and there would be no material distinction in the remedies available in cases where the data are inaccurate and in cases where the data are accurate. The manifest intention behind section 14 is to limit the remedies of rectification, blocking, erasure or destruction of accurate data to cases where the contravention of the Act has caused the data subject some harm distinct from the contravention itself, whereas no such limitation is imposed where the contravention involves holding inaccurate personal data.
- The second reason why the claimant’s interpretation is impossible to reconcile with the language of section 13 is that, as the Court of Appeal recognised in Vidal-Hall, it is plain from the words enacted by Parliament the term “damage” was intended to be limited to material damage and not to extend to “distress”. The only basis on which the Court of Appeal in Vidal-Hall was able to interpret the term “damage” as encompassing distress was by disapplying section 13(2) as being incompatible with EU law. By the same token, if the term “damage” in section 13 is to be interpreted as having an even wider meaning and as encompassing an infringement of a data subject’s rights under the Act which causes no material damage nor even distress, that could only be because this result is required by EU law. On a purely domestic interpretation of the DPA 1998, such a reading is untenable.
- It is not suggested in the present case that section 13(1) should be disapplied: the claimant’s case is founded on it. No argument of the kind which succeeded in Vidal-Hall that words of the statute must be disapplied because they conflict with EU law is therefore available (or is advanced by the claimant). The question is whether the term “damage” in section 13(1) can and should be interpreted as having the meaning for which the claimant contends because such an interpretation is required in order to make the domestic legislation compatible with EU law. There are two aspects of this question: (i) what does the term “damage” mean in article 23 of the Data Protection Directive, which section 13 of the DPA 1998 was intended to implement; and (ii) if “damage” in article 23 includes contraventions of the national provisions adopted pursuant to the Directive which cause no material damage or distress, is it possible to interpret the term “damage” in section 13(1) of the DPA 1998 as having the same meaning?
- To take the second point first, it does not seem to me possible to interpret the term “damage” in section 13(1) of the DPA 1998 as having the meaning for which the claimant contends, even if such an interpretation were necessary to make the Act compatible with the Data Protection Directive. In Vidal-Hall the Court of Appeal held, rightly in my opinion, that section 13 of the DPA 1998 could not be construed as providing a general right to compensation for distress suffered by reason of a contravention of the Act “without contradicting the clearly expressed intention of Parliament on an issue that was central to the scheme” of the legislation (see para 95 above). The same is equally, if not all the more, true of the contention that section 13 of the DPA 1998 can be interpreted as providing a right to compensation for contraventions of the Act which have not caused any distress, let alone material damage. The distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller which causes such damage is a fundamental feature of the remedial scheme provided by the Act which, as indicated above, permeates section 14 as well as section 13. If it were found that this feature makes the DPA 1998 incompatible with the Data Protection Directive, such incompatibility could, in my view, only be removed by amending the legislation. That could only be done by Parliament.
- No such incompatibility arises, however, as there is no reason to interpret the term “damage” in article 23 of the Data Protection Directive as extending beyond material damage and distress. The wording of article 23 draws exactly the same distinction as section 13(1) of the DPA 1998 between “damage” and an unlawful act of which the damage is “a result”. Again, this wording identifies the “damage” for which a person is entitled to receive compensation as distinct from the wrongful act which causes the damage. This is inconsistent with giving a right to compensation for the unlawful act itself on the basis that the act constitutes an interference with the claimant’s data protection rights. Nor has any authority been cited which suggests that the term “damage”, either generally in EU law or in the specific context of article 23 of the Data Protection Directive, is to be interpreted as including an infringement of a legal right which causes no material damage or distress.
- If there were evidence that at least some national laws on the processing of personal data which pre-dated the Data Protection Directive and are referred to in recital (10), quoted at para 111 above, provided a right to compensation for unlawful processing without proof of material damage or distress, that might arguably support an inference that the Directive was intended to ensure a similarly high level of protection across all member states. But it has not been asserted that any national laws did so. The Data Protection Act 1984, which was the applicable UK legislation when the Data Protection Directive was adopted, in sections 22 and 23 gave the data subject an entitlement to compensation in certain circumstances for damage or distress suffered by reason of the inaccuracy of data or the loss or unauthorised destruction or disclosure of data or unauthorised obtaining of access to data. By clear implication, UK national law gave no right to compensation for unlawful processing of personal data which did not result in material damage or distress. There is no evidence that the national law of any other member state at that time did so either.
- EU law therefore does not provide a basis for giving a wider meaning to the term “damage” in section 13 of the DPA 1998 than was given to that term by the Court of Appeal in Vidal-Hall.
- I also reject the claimant’s argument that the decision in Gulati affords any assistance to its case on this issue. Leaving aside the fact that Gulati was decided many years after the Data Protection Directive was adopted, there is no reason on the face of it why the basis on which damages are awarded for an English domestic tort should be regarded as relevant to the proper interpretation of the term “damage” in a statutory provision intended to implement a European directive. The claimant relies on the fact that both derive from the right to respect for private life protected by article 8 of the Convention (and incorporated in article 7 of the EU Charter when it was created in 2007). It does not follow, however, from the fact that two different legal regimes aim, at a general level, to provide protection for the same fundamental value that they must do so in the same way or to the same extent or by affording identical remedies. There are significant differences between the nature and scope of the common law privacy tort and the data protection legislation, to which I will draw attention in a moment. But the first point to note is that the decision in Gulati that damages can be awarded for misuse of private information itself was not compelled by article 8 of the Convention; nor did article 8 require the adoption of the particular legal framework governing the protection of personal data contained in the Data Protection Directive and the DPA 1998.
- The Convention imposes obligations on the states which are parties to it, but not on private individuals and bodies. In some cases the obligations on state parties extend beyond negative obligations not to act in ways which violate the Convention rights and include certain positive obligations on the state to ensure effective protection of those rights. That is so as regards the right to respect for private life guaranteed by article 8. The European Court of Human Rights has held that in certain circumstances the state’s positive obligations under article 8 are not adequately fulfilled unless the state secures respect for private life in the relations between individuals by setting up a legislative framework taking into consideration the various interests to be protected in a particular context. However, the court has emphasised that there are different ways of ensuring respect for private life and that “the choice of the means calculated to secure compliance with article 8 of the Convention in the sphere of the relations of individuals between themselves is in principle a matter that falls within the contracting states’ margin of appreciation”: see the judgment of the Grand Chamber in Bărbulescu v Romania [2017] ECHR 754; [2017] IRLR 1032, para 113.
- While the House of Lords in Campbell drew inspiration from article 8, it did not suggest that the Convention or the Human Rights Act 1998 required the recognition of a civil claim for damages for misuse of private information in English domestic law, let alone that damages should be recoverable in such claim where no material damage or distress has been caused. In Gulati the Court of Appeal rejected an argument that the approach to awarding damages for misuse of private information ought to follow the approach of the European Court of Human Rights in making awards of just satisfaction under article 41 of the Convention. As Arden LJ observed, at para 89, in awarding damages for misuse of private information, the court is not proceeding under section 8 of the Human Rights Act 1998 or article 41 of the Convention, and the conditions of the tort are governed by English domestic law and not the Convention.
- For those reasons, I do not regard as relevant the decision of the European Court of Human Rights in Halford v United Kingdom (1997) 24 EHRR 523, relied on by counsel for the claimant. In Halford a senior police officer whose telephone calls had been intercepted by her employer in violation of article 8 was awarded £10,000 as just satisfaction. As Lord Sales pointed out in argument, on one reading of the judgment, which is far from clear, although it could not be shown that the interception of the applicant’s phone calls, as opposed to other conflicts with her employer, had caused stress for which she had required medical treatment, it was reasonably assumed that this invasion of privacy had caused her mental harm. Even if the award of just satisfaction is understood to have been for the invasion of the right to privacy itself rather than for any distress felt by the applicant, however, it does not follow that, in an action between private parties under national law for a similar invasion of privacy, the Convention requires the court to be able to award damages simply for the loss of privacy itself.
- Whilst it may be said that pursuant to the general principles of EU law embodied in articles 7 and 8 of the EU Charter the EU had a positive obligation to establish a legislative framework providing for protection of personal data, there was clearly a wide margin of choice as to the particular regime adopted; and the same applies to the positive obligation imposed directly on the UK by the Convention. It could not seriously be argued that the content of those positive obligations included a requirement to establish a right to receive compensation for any (non-trivial) breach of any requirement (in relation to any personal data of which the claimant is the subject) of whatever legislation the EU and UK chose to enact in this area without the need to prove that the claimant suffered any material damage or distress as a result of the breach.
- Accordingly, the fact that the common law privacy tort and the data protection legislation have a common source in article 8 of the Convention does not justify reading across the principles governing the award of damages from one regime to the other.
- There are further reasons why no such analogy can properly be drawn stemming from the differences between the two regimes. It is plain that the detailed scheme for regulating the processing of personal data established by the Data Protection Directive extended beyond the scope of article 8 and much more widely than the English domestic tort of misusing private information. An important difference is that the Directive (and the UK national legislation implementing it) applied to all “personal data” with no requirement that the data are of a confidential or private nature or that there is a reasonable expectation of privacy protection. By contrast, information is protected against misuse by the domestic tort only where there is a reasonable expectation of privacy. The reasonable expectation of privacy of the communications illicitly intercepted by the defendants in the phone hacking litigation was an essential element of the decision in Gulati that the claimants were entitled to compensation for the commission of the wrong itself. It cannot properly be inferred that the same entitlement should arise where a reasonable expectation of privacy is not a necessary element of the claim.
- This point goes to the heart of the approach adopted by the claimant in the present case. Stripped to its essentials, what the claimant is seeking to do is to claim for each member of the represented class a form of damages the rationale for which depends on there being a violation of privacy, while avoiding the need to show a violation of privacy in the case of any individual member of the class. This is a flawed endeavour.
- Another significant difference between the privacy tort and the data protection legislation is that a claimant is entitled to compensation for a contravention of the legislation only where the data controller has failed to exercise reasonable care. Some contraventions are inherently fault based. For example, the seventh data protection principle with which a data controller has a duty to comply pursuant to section 4(4) of the DPA 1998 (and article 17 of the Data Protection Directive) states:
- The privacy tort, like other torts for which damages may be awarded without proof of material damage or distress, is a tort involving strict liability for deliberate acts, not a tort based on a want of care. No inference can be drawn from the fact that compensation can be awarded for commission of the wrong itself where private information is misused that the same should be true where the wrong may consist only in a failure to take appropriate protective measures and where the right to compensation is expressly excluded if the defendant took reasonable care.
- Indeed, this feature of the data protection legislation seems to me to be a yet further reason to conclude that the “damage” for which an individual is entitled to compensation for a breach of any of its requirements does not include the commission of the wrong itself. It would be anomalous if failure to take reasonable care to protect personal data gave rise to a right to compensation without proof that the claimant suffered any material damage or distress when failure to take care to prevent personal injury or damage to tangible moveable property does not.
- Accordingly, I do not accept that the decision in Gulati is applicable by analogy to the DPA 1998. To the contrary, there are significant differences between the privacy tort and the data protection legislation which make such an analogy positively inappropriate.
- I add for completeness that the EU law principles of equivalence and effectiveness, on which the Court of Appeal placed some reliance, do not assist the claimant’s case. The principle of equivalence requires that procedural rules governing claims for breaches of EU law rights must not be less favourable than procedural rules governing equivalent domestic actions. As explained by Lord Briggs, giving the judgment of this court, in Totel Ltd v Revenue and Customs Comrs [2018] UKSC 44; [2018] 1 WLR 4053, para 7, the principle is “essentially comparative”. Thus:
- The principle of effectiveness invalidates a national procedure if it renders the enforcement of a right conferred by EU law either virtually impossible or excessively difficult: see again Totel Ltd at para 7. However, the absence of a right to compensation for a breach of data protection rights which causes no material damage or distress, even if regarded as a procedural limitation, does not render the enforcement of such rights virtually impossible or excessively difficult. The right to an effective remedy does not require awards of compensation for every (non-trivial) breach of statutory requirements even if no material damage or distress has been suffered.
- For all these reasons, I conclude that section 13 of the DPA 1998 cannot reasonably be interpreted as conferring on a data subject a right to compensation for any (non-trivial) contravention by a data controller of any of the requirements of the Act without the need to prove that the contravention has caused material damage or distress to the individual concerned.
- “User damages” is the name commonly given to a type of damages readily awarded in tort where use has wrongfully been made of someone else’s land or tangible moveable property although there has been no financial loss or physical damage to the property. The damages are assessed by estimating what a reasonable person would have paid for the right of user. Damages are also available on a similar basis for patent infringement and other breaches of intellectual property rights. Following the seminal decision of this court in OneStep (Support) Ltd v Morris-Garner [2018] UKSC 20; [2019] AC 649, it is now clear that user damages are compensatory in nature, their purpose being to compensate the claimant for interference with a right to control the use of property where the right is a commercially valuable asset. As Lord Reed explained in Morris-Garner, at para 95(1):
- Lord Reed, at paras 27 and 29, cited authorities which make it clear that the entitlement to user damages does not depend on whether the owner would in fact have exercised the right to control the use of the property, had it not been interfered with. The “loss” for which the claimant is entitled to compensation is not loss of this “conventional kind” (para 30); rather, it lies in the wrongful use of the claimant’s property itself, for which the economic value of the use provides an appropriate measure. This value can be assessed by postulating a hypothetical negotiation and estimating what fee would reasonably have been agreed for releasing the defendant from the duty which it breached. It is this method of assessment on which the claimant relies in the alternative formulation of the present claim.
- A claim in tort for misuse of private information based on the factual allegations made in this case, such as was made in Vidal-Hall, would naturally lend itself to an award of user damages. The decision in Gulati shows that damages may be awarded for the misuse of private information itself on the basis that, apart from any material damage or distress that it may cause, it prevents the claimant from exercising his or her right to control the use of the information. Nor can it be doubted that information about a person’s internet browsing history is a commercially valuable asset. What was described by the Chancellor in the Court of Appeal [2020] QB 747, para 46, as “the underlying reality of this case” is that Google was allegedly able to make a lot of money by tracking the browsing history of iPhone users without their consent and selling the information collected to advertisers.
- The view has sometimes been expressed that asserting privacy in information is inconsistent, or at least in tension, with treating such information as a commercial asset: see eg Douglas v Hello! Ltd (No 3) [2005] EWCA Civ 595; [2006] QB 125, para 246; and on appeal sub nom OBG Ltd v Allan [2007] UKHL 21; [2008] AC 1, para 275 (Lord Walker of Gestinghorpe). But once the basis of the right to privacy is understood to be the protection of a person’s freedom to choose and right to control whether and when others have access to his or her private affairs, I think that any tension largely disappears. It is common experience that some people are happy to exploit for commercial gain facets of their private lives which others would feel mortified at having exposed to public view. Save in the most extreme cases, this should be seen as a matter of personal choice on which it is not for the courts to pass judgments. Moreover, where the defendant’s very purpose in wrongfully obtaining and using private information is to exploit its commercial value, the law should not be prissy about awarding compensation based on the commercial value of the exercise of the right. As was confirmed in Morris-Garner, the fact that the claimant would not have chosen to exercise the right himself is no answer to a claim for user damages. It is enough that, as Lord Reed put it at paras 30 and 95(1) of his majority judgment, the defendant has taken something for nothing, for which the owner of the right was entitled to require payment.
- The point does not arise in the present case, however, because the claimant is not claiming damages for misuse of private information. As discussed, the only claim advanced is under the DPA 1998. Here it follows from the conclusion reached above about the meaning of section 13 that user damages are not available. This is because, for the reasons given, compensation can only be awarded under section 13 of the DPA 1998 for material damage or distress caused by an infringement of a claimant’s right to have his or her personal data processed in accordance with the requirements of the Act, and not for the infringement itself. Although his reasoning was in part based on an understanding of user damages overtaken by this court’s decision in Morris-Garner, it follows that Patten J was right to hold in Murray v Express Newspapers Plc [2007] EWHC 1908 (Ch); [2007] EMLR 22, at para 92, that the principles on which user damages are awarded do not apply to a claim for compensation under the DPA 1998.
- There is a further reason why the claimant’s attempt to recover damages under section 13 of the DPA 1998 by means of a representative claim cannot succeed. Even if (contrary to my conclusion) it were unnecessary in order to recover compensation under this provision to show that an individual has suffered material damage or distress as a result of unlawful processing of his or her personal data, it would still be necessary for this purpose to establish the extent of the unlawful processing in his or her individual case. In deciding what amount of damages, if any, should be awarded, relevant factors would include: over what period of time did Google track the individual’s internet browsing history? What quantity of data was unlawfully processed? Was any of the information unlawfully processed of a sensitive or private nature? What use did Google make of the information and what commercial benefit, if any, did Google obtain from such use?
- The claimant does not dispute that the amount of any compensation awarded must in principle depend on such matters. But he contends that it is possible to identify an “irreducible minimum harm” suffered by every member of the class whom he represents for which a “uniform sum” of damages can be awarded. This sum is claimed on the basis that it represents what the Chancellor in the Court of Appeal described as the “lowest common denominator” of all the individual claims: see [2020] QB 747, para 75.
- Google objects that Mr Lloyd, as the self-appointed representative of the class, has no authority from any individual class member to waive or abandon what may be the major part of their damages claim by disavowing reliance on any circumstances affecting that individual. Mr Lloyd’s answer, which the Court of Appeal accepted, is a pragmatic one. He points out that the limitation period for bringing any proceedings has now expired. For any represented individual there is therefore no longer any realistic possibility of recovering any compensation at all other than through the present action. Furthermore, to make this action viable, it is necessary to confine the amount of damages claimed for each class member to a uniform sum; and a uniform sum of damages, even if considerably smaller than an individualised award would be, is better than nothing.
- I do not think it necessary to enter into the merits of this issue. I am prepared to assume, without deciding, that as a matter of discretion the court could - if satisfied that the persons represented would not be prejudiced and with suitable arrangements in place enabling them to opt out of the proceedings if they chose - allow a representative claim to be pursued for only a part of the compensation that could potentially be claimed by any given individual. The fundamental problem is that, if no individual circumstances are taken into account, the facts alleged are insufficient to establish that any individual member of the represented class is entitled to damages. That is so even if it is unnecessary to prove that the alleged breaches caused any material damage or distress to the individual.
- The facts alleged against Google generically cannot establish that any given individual is entitled to compensation. To establish any such individual entitlement it must be shown, at least, that there was unlawful processing by Google of personal data of which that particular individual was the subject. In considering whether the facts alleged, if proved, are capable of establishing an entitlement to damages, it is therefore necessary to identify what unlawful processing by Google of personal data is alleged to have occurred in Mr Lloyd’s own case and also in the case of each other member of the represented class. What facts is the claimant proposing to prove to show that Google acted unlawfully in each individual case?
- The answer, on analysis, is: only those facts which are necessary to show that the individual falls within the definition of the “claimant class”. The premise of the claim is that Mr Lloyd and each person whom he represents is entitled to damages simply on proof that they are members of the class and without the need to prove any further facts to show that Google wrongfully collected and used their personal data. Any such further facts would inevitably vary from one individual member of the class to another and would require individual proof.
- To fall within the definition of the class, it must be shown, in substance, that the individual concerned had an iPhone of the appropriate model running a relevant version of the Apple Safari internet browser which, at any date during the relevant period whilst present in England and Wales, he or she used to access a website that was participating in Google’s DoubleClick advertising service. There are exclusions from the class definition for anyone who changed the default settings in the Safari browser, opted out of tracking and collation via Google’s “Ads Preference Manager” or obtained a DoubleClick Ad cookie via a “first party request” rather than as a “third party cookie”. The aim of the definition is to identify all those people who had a DoubleClick Ad cookie placed on their device unlawfully, through the Safari workaround, but not to include within the class anyone who did not receive a DoubleClick Ad cookie during the relevant period or who received the cookie by lawful means.
- It is sufficient to bring an individual within the class definition that he or she used the Safari browser to access a website participating in Google’s DoubleClick advertising service on a single occasion. The theory is that on that occasion the DoubleClick Ad cookie will have been placed on the user’s device unlawfully as a third party cookie. To qualify for membership of the class, it is not necessary to show that the individual ever visited a website participating in Google’s DoubleClick advertising service again during the relevant period. Nor is it alleged that any individual or individuals did visit such a website on more than one occasion. The “lowest common denominator” on which the claim is based is therefore someone whose internet usage - apart from one visit to a single website - was not illicitly tracked and collated and who received no targeted advertisements as a result of receiving a DoubleClick Ad cookie. This is because the claimant has deliberately chosen, in order to advance a claim in a representative capacity for damages assessed from the bottom up, not to rely on any facts about the internet activity of any individual iPhone user beyond those which bring them within the class of represented persons.
- For reasons given earlier, I am leaving aside the difficulties of proving membership of the class, significant as they would appear to be, and am assuming that such difficulties are not an impediment to the claim. But the question that must be asked is whether membership of the represented class is sufficient by itself to entitle an individual to compensation, without proof of any further facts particular to that individual.
- On the claimant’s own case there is a threshold of seriousness which must be crossed before a breach of the DPA 1998 will give rise to an entitlement to compensation under section 13. I cannot see that the facts which the claimant aims to prove in each individual case are sufficient to surmount this threshold. If (contrary to the conclusion I have reached) those facts disclose “damage” within the meaning of section 13 at all, I think it impossible to characterise such damage as more than trivial. What gives the appearance of substance to the claim is the allegation that Google secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes. But on analysis the claimant is seeking to recover damages without attempting to prove that this allegation is true in the case of any individual for whom damages are claimed. Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages.
- The claimant’s case is not improved by formulating the claim as one for user damages quantified by estimating what fee each member of the represented class could reasonably have charged - or which would reasonably have been agreed in a hypothetical negotiation - for releasing Google from the duties which it breached. I have already indicated why, in my opinion, user damages cannot be recovered for breaches of the DPA 1998. But even if (contrary to that conclusion) user damages could in principle be recovered, the inability or unwillingness to prove what, if any, wrongful use was made by Google of the personal data of any individual again means that any damages awarded would be nil.
- The claimant asserts, and I am content to assume, that if, instead of bypassing privacy settings through the Safari workaround, Google had offered to pay a fee to each affected Apple iPhone user for the right to place its DoubleClick Ad cookie on their device, the fee would have been a standard one, agreed in advance, rather than a fee which varied according to the quantity or commercial value to Google of the information which was subsequently collected as a result of the user’s acceptance of the cookie. However, imagining the negotiation of a fee in advance in this way is not the correct premise for the valuation.
- As explained in Morris-Garner, the object of an award of user damages is to compensate the claimant for use wrongfully made by the defendant of a valuable asset protected by the right infringed. The starting point for the valuation exercise is thus to identify what the extent of such wrongful use actually was: only then can an estimate be made of what sum of money could reasonably have been charged for that use or, put another way, for releasing the wrongdoer from the duties which it breached in the wrongful use that it made of the asset. Imagining a hypothetical negotiation, as Lord Reed explained at para 91 of Morris-Garner, is merely “a tool” for arriving at this estimated sum. As in any case where compensation is awarded, the aim is to place the claimant as nearly as possible in the same position as if the wrongdoing had not occurred. Accordingly, as Patten LJ put it in Eaton Mansions (Westminster) Ltd v Stinger Compania de Inversion SA [2013] EWCA Civ 1308; [2014] 1 P & CR 5, para 21:
- Applying that approach, the starting point would therefore need to be to establish what unlawful processing by Google of the claimant’s personal data actually occurred. Only when the wrongful use actually made by Google of such data is known is it possible to estimate its commercial value. As discussed, in order to avoid individual assessment, the only wrongful act which the claimant proposes to prove in the case of each represented person is that the DoubleClick Ad cookie was unlawfully placed on their device: no evidence is - or could without individual assessment - be adduced to show that, by means of this third party cookie, Google collected or used any personal data relating to that individual. The relevant valuation construct is therefore to ask what fee would hypothetically have been negotiated for a licence to place the DoubleClick Ad cookie on an individual user’s phone as a third party cookie, but without releasing Google from its obligations not to collect or use any information about that person’s internet browsing history. It is plain that such a licence would be valueless and that the fee which could reasonably be charged or negotiated for it would accordingly be nil.
- The judge took the view that, even if the legal foundation for the claim made in this action were sound, he should exercise the discretion conferred by CPR rule 19.6(2) by refusing to allow the claim to be continued as a representative action. He characterised the claim as “officious litigation, embarked upon on behalf of individuals who have not authorised it” and in which the main beneficiaries of any award of damages would be the funders and the lawyers. He thought that the representative claimant “should not be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated”: [2019] 1 WLR 1265, paras 102-104. The Court of Appeal formed a very different view of the merits of the representative claim. They regarded the fact that the members of the represented class had not authorised the claim as an irrelevant factor, which the judge had wrongly taken into account, and considered that it was open to them to exercise the discretion afresh. They saw this litigation as the only way of obtaining a civil compensatory remedy for what, if proved, was a “wholesale and deliberate misuse of personal data without consent, undertaken with a view to commercial profit”: see [2020] QB 747, para 86. In these circumstances the Court of Appeal took the view that, as a matter of discretion, the claim should be allowed to proceed.
- It is unnecessary to decide whether the Court of Appeal was entitled to interfere with the judge’s discretionary ruling or whether it would be desirable for a commercially funded class action to be available on the facts alleged in this case. This is because, regardless of what view of it is taken, the claim has no real prospect of success. That in turn is because, in the way the claim has been framed in order to try to bring it as a representative action, the claimant seeks damages under section 13 of the DPA 1998 for each individual member of the represented class without attempting to show that any wrongful use was made by Google of personal data relating to that individual or that the individual suffered any material damage or distress as a result of a breach of the requirements of the Act by Google. For the reasons explained in this judgment, without proof of these matters, a claim for damages cannot succeed.
- I would therefore allow the appeal and restore the order made by the judge refusing the claimant’s application for permission to serve the proceedings on Google outside the jurisdiction of the courts of England and Wales.
LORD LEGGATT: (with whom Lord Reed, Lady Arden, Lord Sales and Lord Burrows agree)
A. Introduction
“Firstly, there are potential structural differences between the sectors which will require different consideration. … Secondly, it will be necessary to undertake a full assessment of the likely economic and other impacts before implementing any reform.”
See the Government’s Response to the Civil Justice Council’s Report: “Improving Access to Justice through Collective Actions” (2008), paras 12-13.
B. Factual background
C. The Legal FRAMEWORK
(1) The scheme of the DPA 1998
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
The other seven data protection principles, in summary, require personal data: (2) to be obtained and processed only for specified and lawful purposes; (3) to be “adequate, relevant, and not excessive” in relation to those purposes; (4) to be accurate and, where necessary, kept up to date; (5) not to be kept for longer than is necessary for those purposes; (6) to be processed in accordance with the rights of data subjects under the Act; (7) to be protected by appropriate technical and organisational security measures against unauthorised or unlawful processing and against accidental loss or destruction or damage; and (8) not to be transferred outside the European Economic Area unless the destination country or territory provides an adequate level of protection for data subjects in relation to the processing of personal data.
(2) The allegations of breach of duty
D. Collective redress in English law
(1) Group Actions
“Whichever approach is adopted, many class members are likely to fail to take any positive action for a range of reasons that have nothing at all to do with an assessment of whether or not it is in their interests to participate in the proceedings. Some class members will not receive the relevant notice. Others will not understand the notice, or will have difficulty understanding what action they are required to take and completing any relevant form, or will be unsure or hesitant about what to do and will do nothing. Even where a class member considers that it is in their interests to participate in the proceedings, the significance of inertia in human affairs should not be underestimated.”
Ross v Southern Response Earthquake Services Ltd [2019] NZCA 431, para 98; approved by the New Zealand Supreme Court at [2020] NZSC 126, para 40.
(2) Collective Proceedings
“The tribunal may make an award of damages in collective proceedings without undertaking an assessment of the amount of damages recoverable in respect of the claim of each represented person.”
Such an award of damages is referred to in the CAT Rules as “an aggregate award of damages”: see rule 73(2).
(3) Representative Actions
“(1) Where more than one person has the same interest in a claim -
(a) the claim may be begun; or
(b) the court may order that the claim be continued,
by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.
(2) The court may direct that a person may not act as a representative.
(3) Any party may apply to the court for an order under paragraph (2).
(4) Unless the court otherwise directs any judgment or order given in a claim in which a party is acting as a representative under this rule -
(a) is binding on all persons represented in the claim; but
(b) may only be enforced by or against a person who is not a party to the claim with the permission of the court.”
(a) Origins of the rule
“Because it would be impracticable to make them all parties by name, and there would be continual abatements by death and otherwise, and no coming at justice, if all were to be made parties.”
“The general rule, which requires the plaintiff to bring before the court all the parties interested in the subject in question, admits of exceptions. The liberality of this court has long held that there is of necessity an exception to the general rule, when a failure of justice would ensue from its enforcement.”
After citing numerous authorities, he concluded, at p 284:
“Here is a current of authority, adopting more or less a general principle of exception, by which the rule, that all persons interested must be parties, yields when justice requires it, in the instance either of plaintiffs or defendants. … It is quite clear that the present suit has sufficient parties, and that the defendants may be considered as representing the company.”
“The old rule in the Court of Chancery was very simple and perfectly well understood. Under the old practice the Court required the presence of all parties interested in the matter in suit, in order that a final end might be made of the controversy. But when the parties were so numerous that you never could ‘come at justice’, to use an expression in one of the older cases, if everybody interested was made a party, the rule was not allowed to stand in the way. It was originally a rule of convenience: for the sake of convenience it was relaxed. Given a common interest and a common grievance, a representative suit was in order if the relief sought was in its nature beneficial to all whom the plaintiff proposed to represent.”
(b) Effect of the Judicature Act
“Where there are numerous parties having the same interest in one action, one or more of such parties may sue or be sued, or may be authorised by the court to defend in such action, on behalf or for the benefit of all parties so interested.”
This rule became Order 16, rule 9 of the Rules of the Supreme Court and has remained in force in the same or similar form ever since. Save that the requirement for “numerous parties” has been reduced to “more than one”, there is no significant difference in the current version of the rule, quoted at para 33 above.
“… in all other respects I think the rule as to representative suits remains very much as it was a hundred years ago. From the time it was first established it has been recognised as a simple rule resting merely upon convenience. It is impossible, I think, to read such judgments as those delivered by Lord Eldon in Adair v New River Co, in 1805, and in Cockburn v Thompson, in 1809, without seeing that Lord Eldon took as broad and liberal a view on this subject as anybody could desire. ‘The strict rule’, he said, ‘was that all persons materially interested in the subject of the suit, however numerous, ought to be parties … but that being a general rule established for the convenient administration of justice must not be adhered to in cases to which consistently with practical convenience it is incapable of application’. ‘It was better’, he added, ‘to go as far as possible towards justice than to deny it altogether’. He laid out of consideration the case of persons suing on behalf of themselves and all others, ‘for in a sense’, he said, ‘they are before the Court’. As regards defendants, if you cannot make everybody interested a party, you must bring so many that it can be said they will fairly and honestly try the right. I do not think, my Lords, that we have advanced much beyond that in the last hundred years …”
As Megarry J commented in John v Rees [1970] Ch 345, 370, this explanation made it plain that the representative rule is to be treated as being “not a rigid matter of principle but a flexible tool of convenience in the administration of justice”.
“The principle on which the rule is based forbids its restriction to cases for which an exact precedent can be found in the reports. The principle is as applicable to new cases as to old, and ought to be applied to the exigencies of modern life as occasion requires. The rule itself has been embodied and made applicable to the various Divisions of the High Court by the Judicature Act, 1873, sections 16 and 23-25, and Order XVI, rule 9; and the unfortunate observations made on that rule in Temperton v Russell have been happily corrected in this House in the Duke of Bedford v Ellis and in the course of the argument in the present case.”
(c) Markt and declarations of rights
(d) Claims for damages
“no representative action can lie where the sole relief sought is damages, because they have to be proved separately in the case of each plaintiff, and therefore the possibility of representation ceases.”
“classes of shareholders in a railway company who have different rights inter se, but they may all have a common enemy in the shape of a fraudulent director, and they may all join, of course, in one common suit against that director, although after the common right is established they may have a considerable litigation among themselves as to who are the persons entitled to the gains obtained through that suit.”
While the right enforced in such a common suit would in modern company law be seen as a right belonging to the company itself, rather than its shareholders, it is clear from the context that Lord Hatherley had in mind a representative action brought on behalf of shareholders, as he gave this analogy to explain how in that case a representative claim could be brought on behalf of all the freehold tenants of a manor to establish common rights against the lord of the manor even though different tenants or classes of tenant had different rights as between themselves.
(e) Emerald Supplies
(f) Commonwealth cases
(i) Australia
“... it is true that rule 13 lacks the detail of some other rules of court. But there is no reason to think that the Supreme Court of New South Wales lacks the authority to give directions as to such matters as service, notice and the conduct of proceedings which would enable it to monitor and finally to determine the action with justice to all concerned. The simplicity of the rule is also one of its strengths, allowing it to be treated as a flexible rule of convenience in the administration of justice and applied ‘to the exigencies of modern life as occasion requires’. The court retains the power to reshape proceedings at a later stage if they become impossibly complex or the defendant is prejudiced.”
(ii) Canada
(iii) New Zealand
(g) Principles governing use of the representative procedure
(i) The “same interest” requirement
(ii) The court’s discretion
(iii) No requirement of consent
(iv) The class definition
(v) Liability for costs
(vi) The scope for claiming damages
E. The representative claim in this case
(1) The formulation of the claim for damages
“… some affected individuals were ‘super users’ - heavy internet users. They will have been ‘victims’ of multiple breaches, with considerable amounts of [browser generated information] taken and used throughout the Relevant Period. Others will have engaged in very little internet activity. Different individuals will have had different kinds of information taken and used. No fewer than 17 categories of personal data are identified in the claim documents. The specified categories of data vary in their sensitivity, some of them being ‘sensitive personal data’ within the meaning of the section 2 of the DPA (such as sexuality, or ethnicity). … But it is not credible that all the specified categories of data were obtained by Google from each represented claimant. … The results of the acquisition and use will also have varied according to the individual, and their attitudes towards the acquisition, disclosure and use of the information in question.”
If liability is established, the ordinary application of the compensatory principle would therefore result in different awards of compensation to different individuals. Furthermore, the amount of any compensation recoverable by any member of the class would depend on a variety of circumstances particular to that individual. Individualised assessment of damages would therefore be required.
“(a) The lack of consent or knowledge of the Representative Claimant and each member of the Claimant Class to the defendant’s collection and use of their personal data.
(b) The fact that such collection and use was contrary to the defendant’s public statements.
(c) The fact that such collection and use was greatly to the commercial benefit of the defendant.
(d) The fact that the defendant knew or ought to have known of the operation of the Safari Workaround from a very early stage during the Relevant Period. …”
I interpose that factor (c), although no doubt true in relation to the class as a whole, plainly could not in fact be established in relation to any individual class member without evidence of what use, if any, was actually made of personal data of that individual by Google. If there is to be no individualised assessment, this factor must therefore be left out of account.
(2) Section 13 of the DPA 1998
“(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if -
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”
“1. Member states shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.
2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage.”
(3) Vidal-Hall v Google Inc
(4) Misuse of private information
“What human rights law has done is to identify private information as something worth protecting as an aspect of human autonomy and dignity.”
“… the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher.”
If this test is met, in cases where freedom of expression is involved the court must then undertake a “balancing exercise” to decide whether in all the circumstances the interests of the owner of the private information must yield to the right to freedom of expression conferred on the publisher by article 10 of the Convention: see eg McKennitt v Ash [2006] EWCA Civ 1714; [2008] QB 73, para 9.
(5) Gulati v MGN Ltd
“While the law is used to awarding damages for injured feelings, there is no reason in principle … why it should not also make an award to reflect infringements of the right itself, if the situation warrants it.”
“I shall therefore approach the consideration of quantum in this case on the footing that compensation can be given for things other than distress, and in particular can be given for the commission of the wrong itself so far as that commission impacts on the values protected by the right.”
Later in the judgment, at para 168, the judge referred back to his finding that:
“the damages should compensate not merely for distress …, but should also compensate (if appropriate) for the loss of privacy or autonomy as such arising out [of] the infringement by hacking (or other mechanism) as such.”
“the judge was correct to conclude that the power of the court to grant general damages was not limited to distress and could be exercised to compensate the claimants also for the misuse of their private information. The essential principle is that, by misusing their private information, MGN deprived the claimants of their right to control the use of private information.”
Arden LJ justified this conclusion, at para 46, on the basis that:
“Privacy is a fundamental right. The reasons for having the right are no doubt manifold. Lord Nicholls of Birkenhead put it very succinctly in Campbell v MGN Ltd [2004] 2 AC 457, para 12: ‘[Privacy] lies at the heart of liberty in a modern state. A proper degree of privacy is essential for the well-being and development of an individual.’”
(6) How the present claim is framed
(7) “Loss of control” over personal data
(8) The common source argument
“Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of [EU] law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the [EU];”
The aim of protecting the right to privacy with regard to the processing of personal data is also articulated in recitals (2), (7), (8) and (11) of the Data Protection Directive, and is spelt out in article 1 which states:
“Object of the Directive
In accordance with this Directive, member states shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”
Reliance is also placed on the recognition in article 8 of the EU Charter, quoted at para 96 above, of the right to the protection of personal data as a fundamental right in EU law.
(a) The wording of the DPA 1998
“If a court is satisfied on the application of a data subject -
(a) that he has suffered damage by reason of any contravention by a data controller of any of the requirements of this Act in respect of any personal data, in circumstances entitling him to compensation under section 13, and
(b) that there is a substantial risk of further contravention in respect of those data in such circumstances,
the court may order the rectification, blocking, erasure or destruction of any of those data.”
(b) The effect of EU law
(c) Flaws in the common source argument
(d) Material differences between the regimes
“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”
A complaint that a data controller has failed to take such “appropriate technical and organisational measures” is similar to an allegation of negligence in that it is predicated on failure to meet an objective standard of care rather than on any intentional conduct. Even where a contravention of the legislation does not itself require fault, pursuant to section 13(3), quoted at para 90 above, there is no entitlement to compensation if the data controller proves that it took “such care as in all the circumstances was reasonably required to comply with the requirement concerned”.
(e) Equivalence and effectiveness
“The identification of one or more similar procedures for the enforcement of claims arising in domestic law is an essential prerequisite for its operation. If there is no true comparator, then the principle of equivalence can have no operation at all. The identification of one or more true comparators is therefore the essential first step in any examination of an assertion that the principle of equivalence has been infringed.” [citation omitted]
For the reasons given, even if the measure of damages is regarded as a procedural rule, a claim for damages for misuse of private information at common law is not a true comparator of a claim under section 13 of the DPA 1998. The principle of equivalence can therefore have no operation.
(f) Conclusion on the effect of section 13
(9) The claim for user damages
“The rationale of such awards is that the person who makes wrongful use of property, where its use is commercially valuable, prevents the owner from exercising a valuable right to control its use, and should therefore compensate him for the loss of the value of the exercise of that right. He takes something for nothing, for which the owner was entitled to require payment.”
F. The need for individualised evidence of misuse
(1) The claim for the “lowest common denominator”
(2) The facts common to each individual case
(3) User damages on a lowest common denominator basis
“The valuation construct is that the parties must be treated as having negotiated for a licence which covered the acts of trespass that actually occurred. The defendant is not required to pay damages for anything else.”
See also Enfield London Borough Council v Outdoor Plus Ltd [2012] EWCA Civ 608, para 47; and Marathon Asset Management LLP v Seddon [2017] EWHC 300 (Comm); [2017] ICR 791, paras 254-262.
G. Conclusion