The landmark judgment of the Court of Appeal in Vidal Hall & Ors v Google Inc may signal the dawn of a new beginning for data protection litigants. Prior to this case, the law in England was
The landmark judgment of the Court of Appeal in Vidal Hall & Ors v Google Inc may signal the dawn of a new beginning for data protection litigants. Prior to this case, the law in England was relatively settled: that in order to incur civil liability under the Data Protection Act 1998, the claimant had to establish at least some form of pecuniary damage (unless the processing related to journalism, art or literature). The wording of section 13(2) appeared unequivocal on this point and it frequently proved to be a troublesome hurdle for claimants – and a powerful shield for defendants.
The requirement, however, was always the source of some controversy and the English courts have tried in recent years to dilute the strictness of the rule.
Then enter Ms Vidal-Hall & co: three individuals who allege that Google has been collecting private information about their internet usage from their Safari browser without their knowledge or consent. Claims were brought under the tort of misuse of private information and under s.13 of the DPA, though there was no claim for pecuniary loss.
This ruling concerned only the very early stages of litigation – whether the claimants were permitted to even serve the claim on Google which, being based in California, were outside of the jurisdiction. Permission was granted by the Court of Appeal and the case will now proceed through the English courts.
Three key rulings lie at the heart of this judgment:
We take each briefly in turn:
(1) Damages for distress alone are sufficient
The Court of Appeal disapplied the clear wording of domestic legislation on the grounds that the UK Act could not be interpreted compatibly with Article 23 of the EU Directive, and Articles 7, 8 and 47 of the EU Charter of Fundamental Rights. It held that the main purpose of the Data Protection Directive was to protect privacy, rather than economic rights, and it would be "strange" if it could not compensate those individuals who had suffered emotional distress but no pecuniary damage, when distress was likely to be the primary form of damage where there was a contravention.
It is too early to say whether this ruling will in practice open the door to masses of litigation - but there is no doubt that a significant obstacle that previously stood in the way of DPA claimants has now been unambiguously lifted by the Court of Appeal.
(2) Browser-generated information may constitute "personal data"
A further interesting, though less legally ground-breaking, ruling was that the BGI data in this case was arguably "personal data" under the DPA. The Court of Appeal did not decide the issue, but held that there was at least a "serious issue to be tried".
Google had argued that: (a) the BGI data on its own was anonymous as it did not name or identify any individual; and (b) it kept the BGI data segregated from other data it held from which an individual might be identifiable (e.g. Gmail accounts). Thus, it was not personal data.
In response to Google's points, the Court considered that it was immaterial that the BGI data did not name the user – what was relevant was that the data comprised of detailed browsing histories and the use of a DoubleClick cookie (a unique identifier which enabled the browsing histories to be linked to a specific device/machine). Taking those two elements together, it was "possible" to equate an individual user with the particular device, thus potentially bringing the data under the definition of "personal data".
The Court further considered it immaterial that Google in practice segregated the BGI data from other data in its hands. What mattered was whether Google had the other information actually within its possession which it "could" use to identify the data subject, "regardless of whether it does so or not".
(3) Misuse of private information is a tort
Finally, there was the confirmation that the misuse of private information is a tort for the purposes of service out of the jurisdiction. Not a huge point for our readers, but it will mean that claimants who bring claims under this cause of action will more easily obtain service out of the jurisdiction against foreign defendants.
A turning point…?
So the judgment certainly leaves much food for thought and is a significant turning point in the history of data protection litigation. There may also be a wider knock-on effect within the EU as other Member States that require proof of pecuniary damage look to the English judgment as a basis for opening up pure distress claims in their own jurisdictions.
The thing to bear in mind is that the ruling concerned only the very early stages of litigation - there is still a long road ahead in this thorny litigation and a great deal of legal and factual issues that still need to be resolved.
Cookie droppers may be watching this space with a mixture of fear and fascination.
The requirement, however, was always the source of some controversy and the English courts have tried in recent years to dilute the strictness of the rule.
Then enter Ms Vidal-Hall & co: three individuals who allege that Google has been collecting private information about their internet usage from their Safari browser without their knowledge or consent. Claims were brought under the tort of misuse of private information and under s.13 of the DPA, though there was no claim for pecuniary loss.
This ruling concerned only the very early stages of litigation – whether the claimants were permitted to even serve the claim on Google which, being based in California, were outside of the jurisdiction. Permission was granted by the Court of Appeal and the case will now proceed through the English courts.
Three key rulings lie at the heart of this judgment:
- There is now no need to establish pecuniary damage to bring a claim under the DPA. Distress alone is sufficient.
- It is "arguable" that browser generated information (BGI) constitutes "personal data" under the DPA.
- Misuse of private information should be classified as a tort for the purposes of service out of the jurisdiction.
We take each briefly in turn:
(1) Damages for distress alone are sufficient
The Court of Appeal disapplied the clear wording of domestic legislation on the grounds that the UK Act could not be interpreted compatibly with Article 23 of the EU Directive, and Articles 7, 8 and 47 of the EU Charter of Fundamental Rights. It held that the main purpose of the Data Protection Directive was to protect privacy, rather than economic rights, and it would be "strange" if it could not compensate those individuals who had suffered emotional distress but no pecuniary damage, when distress was likely to be the primary form of damage where there was a contravention.
It is too early to say whether this ruling will in practice open the door to masses of litigation - but there is no doubt that a significant obstacle that previously stood in the way of DPA claimants has now been unambiguously lifted by the Court of Appeal.
(2) Browser-generated information may constitute "personal data"
A further interesting, though less legally ground-breaking, ruling was that the BGI data in this case was arguably "personal data" under the DPA. The Court of Appeal did not decide the issue, but held that there was at least a "serious issue to be tried".
Google had argued that: (a) the BGI data on its own was anonymous as it did not name or identify any individual; and (b) it kept the BGI data segregated from other data it held from which an individual might be identifiable (e.g. Gmail accounts). Thus, it was not personal data.
In response to Google's points, the Court considered that it was immaterial that the BGI data did not name the user – what was relevant was that the data comprised of detailed browsing histories and the use of a DoubleClick cookie (a unique identifier which enabled the browsing histories to be linked to a specific device/machine). Taking those two elements together, it was "possible" to equate an individual user with the particular device, thus potentially bringing the data under the definition of "personal data".
The Court further considered it immaterial that Google in practice segregated the BGI data from other data in its hands. What mattered was whether Google had the other information actually within its possession which it "could" use to identify the data subject, "regardless of whether it does so or not".
(3) Misuse of private information is a tort
Finally, there was the confirmation that the misuse of private information is a tort for the purposes of service out of the jurisdiction. Not a huge point for our readers, but it will mean that claimants who bring claims under this cause of action will more easily obtain service out of the jurisdiction against foreign defendants.
A turning point…?
So the judgment certainly leaves much food for thought and is a significant turning point in the history of data protection litigation. There may also be a wider knock-on effect within the EU as other Member States that require proof of pecuniary damage look to the English judgment as a basis for opening up pure distress claims in their own jurisdictions.
The thing to bear in mind is that the ruling concerned only the very early stages of litigation - there is still a long road ahead in this thorny litigation and a great deal of legal and factual issues that still need to be resolved.
Cookie droppers may be watching this space with a mixture of fear and fascination.