Who: Vidal Hall & Others, Google Inc. and The Information Commissioners’ Office (the “ICO”)
Where: The Court of Appeal
When: 2015
Law stated as at: 9 December 2014
What happened:
In January 2014, the High Court ruled that three English residents were entitled to bring claims in the English courts against Google Inc., a US based company, for the misuse of their private information. Google was accused of cloaking its cookies in order to circumvent settings on Apple’s Safari browser that allowed users to block third–party tracking and browser collation cookies. For a detailed discussion of the High Court judgement, please read Stephen Groom’s MarketingLaw article (click here for the full article).
Google appealed against the High Court’s decision and the Appeal hearing began in December 2014. However, due to court holidays, the case was partly heard in the Court of Appeal in December, with the remaining issues to be tried this year.
However, what is of most interest at this stage, is that the ICO have decided to intervene in the proceedings. The ICO will make submissions on the case when it returns to the Court of Appeal this year. It appears that, at this stage, the ICO will be making submissions as to whether the targeted marketing data involved in this case is personal data or not, and whether damages under the Data Protection Act 1998 (The “DPA”) could cover non-pecuniary losses (e.g. mental distress or pain and suffering).
Why this matters:
This case is of considerable potential importance in the world of data privacy and it addresses several key issues; (1) can claims be brought in England against ISPs domiciled outside of England?; (2) can targeted marketing data be personal data?; (3) is the non-consented use of data relating to a web user’s browsing activities so as to serve relevant ads onto the screen of the web user’s device (that may be seen by third parties and thereby cause embarrassment and/or “non pecuniary” loss) an actionable misuse of the web user’s private information?; and (4) can an individual claim non-pecuniary losses under the DPA?
1) Can a claim be brought in England against ISPs based outside of England?
In this case, the High Court decided that it was possible to bring a claim against ISPs based outside of the UK. This is, in summary, because the harm to the individuals was sustained within England and the act that caused the harm was committed in England also, regardless of the fact that Google Inc. is an American company and handles the relevant data outside of the UK.
2) Can targeted marketing data be personal data?
This matter is still to be determined. In the initial hearing, the judge decided that there was a serious issue to be tried regarding this point. This is the main element of the case that has sparked the ICO’s involvement and could be quite disruptive to the world of targeted marketing.
3) Is the non-consented use of data relating to a web user’s browsing activities so as to serve relevant ads onto the screen of the web user’s device (that may be seen by third parties and thereby cause embarrassment and/or “non pecuniary” loss) an actionable misuse of the web user’s private information?
In the first instance judgment the Judge considered this arguable and was not prepared to strike out the claim.
4) Can an individual claim non-pecuniary losses under the DPA?
Again, we will have to wait and see what the judges in the Court of Appeal have to say on this issue. If non-pecuniary losses can be claimed then this opens up a whole new dimension of risk for the behavioural advertising ecosystem.
We will be following the case closely over the next few months and will report again on the matter as soon as it progresses further.
