Who: Judith Vidal-Hall and Ors and Google Inc
Where: London High Court
When: January 2014
Law stated as at: 5 February 2014
What happened:
The High Court in London has ruled in a pre-trial hearing that three Safari users resident in England using Apple devices to access the internet can bring claims in the High Court against Google Inc. for alleged misuse of personal information arising from Google’s exploitation of the Safari web browser’s privacy settings.
Background
In early 2012 Google was accused of circumventing the privacy settings of Apple’s web browser Safari. This enabled Google to set third-party cookies on users’ devices although they had been disabled in the privacy settings. This was achieved by detecting requests from Safari browsers and disguising the cookie in a faked form request. Google argued that this was a documented feature Google used to prevent compatibility issues. In November 2013, however, Google agreed to pay 17 million USD to settle claims in various states in the USA.
The proceedings
In this case and based on similar facts, Apple device and Safari users Judith Vidal-Hall, Robert Hann and Marc Bradshaw issued proceedings against Google, Inc of the US. They claimed damages for misuse of personal and confidential information under the English common law of breach of confidence and for breach of statutory duty in the form of Google’s alleged breach of oblgations to them under the Data Protection Act 1998 (“DPA”).
Google applied to the High Court for a declaration that the English court had no jurisdiction to try the claims.
In dealing with the application, the court considered, probably for the first time in English jurisprudence, whether “personal data” as defined by the DPA is processed when a cookie obtains and collates information about websurfing activities conducted using the device on which the cookie has been placed and serves targeted ads to that device.
The Court also considered whether such activity might in addition be a “breach of confidence,” a “common law” civil wrong for which damages and injunctions may be granted.
The finding was that there was a serious issue to be tried as to whether the claimants had suffered damage as a result of breaches of the DPA and breach of confidence occurring in England. Therefore Google’s application was dismissed and, subject to any Google appeal, the case can proceed in the English court.
Types of ads served may be “personal data”
On whether “personal data” were being processed, the Court held that there was a serious issue to be tried as to whether the claimants were likely to be identifiable by a third party viewer as a person having the characteristics capable of being inferred from the types of ads served.
Based on this finding, although of course no final judgment has yet been handed down on these issues, the court has clearly found it to be arguable that the process by which behavioural data are collected by third party cookies, leading to targeted ads being served on device screens, involves the processing of “personal data” as defined by the DPA, even where the data involved are not directly connected to information directly identifying an individual.
To grant leave to serve the proceedings out of the jurisdiction, the court had to find either that damage was sustained in England or Wales or that such damage was sustained as a result of an act committed in England or Wales.
The court held that the alleged damage had resulted from an act within the jurisdiction by way of the publication of advertisements on the claimants’ device screens. Furthermore, damages for distress were awardable in breach of confidential information cases.
As regards the claim for breach of statutory duty under the DPA, the finding was that although there may be no financial damage in this case, a claim for so-called “moral damage” was arguable, in the form, for example, of damage flowing from inappropriate use of personal data which leads to third parties deducing the interests of the claimant from targeted ads appearing on the claimant’s device screen.
Why this matters:
The case has a long way to go and there is every chance that Google will appeal this judgment. However, the court’s findings are cause for concern within the online advertising industry on the issues of damage and breach of the DPA when most of the regulatory focus to date on online tracking and behavioural advertising has been on cookie disclosure and consent under separate Privacy and Electronic Communications laws.
Sources:
High Court, Vidal-Hall and others v Google Inc [2014] EWHC 13 (QB), 16 January 2014
http://techcrunch.com/2012/02/17/google-under-fire-for-circumventing-safari-privacy-setting/
http://www.nytimes.com/2013/11/19/technology/google-to-pay-17-million-to-settle-privacy-case.html
