Who: Google Inc, Judith Vidal-Hall, Robert Hann and Marc Bradshaw
Where: Supreme Court, London
When: 28 July 2015
Law stated as at: 10 August 2015
What happened:
The Supreme Court has granted Google the right to appeal part of the Court of Appeal’s groundbreaking decision in Google Inc. v Vidal-Hall & Others [2015] EWCA Civ 311.
By way of context, the case was brought against Google in the London High Court by three English users of Apple devices (the “Claimants”). Their claim was based on an allegation that Google had misused their private information and acted contrary to the Data Protection Act 1998 (“DPA”) by using the Claimants’ online browsing data (“Browser Generated Information” or “BGI”), without their knowledge or consent. Google did so in order to serve advertisements tailored to the Claimants’ interests, as deduced from the collected BGI.
The two key aspects of the Court of Appeal’s ruling were that:
- misuse of private information should be classified as a tort, meaning that litigants should be able to bring a claim in the English courts, even against foreign defendants; and
- Section 13(2) of the DPA, which had previously prevented claims for “distress” in the absence of pecuniary loss, was invalid on two grounds:
- it was incompatible with Article 23 of EU Directive 95/46/EC (the “Directive”), which does not condition recovery for distress on simultaneous occurrence of pecuniary damage; and
- it limited the rights of the Claimants in a manner inconsistent with the rights guaranteed by Article 7 (right to private and family life) and Article 8 (right to protection of personal data) of the EU Charter of Fundamental Rights.
Accordingly, the Court of Appeal ruled that Section 13(2) of the DPA should be disapplied.
This decision, if upheld, will have wide-ranging practical impacts for marketers, particularly those who use BGI to identify – and tailor content to – their target audience. For a detailed report on the Court of Appeal’s ruling and its potential impact, please read Stephen Groom’s commentary here.
Google’s appeal
Google applied for permission to appeal to the Supreme Court on the three grounds as to whether the Court of Appeal was right to:
- hold the Claimant’s claims for misuse of private information are claims made in tort for the purposes of the rules relating to service out of the jurisdiction;
- hold that Section 13(2) of the DPA was incompatible with Article 23 of the Directive; and
- disapply Section 13(2) of the DPA on the grounds that it conflicts with the rights guaranteed by Articles 7 and 8 of the EU Charter of Fundamental Rights.
Why this matters:
Although Google appealed on all counts, permission was only granted in relation to the invalidity of Section 13(2) of the DPA (the second and third grounds above). The Supreme Court refused permission to appeal on the first ground (the issue whether or not the claim is in tort) because this did not raise an arguable point of law. In doing so, it has tacitly upheld the view that misuse of private information is a tort.
This effectively means that the claim in tort will proceed against Google, regardless of the eventual outcome of Google’s appeal on Section 13(2). Foreign organisations should now be aware that the English courts will have jurisdiction to hear claims for misuse of private information in any case where “damage” is either sustained in the jurisdiction or otherwise results from an act committed in the jurisdiction.
If the Supreme Court upholds the Court of Appeal ruling on the invalidity of Section 13(2), this will add significantly to the pressures that marketing and advertising organisations face from a data protection perspective. The decision has potentially opened the floodgates to group litigation, which could see thousands of claims brought by aggrieved individuals who have merely suffered “distress” as a result of an organisation’s breach of privacy laws. Though each individual claim might be relatively small, businesses could be exposed to very significant claims if a large group of individuals is affected.
Moreover, we could well see a rise in “follow on” group litigation resulting from any finding by the data protection regulator – the Information Commissioner’s Office – that an organisation has breached its obligations under the DPA. Resulting claims for compensation could easily dwarf a regulatory fine, which is currently set at a maximum of £500,000.
Although no date has yet been announced for the next steps in the proceedings, we expect the Supreme Court to hear the appeal at some point in early 2016. We will keep you posted on developments.
