The United Kingdom's Supreme Court denied a claim Wednesday that sought billions of dollars in damages in a class-action lawsuit against Google over alleged illegal tracking of millions of iPhone users. The 3 billion GBP ($4 billion) lawsuit, which was filed on behalf of 4.4 million residents in England and Wales, had implications for other class-action lawsuits filed in the U.K.
Judge George Leggatt said the claimant did not prove damages to the individuals involved in the data collection.
"The claimants seeks damages," Leggatt said, "for each individual member of the represented class without attempting to show that any wrongful use was made by Google of personal data relating to that individual or that the individual suffered any material damage or distress as a result of a breach." Leggatt also said, "Without proof of these matters, a claim for damages cannot succeed."
According to the BBC, Google said, "This claim was related to events that took place a decade ago and that we addressed at the time. ... People want to know that they are safe and secure online, which is why for years we've focused on building products and infrastructure that respect and protect people's privacy."
The case was originally filed by Richard Lloyd, on behalf of the group, "Google You Owe Us." The group accused Google of bypassing Apple iPhone security by collecting personal information of users on the phone's Safari web browser between August 2011 and February 2012. Google settled with the U.S. Federal Trade Commission for $22.5 million over the same tracking issue in 2012.
A U.K. court dismissed the case in October 2018, but it was later overturned by the U.K. Court of Appeal.
Privacy professionals have been anticipating the outcome of the Supreme Court ruling as it will affect other class-actions in the the U.K.
"This signals that the U.K. legal system is not ready yet to allow U.S.-style class actions for data protection breaches, and the Supreme Court has been categorical about it," Hogan Lovells Partner Eduardo Ustaran, CIPP/E, told The Privacy Advisor.
"The reasoning of the court is straight forward: the right to claim compensation under the UK data protection framework can only be exercised by proving material damage or distress to each individual concerned, as that is what the law says and intended," Ustaran said. "This is not necessarily the end of collective privacy actions, but those affected will be asked to evidence the damage or distress suffered."
TikTok is facing a similar class action — one in which one representative brings a class action on behalf of millions of individuals. In this case, former U.K. Children's Commissioner Anne Longfield alleges the company used children's data without informed consent.
Linklaters characterized Wednesday's ruling as "a big blow to claimant law firms and funders who had hoped to create a new opt out regime for damages in the data breach sphere."
Lloyd, the claimant in the case, said, "We are bitterly disappointed that the Supreme Court has failed to do enough to protect the public from Google and other big tech firms who break the law. Although the court once gain recognized that our action is the only practical way that millions of British people can get access to fair redress, they've slammed the door shut on this case by ruling that everyone affected must go to court individually."
In a short Twitter thread, Oxford University Associate Professor of Philosophy Carissa Véliz said the Supreme Court ruling "is bad news" for privacy, democracy, equality and the U.K. "We have to go beyond damages because the damages that privacy losses cause are grave, but not easily calculated," she wrote.
Véliz also expressed concern about the individual in this context, noting that individuals are unlikely to challenge a big company like Google on their own. She added, "This ruling also undermines equality because the ordinary citizen is very unlikely to take a company like Google to court. Justice is only for the rich, then."
Photo by Bill Oxford on Unsplash
