Lawyers and litigation funders would “by a considerable margin” be the main beneficiaries of any award in a representative action against Google over misuse of private data, the High Court has ruled in blocking the case going forward.
Mr Justice Warby refused the Google You Owe Us group permission to serve proceedings on the internet giant in the US, a decision the group’s representative has vowed to appeal.
The action alleges that, over some months in 2011-2012, Google acted in breach of duty under section 4(4) of the Data Protection Act 1998 (DPA) by secretly tracking the internet activity of Apple iPhone users, collating and using that data, and then selling it all on.
No financial loss or distress was alleged. The claim was for a standard award – potentially of around £750 – for each of the estimated 4.4m members of the class, to reflect the infringement of the right, the commission of the wrong, and loss of control over personal data.
The estimated bill for Google if it lost was between £1bn and £3bn.
However, Warby J ruled against granting permission because there was not a reasonable prospect of the claim succeeding.
He said the particulars of claim did not support the contention that the representative claimant – Richard Lloyd, the former executive director of Which? – or any of those he represented suffered “damage” within the meaning of DPA: contravention of the Act on its own was not enough.
If that was wrong, he decided that the court would “inevitably” refuse to allow the claim to continue as a representative action because members of the class did not have the “same interest”, as required by the CPR – the nature and extent of the breach and the impact it had on individual class members would have varied greatly – and/or because it was impossible reliably to ascertain the members of the represented class.
Alternatively, he concluded, permission to continue the action in this form was refused as a matter of discretion.
The judgment revealed that Therium Capital Management was providing funding in three tranches totalling £15.5m, and there was after-the-event insurance to cover adverse costs of up to £12m. London law firm Mishcon de Reya is acting for Mr Lloyd.
Warby J noted the potential costs, as well as the “considerable amount of court time would undoubtedly be consumed”.
He continued: “The damage sustained and the compensation recoverable by each represented individual are modest at best. The main beneficiaries of any award at the end of this litigation would be the funders and the lawyers, by a considerable margin.”
A representative action was a “convenient case management tool” that avoided a large number of substantially similar actions, the judge continued. “On the evidence before me, the present action would not serve that purpose. Rather the contrary…
“The individual claims are not viable as stand-alone litigation, and a group litigation order is impracticable, so that this representative action is in practice the only way in which these claims can be pursued.
“I do not accept [the] argument that this favours the continued pursuit of the representative action. It would not be unfair to describe this as officious litigation, embarked upon on behalf of individuals who have not authorised it, and have shown no interest in seeking any remedy for, or even complaining about, the alleged breaches…
“My decision is that, if I am wrong about the DPA issue and the threshold requirements, the representative claimant should not be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated.”
Responding to the ruling, Mr Lloyd said he would seek permission to appeal.
He challenged Warby J’s statement that few of those affected in the data breach had shown any interest in the case, pointing out that 20,000 people had signed up to the Google You Owe Us website.
“Today’s judgment is extremely disappointing and effectively leaves millions of people without any practical way to seek redress and compensation when their personal data has been misused,” he said.
“Google’s business model is based on using personal data to target adverts to consumers and they must ask permission before using this data. The court accepted that people did not give permission in this case yet slammed the door shut on holding Google to account.
“People are only now beginning to realise the implications of losing control of their personal data in this way. Closing this route to redress puts consumers in the UK at risk and sends a signal to the world’s largest tech companies that they can continue to get away with treating our information irresponsibly.
“This is an analogue decision in a digital age. There now seems no alternative but for the government to fill this gap by legislating to give groups of consumers the right to affordable collective redress.”
Earlier this year, a QC claimed that the introduction of the General Data Protection Regulation would only increase the appetite for group or representative action for data breaches.