A £3bn legal action against Google over claims it secretly tracked the internet activity of millions of iPhone users has been blocked by the UK supreme court.
Legal experts said the decision meant the “floodgates” remained closed to class actions on data privacy in England and Wales, although the ruling noted digital technology’s ability to cause “mass harm” to people.
Richard Lloyd, a former director of the consumer group Which?, wanted to bring a US-style class action lawsuit against the search engine on behalf of about 4.4 million people in England and Wales.
He claimed Google illegally misused the data of millions of iPhone users by tracking and collating their internet usage on their handsets’ Safari browser in 2011 and 2012, even when users were assured they would be opted out of such tracking by default.
Lloyd and the campaign group Google You Owe Us hoped to sue the US-based company for damages equivalent to £750 per person for alleged breaches of the Data Protection Act (DPA).
The high court initially ruled that Lloyd could not serve the claim on Google outside the jurisdiction of England and Wales in October 2018 – because Lloyd needed permission to serve it in the US state of Delaware where Google is incorporated – but that decision was overturned by the court of appeal in October 2019. However, on Wednesday a panel of five supreme court justices allowed an appeal by Google against that decision.
Giving the lead ruling, Lord Leggatt said Lloyd’s intention that affected iPhone users could be awarded a uniform sum, without having to prove financial loss or mental distress, was “unsustainable”.
Leggatt said the section of the DPA on which the claim was based referred to material damage and mental distress caused by unlawful processing of data – and not the unlawful processing itself. A catch-all lawsuit that did not detail each individual’s suffering of material damage or mental distress was therefore unsustainable.
The judge said: “What gives the appearance of substance to the claim is the allegation that Google secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes. But on analysis the claimant is seeking to recover damages without attempting to prove that this allegation is true in the case of any individual for whom damages are claimed.
“Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages.”
Google’s lawyers argued at a hearing in April that the landmark appeal court ruling could “open the floodgates” to vast claims brought on behalf of millions of people against companies responsible for handling people’s data.
Emily Cox, the head of disputes at Stewarts law firm, said the ruling was a relief for big tech firms that handle the data of millions of people in England and Wales on a daily basis.
“This decision ensures the floodgates remain firmly closed to data privacy class actions in England and Wales, much to the relief of big tech, but it also leaves consumers without a viable route to compensation for breaches of their privacy rights by large corporations and so limits access to justice.”
Jonathan McDonald, a partner at the law firm Charles Russell Speechlys, said: “Had Google lost the appeal, this could have kicked open the floodgates for mass litigations in the technology sector.”
Google You Owe Us and Lloyd claimed Google bypassed privacy settings on Apple iPhone handsets between August 2011 and February 2012 and used the data gathered to divide people into categories for advertisers.
They said “browser-generated information” collected by Google included racial or ethnic origin, physical and mental health, political affiliations or opinions, sexual interests and social class. Google’s lawyers said there was no suggestion the so-called Safari workaround had resulted in any information being disclosed to third parties.
Lloyd said: “We are bitterly disappointed that the supreme court has failed to do enough to protect the public from Google and other big tech firms who break the law.”
A Google spokesperson said: “This claim was related to events that took place a decade ago and that we addressed at the time. People want to know that they are safe and secure online, which is why for years we’ve focused on building products and infrastructure that respect and protect people’s privacy.”
Meanwhile, a top EU court on Wednesday rejected Google’s appeal against a €2.4bn (£2.1bn) fine from regulators who found the tech giant had abused its massive online reach by giving its own shopping recommendations an illegal advantage in its search results.
The European Commission, the EU’s executive arm, punished Google in 2017 for unfairly favouring its own shopping service over competitors. The European court of justice’s general court ruled it “largely dismisses” Google’s appeal against that antitrust penalty and upheld the fine.