Anyone engaged in aggregating valuable personal data from the Internet will have to sit up and take notice after the Court of Appeal paved the way for a consumer rights campaigner to sue Google on behalf of more than four million Apple iPhone users.
The campaigner launched proceedings against the search engine on the basis that it had, for commercial purposes, secretly tracked the Internet activity of millions of people over a five-month period. He sought a uniform amount of damages on behalf of each individual concerned without seeking to prove any distinctive facts affecting any of them, save that they did not consent to the abstraction of their data.
His case was stymied when a judge dismissed his application for permission to serve Google with the proceedings outside the jurisdiction, at its headquarters in Delaware, USA. In upholding his challenge to that ruling, however, the Court found that the campaigner and the millions of others that he sought to represent could recover damages under Section 13 of the Data Protection Act 1998 (DPA) even in the absence of evidence of distress or financial loss having been suffered.
The allegation that Google had collated vast quantities of browser generated information (BGI) for commercial purposes, and without the consent of the individuals concerned, was sufficient to found a representative action. The data, which was of immense value to advertisers, was said to have enabled Google to obtain or deduce information relating not only to individual browsing habits and the location of Internet users, but also to such factors as race, ethnicity, age, sexual orientation, gender and financial position.
Article 8 of the Charter of Fundamental Rights of the European Union enshrines the right of all to protection of their personal data. The alleged breaches of the DPA were far from trivial and the Court noted that a requirement that distress or financial loss must be established in order to mount a successful claim would deprive individuals of an effective remedy for breach of such rights.
Although the claim was an unusual use of the representative procedure, the Court found that it was permissible. Those the campaigner sought to represent were all alleged to have had something of value – their BGI – taken from them by Google without their consent. They were all victims of the same alleged wrong and had all sustained the same loss of control over their BGI. In the absence of evidence of distress or financial loss, the individual damages awards were likely to be low, but that did not preclude the campaigner’s claim from proceeding to trial.
