Last month saw the Court of Appeal upholding the judgment of the High Court that 3 claimants resident in England could bring claims in England against US-based Google Inc for misuse of private information and breach of the Data Protection Act 1998 (DPA).
This landmark judgment clarifies the law on misuse of private information and also potentially paves the way for compensation claims from individuals under the DPA in relation to data collected by third party cookies.
The claimants are based in England and were users of the Safari web browser on Apple computers. In essence, the claimants' complaint was that Google had caused them distress and anxiety by enabling advertisers (through the installation of third party cookies) to send them targeted adverts (some of which related to sensitive personal data) which might have been viewed by third parties who had used or seen their Apple devices.
The cookies in question secretly tracked online behaviour and stored private information known as Browser Generated Information, or BGI. Google's double-click service then allowed subscribing advertisers to collect BGI and send targeted advertising. Safari blocks third-party cookies by default and Google's publicly stated position was that third party cookies could not be enabled without Safari users' consent. The claimants therefore assumed that when they used Safari, there were no third party cookies storing private information and that there was no risk of targeted adverts relating to their private information being sent.
Misuse of Private Information
These proceedings arose because of the need for permission to serve on Google out of the jurisdiction. To obtain that permission, the claimants had to establish (amongst other things) that there was a good arguable case that their claim was made in tort (not in the equitable doctrine of breach of confidence) and that the damage was sustained within the jurisdiction.
Since the coming into force of the Human Rights Act in 1988, the courts have grappled with the concept of introducing a law of privacy in this country. Previously, attempts have been made to categorise privacy claims as a species of breach of confidence claim rather than a standalone tort. In this judgment, however, following substantial legal argument spanning several years the Court of Appeal has finally confirmed that there is a tort of misuse of private information. Whilst this decision had been presaged in earlier case law, there remained a lingering doubt about the status of this cause of action which has now, finally, been laid to rest.
Data Protection Act 1988 (DPA)
Section 13 of the DPA gives individuals the right to claim compensation for damages arising out of a breach of the DPA. However, section 13(2) of the DPA goes on to say that damages may also be recovered for distress in limited circumstances including where the individual also suffers 'damage' by reason of the contravention.
This distinction between damage a distress does not appear in the Data Protection Directive from which the DPA is derived and has been the subject of much debate and case law in which section 13 has, historically, been interpreted as meaning that compensation could only be claimed for distress where financial loss had also been suffered. As a result, very few compensation claims were brought under section 13 of the DPA because the majority of breaches of the DPA lead to distress and not necessarily financial loss. The application of section 13(2) therefore served as a barrier preventing individuals from bringing claims
The Court of Appeal's judgment in this case has significantly changed the application and interpretation of section 13 of the DPA by recognising that the aim of the Data Protection Directive is not to protect economic rights and the fact that it has been interpreted as such has meant that many individuals have been unable to gain redress in circumstances where their rights to privacy have been breached.
As a result of this ruling, it has now been established that a claimant does not have to prove pecuniary damage to successfully bring a claim under s13 of the DPA. Instead, the court ruled that it was sufficient for a claimant to establish that he/she has suffered 'distress'.
Whilst Google has sought permission to appeal this decision to the Supreme Court, the decision of the Court of Appeal will inevitably result in significant change in relation to the number of claims being made under the DPA where pecuniary loss is not necessarily relevant and, in relation to, how those claims are handled.
This preliminary ruling may have serious consequences for the online advertising industry and the search engines which facilitate it. Whilst it was acknowledged by the courts and counsel for the claimants that the damages in this case might be small, the issues of principle are clearly large. With the recent EU announcement that Google may be investigated for alleged anti-competitive behaviour, it seems the authorities are closely watching the way in which our online activities are monitored.
This document is for informational purposes only and does not constitute legal advice. It is recommended that specific professional advice is sought before acting on any of the information given.