A landmark decision of the Court of Appeal in Vidal-Hall v Google Inc ( EWCA Civ 311) may lead to a sea-change in how claims are brought for breaches of data protection laws. The judgment classifies the misuse of private information as a tort and allows claimants to recover damages under the Data Protection Act 1998 (DPA) for non-material loss.
In the claim against Google for misuse of private information, breach of confidence and breach of the DPA for the collection of browser generated information (BGI) from their Apple Safari browsers, the Court of Appeal was required to rule on the following issues:
WHETHER MISUSE OF PRIVATE INFORMATION IS A TORT
The Court distinguished actions for breach of confidence and for misuse of private information, which are based on different legal foundations and protect different legal interests. This decision allows the claimants to serve their claim on Google out of the jurisdiction of the UK. The implications this will have as to remedies, limitation periods and vicarious liability will be considered as and when they arise.
THE MEANING OF DAMAGE IN SECTION 13 OF THE DPA
The Court of Appeal disapplied section 13(2) of the DPA, which limits the right to non-pecuniary damages, on the grounds that this conflicts with the rights granted in Articles 7 (right to respect of private and family life) and 8 (right to protection of personal data) of the EU Charter. It was held that article 23 of the Data Protection Directive, which is implemented by section 13 of the DPA, does not distinguish between pecuniary and non-pecuniary loss.
IS BGI PERSONAL DATA UNDER SECTION 1(1) OF THE DPA?
The Court held that it was clearly arguable that BGI was personal data under section 1(1)(a) of the DPA; however it acknowledged that the issues are not clear-cut or straightforward. The court concluded that there was a serious issue to be tried which merits a trial and that these issues were best left to be determined after the facts have been found at trial.
IS THERE A REAL AND SUBSTANTIAL CAUSE OF ACTION?
The secret blanket tracing and collation of information by Google merit a trial and the Court rejected arguments that the claim should not be allowed on the grounds that the alleged incursions into the claimants’ private lives did not cross the Article 8 threshold of seriousness and that any award of damages would be modest, relative to the costs of litigation.
The judgment allows the claimants to serve proceedings against Google outside the UK and there will be a full trial and substantive hearing to follow in England, unless Google appeals this decision.
This may open the door for a substantial class action against Google and it is likely that the courts will now see many more cases brought for breaches of the DPA, given that the requirement for pecuniary loss has been removed.