The Supreme Court has granted Google permission to appeal the Court of Appeal decision in Google Inc. v Vidal-Hall . The Court of Appeal held that individuals can bring compensation claims for breaches of their data protection rights even where they have suffered no pecuniary loss.
This will be a very important ruling because the Court of Appeal decision opened the door to Group litigation by aggrieved individuals who had merely suffered distress. Previously the law had been understood to require some form of actual loss before they could do so. If the Supreme Court upholds the Court of Appeal ruling then this will add to the pressure on organisations to take data protection law more seriously. Though each individual claim might be relatively small (a few thousand pounds at most), where a large group of individuals is affected by issues such as failures to keep personal data secure from hackers, it really makes such claims economically viable for the first time. Group litigation may well “follow on” from findings by the regulator, the Information Commissioner, that an organisation has breached the Data Protection Act. The consequent compensation claims may dwarf the regulatory fines, currently set at a maximum of £500,000.
For some time, the English courts have been moving towards liberalising damages claims in relation to breaches of data protection laws. The Court of Appeal’s decision inVidal-Hall marked a watershed moment in that process. Controversially, the court decided not to follow its own prior ruling. Perhaps more controversially it re-wrote the underlying statutory provision by declaring that its restriction on compensation was incompatible with European law as, in the court’s view, it left individuals without an effective remedy.
Final determination of this point by the Supreme Court is desirable. Whilst stronger data protection laws might be welcomed by privacy advocates, this may have unintended consequences. For example, organisations might be less willing to share information about data breaches with regulators and those affected if they know that this might also lead to Group litigation claims. The reluctance to share intelligence on data breaches between organisations is currently cited as one of the major problems in adopting a collective defence to cyber-threats.
The Supreme Court should hear the appeal in the next six to twelve months.