A Court of Appeal ruling in an application to serve out of the jurisdiction makes a number of ground breaking decisions.
What's the issue?
s13(2) of the Data Protection Act 1998 (DPA) states that a claim for distress caused by a data controller's breach of the DPA, can only be made where the individual also suffers damage (or where the processing relates to a special purpose). What is meant by "damage" in this context has long been an issue in the courts. It has usually been taken to mean pecuniary loss which suggests that claims cannot be made unless some financial loss has been experienced. This has led to some rather convoluted judgments which have, for example, found nominal damages of £1 in order to enable the making of further awards for distress.
What's the development?
In an application to serve out of the jurisdiction, the Court of Appeal has considered not only s13(2) of the DPA but a number of other important issues holding:
- misuse of private information is a tort despite its origins in the equitable claim for breach of confidence;
- s13(2) of the DPA is disapplied due to its conflict with rights under the EU Charter of Fundamental Rights (Charter) so claims can be made for distress alone;
- there is a strong case to answer that browser generated information (BGI) is personal data, even when it does not directly identify an individual; and
- there is a serious issue to be tried in this particular case in relation to tracking and collection of personal information without consent, despite the fact that any award of damages is likely to be relatively low.
What does this mean for you?
In theory at least, this judgment opens the gate for a far greater number of claims from individuals now that the requirement to have suffered damage has been ruled out. Given the cost of bringing proceedings and the likely low awards in all but the most extreme cases, it is not clear at present how much change this ruling will bring in practice. The risk for businesses is that they may be subject to more group claims which could lead to considerable expense.
The Court of Appeal decision also confirms that claimants can serve out of the jurisdiction to bring UK proceedings against non-UK companies for misuse of private information.
The remaining issues discussed by the Court will not be decided until trial but this case will be fascinating to watch as and when it progresses.
The claims in this case have been brought by three individuals against Google Inc. for alleged misuse of their private information and breach of the Data Protection Act 1998. They relate to Google's bypassing of Apple Safari's web browser security settings to install tracking cookies without the knowledge or consent of the individuals. Google used the data collected, selling it to third parties who, in turn, used it to send targeted advertising. This Court of Appeal hearing was in relation to whether or not the claimants could proceed with their claims in the English courts against Google Inc. which is based in the USA.
Cause of action
Under the Civil Procedure Rules, claimants may serve outside the jurisdiction with the court's permission on a number of limited grounds, including a claim in tort for damages sustained within the jurisdiction or due to an act committed in the jurisdiction. The question for the Court to decide was whether misuse of private information could be classified as a tort for the purposes of service out of the jurisdiction, rather than as a claim for breach of confidence which, under established law, is not considered to be a tort. The Court of Appeal upheld the High Court's decision, re-iterating that it could not think of any satisfactory reason why misuse of private information should not be considered a tort for the purpose of serving outside the jurisdiction and emphasising that it was not creating a new cause of action but correctly classifying a pre-existing one.
The main authority for finding that the word "damage" in s13(2) DPA, means pecuniary loss, is the case of Johnson v Medical Defence Union  EWCA Civ 262 in which Buxton LJ said that damage was limited to pecuniary loss and could not refer to damage to a person's reputation. The Court of Appeal judges held that these comments were obiter dicta and not binding on them. The Court went on to consider other authorities for the interpretation of "damages". It concluded that Article 23 of the Data Protection Directive did not distinguish between pecuniary and non-pecuniary loss. It also held that there was no intrinsic linguistic reason to restrict the meaning to pecuniary loss.
Having determined that damage does not have to be pecuniary, the Court went on to consider whether or not it should be permissible to claim for distress alone without any sort of damage having been suffered (whether or not of a financial nature). The Court said to require damage in addition to distress, would undermine the objective of the Data Protection Directive which is to protect the right to privacy of individuals in relation to the processing of their personal data and would also be an irrational narrowing of the rights available under the Charter.
Under Articles 7 and 8 of the Charter, individuals have the right to the respect of their private and family life, home and communications and the right to protection of their personal data. Article 47 of the Charter guarantees an effective remedy in relation to breach of any Charter rights which, the Court decided, should include a remedy for distress suffered as a result of such breach, whether with or without damage.
The Court held that s13(2) DPA was incompatible with Article 23 of the Data Protection Directive but it was not able to disapply s13(2) DPA on the basis that it conflicted with rights under the Directive because Parliament had chosen to restrict the rights in the Directive by the introduction of s13(2). The Court was, however, able to disapply it on the grounds that it conflicted with rights under Article 47 of the Charter because Article 47 has direct horizontal effect (meaning Member States have no choice about how it is implemented).
The effect of the Court of Appeal's decision on this issue is that s13(2) DPA no longer applies. Claims for breach of rights under the DPA can be made for distress alone. With the DPA likely to be replaced by the EU General Data Protection Regulation in the not too distant future, the impact of this decision may not be long lasting but it is important for now. While the costs of bringing an action set against the likely awards for distress may mean we will not see a huge rush of claims, the widening of potential claims is nonetheless significant.
Is BGI personal data?
The Court of Appeal had to rule on whether there was a serious issue to be tried that BGI is personal data under the DPA. The Court considered both whether BGI is personal data within the meaning of the DPA when in isolation and, if not, whether it is personal data when combined with other identifying data held by the same data controller.
The Court did not have to decide whether BGI is, in fact, personal data but it held that, based on definitions in the Data Protection Directive, the Article 29 Working Party's Opinion on the concept of personal data and the ECJ's decision in Lindqvist C-101/0  QB 1014, it was clearly arguable that BGI on its own constitutes personal data.
The Court dismissed the defendant's argument that it had no intention of combining BGI data with other personal data (gmail account information) that it held in order to identify individuals as irrelevant. The issue was about the data controller's potential ability to identify individuals by combining the data sets in its control.
The Court concluded that the issues around BGI are not clear or straightforward and that there are serious issues to be tried in relation to both questions about BGI.
A real and substantial cause of action for misuse of private information under the DPA?
The defendants argued (citing Jameel v Dow Jones and Co  EWCA) that to give the claimants permission to serve outside the jurisdiction would be an abuse of process because the claimants would be unlikely to achieve anything of value yet the cost of bringing the action would be high. They argued that the claims did not meet the 'seriousness' requirement under Article 8 of the Charter and that any damages awarded would be negligible when set against the costs of litigation. The Court disagreed, holding it was clearly arguable that the Article 8 threshold was met. On the face of it, the claims raised "serious issues which merit a trial".