Google Inc v Vidal-Hall & Ors

Factual and Procedural Background

The claimants are three individuals who used Apple computers and accessed the internet via the Apple Safari browser between summer 2011 and February 2012. The case concerns the defendant's collection of private information about the claimants' internet usage through their Safari browsers without their knowledge or consent by employing a "Safari workaround" involving cookies. This allowed the defendant to recognize browsers sending browser-generated information ("BGI") and aggregate this data to offer targeted advertising services through its DoubleClick advertising network. The claimants allege this tracking and collation of private information was contrary to the defendant's public statements that such tracking would not occur without express user consent.

Proceedings were commenced on 12 June 2013. The claimants pleaded causes of action including misuse of private information, breach of confidence, and breach of the Data Protection Act 1998 ("DPA"). They claimed damages for anxiety and distress but not for pecuniary loss. The claimants also sought aggravated damages, contending the defendant knew or ought to have known of the Safari workaround but failed to act.

The claimants, domiciled in England, sought and obtained permission under CPR 6.36 and Practice Direction 6B to serve proceedings on the defendant, a Delaware-registered corporation with its principal place of business in California, out of the jurisdiction. The defendant applied to set aside this permission, challenging jurisdiction and the appropriateness of the English forum.

The judge dismissed the defendant's application to set aside permission to serve out of jurisdiction for the claims of misuse of private information and under the DPA, declaring the court had jurisdiction to try those claims. However, the court declined jurisdiction over claims for injunction and breach of confidence, setting aside those claims. The defendant appealed the rulings concerning misuse of private information as a tort and the interpretation of "damage" under section 13 of the DPA.

Legal Issues Presented

1. Whether misuse of private information constitutes a tort for the purposes of service of proceedings out of the jurisdiction under CPR PD 6B para 3.1(9).
2. The meaning of "damage" in section 13 of the Data Protection Act 1998, specifically whether compensation may be claimed without pecuniary loss.
3. Whether there is a serious issue to be tried that the browser-generated information (BGI) qualifies as personal data under the DPA.
4. Whether there is a real and substantial cause of action in the claims for misuse of private information and under the DPA.

Arguments of the Parties

Appellant's Arguments

• The defendant contended that misuse of private information is not a tort but rather a breach of confidence, and thus the claims do not fall within the tort gateway for service out of jurisdiction.
• They argued that the meaning of "damage" in section 13 of the DPA is limited to pecuniary loss, so compensation for distress without pecuniary loss is not recoverable.
• The defendant relied on binding authority, including Douglas v Hello! (No 3) for the tort issue and Johnson v Medical Defence Union for the interpretation of "damage" under the DPA.
• They argued the BGI was not personal data as it did not directly identify individuals, and that the defendant's segregation of BGI from other identifying data prevented it from being personal data under section 1(1)(b) of the DPA.
• The defendant submitted that the claims lacked sufficient seriousness and were disproportionate relative to the costs of litigation, constituting an abuse of process.

Appellee's Arguments

• The claimants maintained that misuse of private information should be recognized as a tort, distinct from breach of confidence, for the purposes of service out of jurisdiction.
• They argued that "damage" in section 13 of the DPA should be interpreted compatibly with article 23 of the EU Data Protection Directive to include non-pecuniary loss such as distress.
• The claimants contended that the BGI constituted personal data, either directly or indirectly, as it singled out individuals and could be linked with other information in the defendant's possession.
• They submitted that the claims raise serious issues of law and fact, including the defendant's secret tracking and the distress caused, justifying the continuation of the claims.
• The Information Commissioner intervened supporting the view that compensation for distress should be available and that BGI could constitute personal data.

Table of Precedents Cited

Court's Reasoning and Analysis

The court began by addressing whether misuse of private information is a tort for the purposes of service out of jurisdiction. It acknowledged the historical classification of breach of confidence as an equitable claim and misuse of private information as an evolving cause of action incorporating privacy rights under article 8 of the European Convention on Human Rights (ECHR). The court recognized that misuse of private information and breach of confidence protect distinct interests and that misuse of private information has been referred to as a tort in various authorities. It found the reasoning in Douglas v Hello! (No 3) on this point to be obiter and not binding, and considered the binding authority in Kitechnology only applied to breach of confidence, not misuse of private information. The court concluded that misuse of private information should be classified as a tort for the purposes of CPR PD 6B, facilitating service out of the jurisdiction.

Regarding the meaning of "damage" in section 13 of the DPA, the court examined the statutory text, the Directive 95/46/EC (the Directive), and relevant EU jurisprudence. It found that the literal wording of section 13(2) restricts compensation for distress to limited circumstances, inconsistent with the broader meaning of "damage" in article 23 of the Directive, which includes non-pecuniary loss. The court held that section 13(2) could not be interpreted compatibly with article 23 to allow compensation for distress without pecuniary loss. However, invoking article 47 of the EU Charter of Fundamental Rights, which guarantees the right to an effective remedy, the court concluded it must disapply section 13(2) insofar as it conflicts with EU law, thereby permitting compensation for distress under section 13(1) generally.

The court then considered whether there was a serious issue to be tried that the BGI constitutes personal data under the DPA. It found that the claimants' case was clearly arguable, supported by EU and domestic authority, the Article 29 Working Party opinions, and the nature of the data collected, which singles out individuals and may be linked to other identifying data. The defendant's arguments that the data was anonymous or segregated raised substantial issues of law and fact to be resolved at trial.

Finally, the court addressed whether the claims constituted a real and substantial cause of action justifying service out of jurisdiction. It rejected the defendant's contention that the claims were disproportionate or an abuse of process, recognizing the seriousness of the privacy intrusion and the anxiety caused. Although damages might be modest, the claims raised important issues of principle meriting trial.

Holding and Implications

The court DISMISSED THE APPEAL.

The court held that misuse of private information is a tort for the purposes of service of proceedings out of the jurisdiction. It further held that compensation under section 13 of the Data Protection Act 1998 may be awarded for distress without pecuniary loss by disapplying section 13(2) where it conflicts with EU law, ensuring an effective remedy. The court found there were serious issues to be tried that the browser-generated information constituted personal data and that the claims raised a real and substantial cause of action. The decision permits the claimants to proceed with their claims in England against the foreign defendant. No new precedent beyond the immediate context was established, and the court noted that broader implications such as remedies and limitation periods remain to be considered in future cases.