Factual and Procedural Background
The Plaintiff applies for permission to serve proceedings on Company A, a Delaware corporation with its principal place of business outside the jurisdiction, due to alleged breaches of duty under section 4(4) of the Data Protection Act 1998 ("DPA"). The claim concerns Company A's conduct during 2011-2012, specifically its secret tracking of internet activity of users of a particular internet browser on mobile devices, using a method referred to as "the Safari Workaround". The Plaintiff sues not only on his own behalf but also in a representative capacity for a class of residents of England and Wales ("the Class") affected by these actions. The claim seeks damages or compensation for infringement of data protection rights without alleging financial loss or distress, proposing a uniform tariff award or alternatively damages reflecting the value of the data's use by Company A.
The Class is substantial, originally estimated at 5.4 million individuals, later refined to approximately 4.4 million. Company A estimates potential liability could range between 1 and 3 billion in damages. The claim focuses on whether the pleaded facts disclose a basis for compensation under the DPA and whether the claim should continue as a representative action.
Prior related litigation includes a civil claim brought by other individuals in this jurisdiction concerning the same "Safari Workaround", which resulted in permission to serve proceedings outside the jurisdiction being granted, with some claims dismissed and others allowed. Regulatory actions in the United States led to significant financial penalties and undertakings by Company A, but no regulatory action occurred in this jurisdiction.
The Plaintiff is experienced in consumer protection and is supported by an advisory committee and litigation funding. A Notice and Administration Plan for managing the Class claims has been devised. The court procedure for service outside the jurisdiction was adapted by agreement to allow a more efficient process in this case.
Legal Issues Presented
- Whether the pleaded facts disclose any basis for claiming compensation under the Data Protection Act 1998.
- Whether the Court should or would permit the claim to continue as a representative action under CPR 19.6.
Arguments of the Parties
Plaintiff's Arguments
- The Plaintiff asserts that Company A acted as a data controller and breached statutory duties under DPA s 4(4) by secretly tracking and using personal data without consent.
- The claim is advanced on a uniform per capita basis for compensation reflecting the infringement of rights, commission of the wrong, and loss of control over personal data.
- Alternatively, damages are sought on a hypothetical release basis, representing what claimants could reasonably have charged for releasing Company A from the breached duties.
- The Plaintiff contends that damages can be awarded even absent material loss or distress, relying on authorities permitting compensation for infringement of rights and loss of control over personal information.
- The Plaintiff argues the representative action procedure is appropriate to manage the large class and that the class definition is clear and workable.
Defendant's Arguments
- Company A disputes that the claim discloses a basis for compensation under the DPA absent proof of damage as defined by statute and case law.
- It argues that the claimants do not all have the "same interest" required for a representative action, given the varying nature and extent of any alleged damage.
- The Defendant submits that the class includes many individuals who have not suffered compensatable damage and that the proposed uniform tariff is artificial and unprincipled.
- Company A maintains the claim is a contrived attempt to fit a novel opt-out class action into the representative action framework, which Parliament has not sanctioned.
- The Defendant also contends that practical difficulties in identifying and verifying class members make the representative action unworkable and disproportionate.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Vidal-Hall v Google Inc [2014] EWHC 13 (QB), [2015] EWCA Civ 311 |
Establishes that a claim for damages for breach of DPA s 4(4) is a claim in tort and that distress can constitute damage under s 13. |
Used to confirm the tortious nature of the claim and that non-material damage such as distress can be compensatable, though the present claim differs as it alleges no distress. |
| Johnson v Medical Defence Union Ltd (No 2) [2007] EWCA Civ 262 |
Earlier interpretation limiting "damage" under s 13 to material or financial loss. |
Discussed and distinguished as superseded by later decisions recognizing non-material damage. |
| Gulati v MGN Ltd [2015] EWHC 1482 (Ch), [2017] QB 149 |
Damages can be awarded for misuse of private information for infringement of the right, not limited to distress. |
Relied upon by Plaintiff for awarding damages for loss of control over personal data; Court distinguished the factual context and did not accept it as universally applicable. |
| R (Lumba) v Secretary of State for the Home Department [2012] 1 AC 245 |
Prohibition on vindicatory damages without loss. |
Applied to reject damages awarded merely to mark commission of wrong without compensatable loss. |
| Murray v Express Newspapers [2007] EWHC 1908 (Ch) |
Rejected awarding damages under DPA based on market value of data without proof of damage or distress. |
Applied to deny the alternative user damages claim in the present case. |
| One Step (Support) Ltd v Morris-Garner [2018] UKSC 20 |
Conditions for awarding damages based on economic value of breached rights. |
Considered in relation to hypothetical release fee argument; Court found such awards artificial and inapplicable here. |
| Emerald Supplies Ltd v British Airways plc [2011] Ch 345 |
Requirement that representative parties have the "same interest" in the claim. |
Applied strictly to reject representative action where claimants have differing levels or types of damage and potential defences. |
| Millharbour Management Ltd v Weston Homes Ltd [2011] 3 All ER 1027 |
Clarifies the "same interest" requirement for representative actions. |
Used to emphasize the fundamental and non-bendable nature of this requirement. |
| Jameel (Yousef) v Dow Jones & Co Inc [2005] EWCA Civ 75 |
Discretion to strike out claims on proportionality grounds. |
Referenced in context of proportionality and court resources in managing the case. |
| Sullivan v Bristol Film Studios Ltd [2012] EWCA Civ 570 |
Hesitancy to strike out claims unless proportionate alternatives fail. |
Considered in relation to the Court's approach to case management and proportionality. |
Court's Reasoning and Analysis
The Court began by confirming that the claim is a tortious claim under the DPA and that permission to serve proceedings outside the jurisdiction requires that the claim has a real prospect of success, falls within a jurisdictional gateway, and that England is the appropriate forum.
The Court accepted that the claim falls within the tort gateway and that England is the natural forum given the residence of the Class members and the locus of the alleged acts.
However, the central legal question was whether the claim discloses a basis for compensation under the DPA. The Court conducted a detailed statutory construction analysis of section 13(1) of the DPA, concluding that compensation requires proof of damage resulting from the contravention. The contravention itself does not constitute damage.
The Court noted that while the Court of Appeal in Vidal-Hall recognized compensation for distress as damage, the present claim alleges no distress or material loss. The pleaded categories of damage—loss of control, commission of the wrong, and infringement of rights—were found to be circular or insufficient to constitute damage under the statute.
The Court considered domestic authorities permitting damages for misuse of private information even absent distress, but emphasized that such awards depend on significant impact on the claimant's rights, which the present claim does not allege. The Court rejected the argument that compensation can be awarded merely for loss of control over data without evidence of harm or impact.
Regarding the alternative claim for damages based on a hypothetical release fee, the Court found this approach artificial and unsupported by authority in the context of the DPA. It noted practical and conceptual difficulties in applying a uniform tariff or hypothetical fee across a diverse class.
On the issue of representative proceedings, the Court held that the requirement for the representative party and the class to have the "same interest" is fundamental and non-negotiable. Given the variation in alleged damage and potential defences, the Class as defined does not satisfy this requirement.
The Court further found that the Class could not be reliably identified or verified in practice, creating significant obstacles to administering a representative action.
Finally, the Court exercised its discretion against allowing the representative action to continue, citing proportionality, lack of interest shown by the Class members, and the risk of officious litigation consuming disproportionate resources.
Holding and Implications
PERMISSION TO SERVE PROCEEDINGS OUTSIDE THE JURISDICTION IS REFUSED.
The Court held that the claim does not disclose a reasonable basis for compensation under the Data Protection Act 1998, as the pleaded facts do not establish recoverable damage. Alternatively, the claim cannot continue as a representative action because the Class members do not have the same interest, and the Class cannot be reliably identified. The Court also exercised its discretion to refuse continuation of the representative action on grounds of proportionality and practicality.
The direct effect is that the Plaintiff's application to serve the foreign Defendant is denied and the representative claim cannot proceed in its current form. No new legal precedent is established beyond the application of existing principles to the facts of this case.