Factual and Procedural Background
The Plaintiff, financially supported by a commercial litigation funder, issued proceedings against Company A (a Delaware-incorporated technology company) for alleged breaches of its statutory duties as a data controller under section 4(4) of the Data Protection Act 1998 (“DPA 1998”). The claim concerns the period between August 2011 and February 2012, during which Company A is said to have employed a “Safari workaround” that secretly placed third-party cookies on Apple iPhones, enabling the covert tracking of users’ browsing activity for advertising purposes.
Uniquely, the Plaintiff sought to act as a representative under Civil Procedure Rules (“CPR”) 19.6 on behalf of more than four million iPhone users resident in England and Wales, claiming uniform damages (suggested at £750 each) for “loss of control” of personal data. Because Company A is domiciled abroad, permission to serve out of the jurisdiction was required.
Judge Warby in the High Court refused permission, finding the claim had no real prospect of success. The Court of Appeal reversed that decision and granted permission. Company A appealed to the Supreme Court, which also received submissions from the Information Commissioner and several interveners.
Legal Issues Presented
- Whether compensation under section 13 DPA 1998 can be awarded for mere “loss of control” of personal data without proof of individual financial loss or distress.
- Whether, in the circumstances, the claim is suitable to proceed as a CPR 19.6 representative action seeking uniform, per-capita damages for every class member.
- Consequently, whether the claim disclosed a “real prospect of success” sufficient to justify service out of the jurisdiction on Company A.
Arguments of the Parties
Plaintiff’s Arguments
- Section 13 DPA 1998 should be interpreted (in light of EU privacy principles) to permit damages for the mere interference with the right to control personal data, even absent financial loss or distress.
- All class members share the “same interest”; individual assessment is unnecessary because a uniform “minimum harm” was suffered by every iPhone user whose data were taken.
- User-damages (a reasonable hypothetical licence fee) can be assessed on a uniform basis.
- The representative mechanism is the only practical route to collective redress; without it, affected individuals have no realistic remedy.
Company A’s Arguments
- Section 13 requires proof that each individual suffered material damage or distress; “loss of control” alone is insufficient.
- Even if liability were arguable, damages would inevitably require individualised evidence (extent of tracking, sensitivity of data, subjective impact), rendering CPR 19.6 inappropriate.
- User-damages principles do not apply to statutory data-protection claims.
- Accordingly, the claim has no real prospect of success and permission to serve out should be refused.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Vidal-Hall v Company A [2016] QB 1003 |
Section 13 DPA permits damages for distress; analysis of “browser workaround” facts |
Distinguished: distress recoverable, but does not justify uniform loss-of-control damages |
| Duke of Bedford v Ellis [1901] AC 1 |
Historic scope of representative actions (“same interest” requirement) |
Affirmed flexibility but stressed absence of conflicts is essential |
| Markt v Knight Steamship [1910] 2 KB 1021 |
Limits of representative actions where individual damages vary |
Used to illustrate need for individual proof when damages differ |
| Emerald Supplies v British Airways [2011] Ch 345 |
Class definition must not depend on outcome; conflicts within class bar representation |
Analogous flaws highlighted in Plaintiff’s class definition |
| Merricks v Mastercard [2021] Bus LR 25 |
Aggregate damages permissible only under specific competition-law regime |
Contrasted with absence of such statutory power in data-protection claims |
| Gulati v MGN Ltd [2017] QB 149 |
Damages for misuse of private information may include loss of control |
Held not analogous to statutory DPA regime due to material differences |
| Campbell v MGN Ltd [2004] 2 AC 457 |
Identification of privacy as a protected value in English law |
Cited in comparative discussion but not determinative of statutory interpretation |
| OneStep (Support) Ltd v Morris-Garner [2019] AC 649 |
Principles governing user-damages |
Used to reject availability of user-damages under DPA 1998 |
| Halford v United Kingdom (1997) 24 EHRR 523 |
Article 8 ECHR and “just satisfaction” awards |
Court found Convention jurisprudence does not mandate statutory damages without proof of loss |
| Carnie v Esanda Finance (1995) 127 ALR 76 (High Ct Australia) |
Flexible, purposive approach to representative procedure abroad |
Considered persuasive but did not override domestic statutory limits |
Court's Reasoning and Analysis
1. Interpretation of Section 13 DPA 1998. The Court held that Parliament deliberately limited compensation to individuals who “suffer damage” (i.e. material loss) or distress as a result of a breach. Reading “loss of control” into “damage” contradicts the statute’s text and structure, particularly when contrasted with section 14, and would require impermissible judicial legislation.
2. EU Law Considerations. While Vidal-Hall disapplied section 13(2) to allow recovery for distress, EU law does not compel compensation for non-material, non-distress infringements. The principles of equivalence and effectiveness were not infringed.
3. Misuse-of-Private-Information Analogy Rejected. The privacy tort involves deliberate wrongdoing and strict liability, whereas DPA claims may rest on lack of reasonable care; therefore, Gulati does not translate to statutory claims.
4. User-Damages Argument. User-damages compensate for wrongful exploitation of valuable rights. They are unavailable here because section 13 requires proof of damage/distress and, in any event, the Plaintiff disavowed evidence of actual use of each individual’s data.
5. Representative Procedure. Even if “loss-of-control” were actionable, the claim would fail the “same interest” test: damages inevitably vary with each user’s browsing, duration of tracking, and sensitivity of data. The Plaintiff’s “lowest common denominator” strategy leaves no non-trivial harm provable for every class member.
6. Prospect of Success. Without individualised evidence of misuse and consequent damage/distress, the pleaded case is “doomed to fail.” Accordingly, permission to serve out must be refused.
Holding and Implications
APPEAL ALLOWED. The order of Judge Warby refusing permission to serve Company A outside the jurisdiction is restored.
Implications: The decision closes the door on using CPR 19.6 representative actions to pursue uniform “loss-of-control” damages under the DPA 1998 (and, by analogy, similar provisions) without proof of individual harm. Collective redress for data-protection breaches will generally require either: (a) statutory opt-out regimes (e.g., competition law), or (b) bifurcated processes in which liability is determined representatively and damages are later assessed individually. The ruling therefore limits the scope for US-style class actions in UK data-privacy litigation until Parliament enacts a bespoke framework.