The UK’s Supreme Court has rejected a claim that sought billions of pounds in damages from Google over alleged illegal tracking of millions of iPhones.
The judge ruled that the claimant had failed to demonstrate that the data collection had caused individuals harm.
However, he did not rule out future mass-action lawsuits if damages could be calculated.
The decision will have ramifications for other mass-action lawsuits.
Lord Leggatt stated in his decision that a key issue was that “the claim has been framed in order to try to bring it as a representative action” for many people.
“The claimant seeks damages… for each individual member of the represented class without attempting to show that any wrongful use of personal data relating to that individual was made by Google or that the individual suffered any material damage or distress as a result of a breach,” it stated.
“A claim for damages cannot be successful unless these matters are proven.”
However, he added that if the claimant pursued the case as an individual rather than as a class action, the case had a “real chance of success.”
The Google case, brought by Richard Lloyd, former director of consumer rights group Which?, alleged that between 2011 and 2012, Google cookies collected data on health, race, ethnicity, sexuality, and finance via Apple’s Safari web browser, even when users had selected a “do not track” privacy setting.
He sought restitution for the 4.4 million affected users. While each iPhone owner would have received a small payment, Google’s fine could have been in the billions.
“We are bitterly disappointed that the Supreme Court has failed to do enough to protect the public from Google and other big tech firms that violate the law,” Mr Lloyd said.
“Although the court once acknowledged that our action is the only practical way for millions of British people to obtain fair redress, they’ve slammed the door on this case by ruling that everyone affected must go to court individually.”
He urged the government to intervene to make it easier for groups of consumers to take action in response to data breaches.
“There must be a way for people to seek redress against massive data breaches,” said Jim Killock, executive director of the Open Rights Group.
Currently, the legal fees would make it “completely unreasonable” for individuals to take on tech behemoths, he added.
The lengthy case began in 2017 and proceeded through the High Court and Court of Appeal before being escalated to the UK Supreme Court.
If it had been successful, it could have paved the way for many more mass actions against tech companies for data breaches.
Such actions currently necessitate people opting in, which can be a time-consuming process.
The Lloyd v Google case attempted to set a precedent for opt-out cases, meaning one representative could bring action on behalf of millions.
TikTok is facing a similar case, brought by former Children’s Commissioner Anne Longfield, which alleges that the video-sharing app used children’s data without informed consent. And Facebook is involved in a lawsuit alleging that users’ data was improperly handled.
“This decision ensures the floodgates remain firmly closed to data privacy class actions in England and Wales, much to the relief of big tech, but it also leaves consumers without a viable route to compensation for breaches of their privacy rights,” Emily Cox, head of media disputes at law firm Stewarts, told the BBC.
Future cases, according to Nick McAleenan, a partner at JMW Solicitors, will need to balance “the legal rights and interests of ordinary consumers, and those of the large organisations that process all of our personal data.”
And, according to techUK, the UK’s trade association for technology firms, if the decision had gone the other way, it would “have opened the door for speculative and vexatious claims to be made against data controllers.”
“We believe it is correct that any action must first seek to determine whether damage has been caused,” it continued.
Google has lost a separate appeal against a €2.4 billion fine imposed in 2017 for causing price comparison websites to compete unfairly.
The Luxembourg General Court dismissed Google’s legal challenge and upheld the fine.
The judgement was welcomed by Shivaun Raff, CEO of Foundem, the lead complainant in that case, but he added, “It does not undo the considerable consumer and anti-competitive harm caused by more than a decade of Google’s insidious search manipulation practises.”