WHAT constitutes “damage” for data protection purposes? This question came before the Supreme Court in Lloyd v Google LLC [2021] UKSC 50.

The claimant, Mr. Lloyd, sought permission to serve proceedings on Google outside the jurisdiction, alleging breach of Google's duties as a data controller under section 4(4) of the Data Protection Act 1998 (“DPA 1998”). The claim alleged that for several months between late 2011 and early 2012, Google used Apple's “Safari” Internet browser to track secretly the Internet activity of millions of Apple iPhone users (in what is known as “the Safari workaround”) before collating and selling the data. The Safari workaround has already been the subject of litigation (see Vidal-Hall and ors v Google Inc [2015] EWCA Civ 311), but a novel feature of Lloyd was that the claimant did not seek damages just for his own loss but instead claimed to represent – and recover damages for – everyone resident in England and Wales who owned an iPhone at the relevant time and whose data were obtained by Google without their consent. The size of class was estimated to be 4.4 million people.

This is where the claimant fell into difficulties. Had Mr. Lloyd simply claimed damages on his own behalf it is likely he would have been successful so long as material damage (pecuniary loss, as well as physical and psychiatric harm) or distress caused by the breach of duty could be shown (as decided in Vidal-Hall v Google). However, Mr. Lloyd's claim was financially backed by a commercial litigation funder, and there would have been little commercial value to the funder in Mr. Lloyd pursuing this more modest line. Instead, then, a representative action. A long-standing rule of civil procedure, now CPR rule 19.6, allows a claim to be brought by someone as a representative of other persons who have the “same interest” in the claim. Section 13 of the DPA 1998 requires “damage” to be suffered by an individual seeking compensation for a data controller's breach of duty. “Damage” under section 13 clearly encompasses material damage, and following Vidal-Hall v Google, also includes distress. Due the representative nature of the claim, proof of material damage or distress caused to each individual member of the class could not be evidenced. However, the claimant argued that such an individualised approach to “damage” was unnecessary and instead a “uniform per capita” sum could be awarded to each member of the class on the basis that contravention of the DPA 1998 itself, otherwise framed as “loss of control” of personal data, amounts to compensable “damage” under section 13. In making this argument the claimant drew an analogy with the tort of misuse of private information, for which substantive damages may be awarded for breach of the right itself (see Gulati v MGN Ltd. [2015] EWHC 1482 (Ch) as affirmed by the Court of Appeal [2015] EWCA Civ 1291).

A unanimous Supreme Court, with judgment given by Lord Leggatt, rejected the claimant's argument and refused the application. As a matter of statutory interpretation, the court reasoned, the wording of section 13 “draws a distinction between ‘damage’ suffered by an individual and a ‘contravention’ of a requirement of the Act by the data controller” (at [115]). The fatal flaw of the claimant's logic therefore was “on the claimant's case the damage and the contravention are one and the same” (at [115]). Furthermore, the Supreme Court also rejected the premise that the remedies regime of the DPA 1998 ought to mirror that of the tort of misuse of private information. Whilst both the legislation and domestic tort have a common source in Article 8 of the European Convention on Human Rights (the right to privacy), the Convention does not require the legal systems of Member States to award compensation for breach of the right to privacy where no material damage or distress has been caused (at [126]). Moreover, the Supreme Court highlighted differences between the DPA 1998 and the common law tort, such as the fault-based nature of the DPA 1998 compared to the strict liability of the tort, which made analogising from one to the other inappropriate (at [130]–[134]). Whereas loss of control of personal data was rejected as “damage” for the purposes of the DPA 1998, the Supreme Court did not doubt the correctness of Gulati v MGN Ltd. in awarding damages for loss of control of information in the context of the privacy tort. However, equally, when engaging with Gulati, the court did not offer a convincing normative reason as to why substantive “compensation for the commission of the wrong itself” (at [130]) is justified for breach of privacy when such damages have been rejected in other contexts, such as false imprisonment (as in R. (Lumba) v Secretary of State for the Home Department [2011] UKSC 12).

An interesting feature of the Lloyd litigation has been to illuminate fractures in the different judicial conceptions of damage or loss in the law. Similar to the view of Supreme Court, the trial judge, Warby J., had noted that “the pleaded case appears circular: it asserts that the commission of the tort has caused compensatable damage, consisting of the commission of the tort … To say simply that A has ‘lost control’ over his or her personal data is not obviously different from saying that B has acquired and used the data without A’s consent” ([2018] EWHC 2599 (Q.B.), at [58]).

Implicit in this view is an endorsement of the concept of “loss” posited by scholars such as James Edelman (see e.g. J. Edelman, “The Meaning of Loss and Enrichment” in R. Chambers, C. Mitchell and J. Penner (eds.), The Philosophical Foundations of the Law of Unjust Enrichment (Oxford 2009), 211, 212–13) and Robert Stevens (e.g. R. Stevens, “Damages for Wrongdoing in Absence of Loss” in J.N.E. Varuhas and N.A. Moreham (eds.), Remedies for Breach of Privacy (Oxford 2018), 97, 98–99): that “damage” or “loss” is an adverse consequence of wrongdoing, namely one which leaves a claimant factually worse off than they would have been had the wrong not occurred. On this view, taking the facts of Lloyd, financial loss, physical or psychiatric harm or distress caused by a data controller's breach suffice for “damage” since each of these is an adverse consequence of the wrongdoing factually experienced in the real world. However, loss of control of personal data is not an adverse consequence of wrongdoing – it is the wrongdoing itself, and therefore cannot amount to “damage”.

By contrast, the Court of Appeal ([2019] EWCA Civ 1599, noted [2020] C.L.J. 417) accepted that loss of control of personal data could constitute “damage” under section 13. Sir Geoffrey Vos, giving the unanimous judgment of the court, did not accept that the claimant's case for damage was circular. Rather, he reasoned (at [46]–[47]) that an individual's data has economic value – for example, it can be exchanged in return for free Wi-Fi at an airport – and therefore consent to use of data also has economic value. As such, the court concluded that loss of control of personal data also has economic value and can, therefore, constitute “damage”. The Court of Appeal thereby adopted a broader idea of loss or damage than the High Court and Supreme Court; it cannot be suggested that each individual member of the class would have sold their data and could thereby prove on a counterfactual basis that they were worse off for having lost the chance to realise its value. Instead, the Court of Appeal's conception of loss more closely resembles either damages for a fictive or hypothetical bargain – bringing compensation for “damage” under section 13 closer to negotiating damages (to use the terminology of the Supreme Court in Morris-Garner v One Step (Support) Ltd. [2018] UKSC 20) – or for “normative” loss (to borrow Jason Varuhas’ language used to describe damage “that is constructed by and only exists on a plane of law” as opposed to loss of a factual kind : see J.N.E. Varuhas, “Varieties of Damages for Breach of Privacy” in Varuhas and Moreham (eds.), Remedies for Breach, 55, 57).

By way of final observation, the court also rejected the alternative formulation of Mr. Lloyd's claim that negotiating damages could be recovered under section 13. As explained by Lord Leggatt, “compensation can only be awarded under section 13 of the DPA 1998 for material damage or distress caused by an infringement of the claimant's right” (at [143]). This affirms the view held by Patten J. in Murray v Express Newspapers plc ([2007] EWHC 1908 (Ch)) that negotiating damages are inappropriate in the data protection context. However, the Supreme Court suggested, obiter, that a claim for the tort of misuse of private information “would naturally lend itself to an award of user damages” (at [141]). As Lord Reed set out in Morris-Garner v One Step, negotiating damages may be awarded for wrongful interference of an asset where such interference prevents the claimant from exercising a valuable right to control its use (One Step, at [95(1)]. One method of quantifying the damages in such case is by way of a hypothetical release fee for the obligation in question (One Step, at [95(4)]). Once again, we see a divergence in the privacy and data protection remedies regimes.