The background
The case of Google v Vidal-Hall and others (the "Claimants") centred around a dispute over the user information related to internet usage (Browser Generated Information) collected by Google through cookies via the Apple Safari browser, without the Claimants’ knowledge and consent. The information was then offered to advertisers who used it to target advertisements which were then displayed on the Claimants’ computer screens and were, or might have been, visible to others.
None of the Claimants suffered any financial loss or other material damage; claims were for compensation for distress alone.
The issues
The Court of Appeal had to decide whether:
- the cause for action for misuse of private information is a tort
- there could be a claim for compensation for distress alone (ie without any pecuniary loss or other material damage) under section 13(2) of the Data Protection Act 1998 (DPA).
In its decision, the Court of Appeal ruled that misuse of private information constitutes a tort.
Section 13(2) of the DPA is intended to transpose Article 23 of the EU Data Protection Directive (Directive 95/46/EC) (the "Directive") into UK law. Article 23 of the Directive mandates that data subjects be entitled to receive compensation from a data controller for "…damage as a result of an unlawful processing operation or any act incompatible with the natural provisions adopted pursuant to this Directive...". Section 13(2) in contrast provides that damages can only be claimed for distress when the distress is accompanied by economic loss.
The Court of Appeal found that there was no distinction between pecuniary and non-pecuniary loss under Article 23 of the Directive and that it was not possible to interpret section 13(2) of the DPA in a way that was compatible with Article 23. The Court of Appeal held that section 13(2) of the DPA should be disapplied on the grounds that it conflicts with Articles 7 and 8 of the EU Charter of Fundamental Rights (the "Charter") which guarantees the right to privacy and the protection of personal data respectively.
The consequence of the Court of Appeal’s decision is that data subjects may bring claims for compensation against a data controller for distress caused where their data is compromised as a result of a data breach; such claim need not be accompanied by a claim for pecuniary loss as a result of such contravention.
Permission to appeal
In July 2015, Google was granted permission to appeal by the Supreme Court on the grounds of:
- whether the Court of Appeal was right to hold that section 13(2) of the DPA was incompatible with Article 23 of the Directive
- whether the Court of Appeal was right to disapply section 13(2) of the DPA on the grounds that it conflicts with the rights guaranteed by Articles 7 and 8 of the Charter.
Permission to appeal the Court of Appeal’s decision that misuse of private information constituted a tort was rejected.
However, Google and the Claimants have now reached a settlement agreement and as such the case will not be proceeding to the Supreme Court. As a result, the Court of Appeal’s decision still stands and data subjects may well take this opportunity to bring claims under the DPA relying only on distress.
Commentary
It is unlikely that we have heard the last of this issue in the courts given that the Supreme Court did allow the appeal on the grounds stated above. The disapplication of primary UK legislation on the basis of a conflict with the Charter raises interesting issues in the context of Brexit. Once Brexit (whatever that may look like) takes place cases such as Vidal-Hall, which have taken the English courts into the muddy waters of disapplying UK legislation which conflicts with their interpretation of open-textured Charter rights, may well be the first to be overturned.