The UK Supreme Court has blocked a planned £3.2 billion class action against Google over data tracking from a decade ago.
The tech giant had been accused of secretly collecting personal data from 5.4 million UK-based iPhone users between 2011 and 2012, allegedly bypassing default privacy settings on Safari browsers and violating section 4 of the UK’s Data Protection Act 1998.
The collected data included race, political leanings, sexuality, social class, financial, shopping habits, as well as physical and mental health information, and was allegedly used for commercial purposes.
Led by former Which? consumer group director Richard Lloyd, the lawsuit aimed to make Google pay a compensation bill of £3.2 billion, an estimated £750 per person, in what was considered to be the UK’s first mass data protection lawsuit.
However, the Supreme Court, presided by Lord Robert Reed, today granted Google appeal in the lawsuit, ruling in favour of the tech giant, which was described by legal experts as “a significant win for Google”.
A Google spokesperson told IT Pro that the claim “was related to events that took place a decade ago” and had already been addressed by the tech giant at the time.
“People want to know that they are safe and secure online, which is why for years we've focused on building products and infrastructure that respect and protect people's privacy,” they added.
Commenting on the decision, Leigh Mallon, partner at law firm Steptoe & Johnson said that the ruling “is a welcome development for data controllers the world over”.
“While data controllers will continue to face increasing activity from supervisory authorities, it is almost impossible for individuals to bring private damages claims because the legal costs of doing so will far exceed any damages that might be recovered,” he told IT Pro.
In order to win the case, each and every claimant would have had to prove that Google’s data collection between 2011 and 2012 had caused “material damage such as financial loss or mental distress resulting from the alleged breach of the Data Protection Act 1998”.
Jonathan McDonald, partner at Charles Russell Speechlys, said that “Google, along with the wider technology sector, will be relieved by today’s ruling”.
“This morning’s judgment was gearing up to be an incredibly important case in the context of data protection, privacy and information law litigation.
Modernise the data stack to transform the data experience
Next generation business intelligence and analytics
"However, Google and countless other businesses – including many who use cookies on their websites without a full understanding of the cookie rules – will be relieved with the court’s finding that a claim founded on the data protection legislation’s provisions providing for the payment of compensation (or “damages”) to individuals, requires a claimant to have suffered monetary loss or actual distress.
The provisions do not require compensation to be paid where data has simply been processed or used in contravention of the law,” he added.
McDonald said that, in the event that Google had lost the case, the tech sector would have been threatened by further mass litigations which could ‘seriously damage’ smaller companies.
“Today will be a wake-up call for technology companies to ensure their data protection operations are watertight and adhering to law,” he added.
The long-awaited ruling comes three years after the UK’s High Court also blocked the lawsuit.
