News: 1619695813

Google has urged the UK's Supreme Court to throw out a £3bn lawsuit brought by an ex-Which director over secretly planted tracking cookies on devices running Safari, on the grounds that local law doesn’t allow for opt-out class action lawsuits.

The case, being heard over two days this week in the Supreme Court, the final court of appeal in Britain for [1]civil cases , has huge implications for legal businesses and investors as well as data protection law. At stake is a previous Court of Appeal ruling, as well as up to £3bn for a venture capital fund backing former Which man Richard Lloyd's case.

[2]

Lloyd fronts a campaign called Google You Owe Us. He seeks somewhere between £1.5bn and £3bn from Google in damages for breach of statutory duty – but before that can be argued about, he needs legal permission to serve the case on Google LLC in the US.

What's the Safari Workaround?

The "Workaround" was [3]first revealed in February 2012 by Stanford PHD researcher Jonathan Mayer – who incidentally [4]also published research about so-called [5]Microsoft "supercookies" .

The "Workaround" allowed Google to bypass the privacy settings on Apple's iPhone Safari browser to track people's online activity. Google disabled the code after The Wall Street Journal broke the story [6]in early 2012 .

Regulatory action against Google on the matter has already been taken [7]in the US: firstly by the Federal Trade Commission, which fined it $25m in August 2012 , and latterly in a civil case, where the tech giant was forced to cough up [8]$17m to consumers [PDF] , to be shared among 37 states and the District of Columbia.

A [9]2015 UK case that paved the way for Lloyd v Google was brought by three claimants ( Judith Vidal-Hall et al v Google Inc ) who went through the UK court system to claim their privacy rights had been breached by the "Safari Workaround". The Court of Appeal of England and Wales ruled at the time that users could sue Google in the UK.

The High Court [10]refused that permission in 2018 ; the Court of Appeal [11]overruled it a year later and said yes (with some [12]very pointed observations from a senior judge as it did so); and now Google wants a return to the status quo from the Supreme Court.

Antony White QC for Google told the court yesterday: “In our submission it is an important point of reference in this case that under the general law, a claim in tort of breach of statutory duty is not actionable per se; it requires proof of harm.”

When is a class action not a class – or an action?

Class actions, in the US sense, are almost unknown over here because until the Court of Appeal’s 2019 ruling, the UK didn’t have a so-called “opt out” class action procedure. In America anyone can start a class action on behalf of however many millions of people they want and it’s up to members of the class to say “not in my name” if they don’t want to be part of it; in the UK the situation used to be the other way around.

To start a representative action (the English legal name for a class action) members of the class all need to have exactly the same “interest” in the case. Here, Google argues that of the potentially millions of Britons affected by its [13]Safari Workaround , nobody can tell how many people suffered damage (in the legal sense) by being tracked around the web. Therefore, the adtech monolith says, Lloyd’s case is fundamentally flawed and ought to be kicked out.

[14]

Kate Macmillan, a consultant for law firm Herbert Smith Freehills, explained the “same interest” test for The Register , saying the principle this case could establish would apply to a lot of different circumstances.

“In this instance one person’s use – a user visiting a dictionary website for example – will be very different to another’s such as a super user's,” said Macmillan. “The latter is likely to be entitled to a higher award of damages than the former. Or to give another practical example, consider the problem in relation to a representative action involving rent increases where those with higher incomes are subsiding those with lower incomes. Claimants would be differently impacted – so could one say there is ‘relief beneficial to all’?”

They’re all different so shouldn’t all sue at once

Back in the courtroom, White expanded on Google’s case: “We submit that where loss of control over personal data does have significantly harmful consequences for an individual, compensation can be awarded but the harm being compensated in such circumstances is not the abstract fact of loss of control but the harmful consequences it has had for the individual.”

This is an unbroken line of argument stretching back to the High Court, where a 2018 witness statement made on Google’s behalf said: “The Claimant’s attempt to characterise every Class member as suffering the same loss is contrived. It is self-evident that individual Class members would have had very different experiences, and those experiences bear directly on whether (and if so how) they can claim to have suffered any loss at all.”

[15]

White’s argument that loss of control is separate from damage, in legal terms, may not hit home. Sir Geoffrey Vos, Chancellor of the High Court, [16]gave this short shrift when he heard the case in the Court of Appeal. Similarly, Lady Arden, one of the Supreme Court judges, trenchantly observed yesterday: “You can’t just pull out one strand and say ‘no harm’. You also have to look at the responsibility of the data holder, whether its actions were proportional or not.”

Echoing Lady Arden, Lord Leggatt said: “Let’s say if you’re detained wrongfully for five minutes you’re not going to get any significant award. If you were to look at this wrong in the same way, there are still going to be cases aren’t there, where the breach is such that nominal damages are appropriate.”

If the Supreme Court gives permission for the case to go ahead, Google will have to defend its sneaky implanting of tracking cookies with reference to [17]section 13 of the Data Protection Act 1998 (“Compensation for failure to comply with certain requirements”), which was in force when the badness occurred.

The legal industry and speculators are watching closely

Lots of law firms and big-ticket lawsuits depend on Lloyd winning: to list a few, these include the British Airways sueball, a similar one [18]proposed against Easyjet , and [19]one in the works against Facebook plus one more in a [20]weird public-private partnership against Tiktok .

In each of those cases there is a financial backer who stands to profit handsomely from the damages, taking up to half of the sum awarded against the allegedly naughty company – which explains why the maximum claim runs to hundreds of millions or even billions of pounds. Advocates for these representative actions say they are the only way that Joe and Josephine Average can claim any meaningful compensation for wrongs done to them in those cases.

Today the court will hear from Hugh Tomlinson QC, for Lloyd, and from Gerry Facenna QC on behalf of the Information Commissioner’s Office which supports Lloyd’s case. ®

Get our [21]Tech Resources



[1] https://www.supremecourt.uk/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YIrYHOMxTwykl0vooVynzwAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://www.theregister.com/2012/02/20/google_bypasses_apple_safari_privacy/

[4] https://www.theregister.com/2011/08/22/microsoft_zombie_cookie_disclosure/

[5] http://cyberlaw.stanford.edu/blog/2011/08/tracking-trackers-microsoft-advertising

[6] https://www.wsj.com/articles/SB10001424052970204880404577225380456599176

[7] https://www.theregister.com/2012/08/09/google_to_pay_ftc_25m_dollars_over_safari_tracking_blunder/

[8] http://www.ct.gov/ag/lib/ag/press_releases/2013/20131118_googlesafari_avc_executed.pdf

[9] https://www.theregister.com/2015/03/27/google_safari_appeal/

[10] https://www.theregister.com/2018/10/08/google_iphone_data_privacy_case_blocked_by_high_court/

[11] https://www.theregister.com/2019/10/02/lloyd_v_google_court_appeal_goahead/

[12] https://www.theregister.com/2019/07/17/google_safari_cookie_uk_court_appeal_judge/

[13] https://www.theregister.com/2014/01/16/google_to_appeal_against_high_court_privacy_ruling/

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YIrYHOMxTwykl0vooVynzwAAAIE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YIrYHOMxTwykl0vooVynzwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[16] https://www.theregister.com/2019/07/17/google_safari_cookie_uk_court_appeal_judge

[17] https://www.legislation.gov.uk/ukpga/1998/29/section/13/enacted

[18] https://www.theregister.com/2020/05/26/easyjet_sued_9m_data_breach/

[19] https://www.theregister.com/2020/10/29/facebook_you_owe_us_high_court_campaign/

[20] https://www.theregister.com/2021/01/07/tiktok_high_court_class_action/

[21] https://whitepapers.theregister.com/