The highly anticipated UK Supreme Court decision in Lloyd v. Google has brought into focus (1) the operation of the United Kingdom’s collective redress regime brought under the civil procedure rules, particularly the limitations of the “opt-out” regime, and (2) claims pursued as a result of data protection breaches. This LawFlash considers the significance of Lloyd v. Google in the overall context of the developments taking place in the collective action regime, and the impact of this judgment on future actions related to the misuse of data.
On November 10, 2021, the UK Supreme Court handed down its judgment in the case of Lloyd v. Google, an appeal of the Court of Appeal’s decision that Mr. Richard Lloyd could serve proceedings on Google outside the UK jurisdiction (for which the permission of the UK court is required). In its judgment, discussed in more detail below, the Supreme Court determined the following:
With its judgment, the Supreme Court reversed the 2019 decision of the Court of Appeal that allowed Mr. Lloyd’s representative action against Google to proceed.[3]
The collective redress landscape in England and Wales is less developed, and far less permissive, than the long-established regimes in jurisdictions such as the United States and Australia. The majority of the collective action regimes available to claimants in England and Wales utilise an “opt-in” model, in which litigants must take affirmative steps to be included in an action.[4] There are two effective “opt-out” models in which a litigant is part of an action unless he, she, or it actively chooses not to participate: (1) collective proceedings in the Competition Appeals Tribunal (CAT)[5] and (2) representative actions under CPR 19.6. The CAT has now certified three actions. Despite the fact that representative actions are technically “opt-out” proceedings, the Court’s recent decision in Lloyd v. Google has emphasised their relatively limited utility as a vehicle for these actions.
Multiple Joint Claimants
There are various ways in which opt-in actions typically proceed. A commonly used approach is that of joining multiple claimants in a single claim. Although not a formal collective redress mechanism, courts have wide case management powers to join or consolidate proceedings using their ordinary procedural rules.[6] CPR 19.1 allows the court to join “any number” of claimants or defendants as parties to a claim. CPR 7.3 adds the caveat that claims included in a single claim form must be ones that “can be conveniently disposed of in the same proceedings.”
Though there is no prescribed set of circumstances that must exist for a court to join claims or permit claims to proceed together, courts will usually allow multiple claims to continue when, having regard for the overriding objective, it is clear that a case can be disposed of expeditiously in a cost-effective manner.[7] For example, it is commonplace for claimants to utilise this method, rather than Group Litigation Orders (GLOs) or representative actions, to bring group securities claims. Recent examples of this strategy can be seen in the concluded SL Claimants v. Tesco plc[8] and the ongoing proceedings in Allianz Global Investors GmbH & others v. RSA Insurance Group Limited,[9] Various Claimants v. G4S Plc,[10] Various Claimants v. Serco Group Plc,[11] and The Trustees for the Victory Portfolios and others v. Standard Chartered Plc.[12] A court is entitled, however, to utilise its discretion in deciding whether to allow these proceedings.
Group Litigation Orders
A group of persons or parties wishing to bring claims which “give rise to common or related issues of fact or law”[13] may apply to the court for a GLO[14] pursuant to CPR 19.11. GLOs are opt-in procedures, meaning that each participating claimant must take positive steps to join, and each claim is technically an individual claim.
If a GLO is granted, a court will manage the individual claims as a group; CPR 19.11(2) requires that a GLO identify the claims to be managed under the GLO and establish a register on which these claims will be entered. The way in which the claims are managed is a discretionary matter for the judge.[15] Unless a court decides otherwise, any judgement or order made in a claim on the group register is binding on the parties to all other claims that are on the group register.[16]
GLOs can be useful tools in that they are capable of effectively managing the claims of numerous litigants while conserving the court’s resources and giving claimants the benefit of sharing costs and litigation risk.[17] GLOs have been granted in a variety of different practice areas, including data protection,[18] mass tort,[19] and certain types of securities litigation.[20]
However, the fact that GLOs are opt-in procedures limits their functionality. As the Supreme Court has pointed out, the opt-in mechanism has significant downsides including (1) the administrative hurdles for solicitors who must determine claimant eligibility to be added to the group register, give appropriate advice, and enter into a retainer with each client; (2) limited utility for small individual claims because initial costs may exceed the potential value of a claim; and (3) the fact that, generally, a relatively small proportion of eligible claimants join a group, whether because the value of individual claims is small or claimants merely lack awareness of proceedings.[21] These realities are, perhaps, reflected in the fact that the number of GLOs granted since the regime’s inception in 2000 is a mere 109, with only 10 granted in the last three years.
Representative Actions
CPR 19.6 provides that a claim can be initiated or continued by one or more persons who have the same interest as those being represented.[22] Representative actions are generally considered to be “opt-out” actions in that a representative’s ability to act under the rule does not depend upon the consent of the persons represented.[23] Critically, in the context of a representative action, the “same interest” requirement means that no individual assessment is necessary to reach a judgment, whether of liability, damages, or any other element, and to the extent individual assessment is required, that is likely to be fatal to the ability to bring a representative action.[24]
It is this mechanism that Mr. Lloyd attempted to use to pursue a claim against Google LLC under section 4(4) of the DPA 1998. Mr. Lloyd’s claim alleged that, between 2011 and 2012, Google used the “Safari workaround” to track the internet activity of iPhone users for commercial purposes.[25]
As explained above, the Court held that damages were not available for loss of control of personal data under the DPA 1998. However, the Court went on to say that, even if damages were available for loss of control, it would still be necessary to prove what unlawful processing of each individual’s personal data had occurred, because Google’s alleged use of the Safari workaround was not uniform across all parties. This requirement would have precluded a representative action under CPR 19.6 from succeeding in this case.[26]
In arriving at this conclusion, the Supreme Court undertook an instructive analysis of representative actions and their key features and uses. First, the Court observed that the “same interest” requirement under CPR 19.6 should not be interpreted rigidly; rather, it should be interpreted in light of the overriding objective of the CPR and the purpose of the representative procedure, which is to ensure that a representative can be relied on to bring litigation that will promote and protect the interests of all class members.[27] As long as the same-interest requirement is satisfied, the Court explained, a court may exercise its discretion in determining whether to allow a claim to proceed as a representative action.[28]
Additionally, the Court confirmed the “opt-out” nature of representative actions[29] and highlighted that a clearly defined class, while desirable, is a discretionary matter for the judge rather than a precondition for the application of CPR 19.6.[30] Further, the Court clarified that claimants represented by a representative claimant will not usually be liable to pay any costs incurred by that representative, but opined that a court could make a different order, assuming it would be in the interests of justice to do so.[31]
Most significantly, the Court offered details on how a claim for damages impacts a claimant’s ability to pursue a representative action. The Court explained that, while a claim for damages is not a bar to a representative action, damages are usually intended to put an individual claimant in the same position as if the wrong had not occurred.[32] Generally, the Court expounded, such an exercise requires an individualised assessment that does not raise common issues and which cannot fairly or effectively be carried out without a litigant’s presence in the proceedings. The Court therefore concluded that a representative action is not suitable in cases requiring an individualised assessment of damages.[33] If, however, it is possible to calculate damages on a “top down” basis, or a basis common to all class members, the Court suggested that a representative action could still be appropriately employed.[34] As potential examples, the Court cited a claim alleging that all class members were wrongly charged a fixed fee, or a claim alleging that all class members acquired a product with the same defect that reduced its value by the identical amount.[35] Or, the Court hypothesised, if loss suffered by the class as a whole can be calculated on a global basis, such as loss under a particular insurance policy or loss to all members of a trade association for copyright infringement, a representative action might not be precluded.[36]
The Court also noted that, in cases where some form of individualised assessment is necessary, parties could adopt a “bifurcated process” in which common issues of law or fact are decided through a representative claim, and any issues requiring individual determination, such as liability or damages, are dealt with in a subsequent nonrepresentative action.[37] The Court acknowledged that a difficulty with the pursuit of such a bifurcated process might be that any declaratory judgment would not generate financial return for any litigation funders or persons represented, and would therefore only be viable if pursuing separate damages claims on behalf of individual class members would be economic.[38]
The Supreme Court’s decision silences any suggestion that the Court of Appeal’s judgment marked a shift in the English courts’ attitude to representative actions. It serves to clarify not only data protection legislation, but also how and when representative actions can be successfully utilised and their place within the wider collective redress landscape.
Data Privacy
The Supreme Court’s judgment likely removes the possibility that future representative actions can be based solely on contraventions of data protection legislation that do not result in damages or distress to the affected consumers. If Mr. Lloyd had been successful, the Supreme Court’s judgment would have entitled claimants to bring representative actions where there has been a breach of data protection obligations resulting in a loss of control over a claimant’s personal data. The Supreme Court’s rejection of Mr. Lloyd’s claim confirms that, contrary to his assertion, the loss of control of data will not be sufficient to support a claim under the DPA 1998, and that loss of control will not itself usually amount to “distress” or “damage” without something more significant, such that it would succeed in a data breach claim. The judgment has made it clear that this position applies to causes of action brought individually or collectively.
The Supreme Court restricted its judgment to the DPA 1998, which has now been repealed and replaced by the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This fact could in theory mean that similar claims under the UK GDPR have more chance of success, but the equivalent provision to section 13 of the DPA 1998 in the UK GDPR (Article 82) is substantively the same. Recital 85 of the UK GDPR states that “a personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data” (emphasis added). However, this recital is not legally binding; it is an explanatory note rather than part of the legislation itself. In any case, the Supreme Court’s decision to forego a consideration of the current legislation means that any future claims will be likely be focused on these provisions. It seems likely, however, that the Court’s judgment largely removes the potential for representative actions as vehicles for seeking redress for loss of control of data that does not result in material damages.
The potential ramifications of this case are more pronounced considering the other data protection representative action claims currently before UK courts, some of which were stayed pending its outcome. These include claims against TikTok, Facebook, Oracle, and Salesforce. The Supreme Court’s judgment could create some difficulties for the claimants in these cases given that aspects of these cases are also brought on similar grounds to Mr. Lloyd’s claim. It is conceivable, therefore, that we may see some creative arguments in the future from claimants attempting to distinguish their case from Lloyd v. Google.
Collective Redress
This judgment suggests that opt-out proceedings will not become the norm in UK courts any time soon. While the Court’s judgment does not slam the door on the use of CPR 19.6 in all cases, it does serve to limit its functionality in both the data protection arena and more broadly.
Although collective action systems in other jurisdictions can be similarly wary of accommodating individualized damages claims, many are far less restrictive than the regime summarised in Lloyd v. Google. For instance, in the United States, the need for individualised damages calculations will not always preclude class certification in federal courts.[39] Rather, assuming the requirements of Federal Rule of Civil Procedure (FRCP) 23(a) are met, FRCP 23(b)(3) allows a class seeking money damages to be certified if (i) questions of law or fact common to class members predominate over questions affecting only individual members (the predominance requirement) and (ii) a class action is superior to other available methods for the fair and efficient adjudication of the controversy (the superiority requirement).[40]
Determinations of whether a class meets the above tests are fact-based and multifaceted, and there is no specific applicable test. Nonetheless, some US federal courts have been willing to find that common questions of law or fact predominate even when some individualized damages calculations are required.[41] For instance, if damages are capable of calculation by formula or other objective means applicable to each class member, a number of US courts have concluded that damages questions do not pose a barrier to certification.[42] These courts reason that only when damages calculations are complex or burdensome do they impede class certification.[43]
Such flexibility seems unlikely to be achieved outside the competition sphere in the United Kingdom. Notably, the Supreme Court took a more permissive approach to the calculation of class damages in the recent case of Mastercard Incorporated and others v. Walter Hugh Merricks CBE [2020] UKSC 51. In that case, the Supreme Court interpreted the provisions of the Competition Act 1998 (CA 1998), as amended by the Consumer Rights Act 2015, that permit opt-out collective proceedings to be brought in the CAT and allow damages to be awarded in the aggregate.[44] The Supreme Court in that case disagreed with the CAT’s initial refusal to certify a class on the bases that (i) the proposed methodology for quantifying aggregate damages was unworkable, and (ii) even if loss could be calculated in the aggregate, there was no way to determine an approximation of loss suffered by individual claimants.[45] In rejecting the CAT’s second point, the Supreme Court explained that the CAT had erred in focusing on determining individual damages because the proposed method for distribution did not reflect individual losses and because the CA 1998, as amended, provides for aggregate awards of damages without assessing individual class members losses, thereby “radically alter[ing] the established common law compensatory principle.”[46]
No similar legislation expands the operation of the compensatory principle in the case of CPR 19.6 representative actions, and the Supreme Court appears unwilling to apply its analysis outside the ambit of the CA 1998. Rather, the Supreme Court’s examples of situations in which damages could be appropriately assessed on a “common or global basis” in a CPR 19.6 action appear niche and specific and may have limited applicability. However, this does not mean that representative actions will not have a role in the right situation. For example, a circumstance in which a common assessment of damages could apply is in claims brought under s. 90 of the Financial Services and Markets Act 2000, by which those responsible for listing particulars can be found liable for losses that a claimant has suffered because of untrue or misleading statements they contain. If, for example, investors purchase shares in a company as part of an initial public offering (IPO), those investors will almost certainly purchase each share at the same price. If the listing particulars are revealed to contain untrue or misleading statements and the share price subsequently falls, it is arguable that a claim could be made by any one of the investors on a representative basis because it would be possible to undertake a “top down”[47] approach to the loss suffered by those investors as a “class.” Or, put another way:
The Court’s suggestion that representative actions could be run as bifurcated proceedings appears in theory to offer some scope for future representative actions, but in practice may be unworkable in many cases. In the United States, class action suits brought according to Rule 23 of the FRCP are sometimes run as bifurcated proceedings or certified as so-called issues classes.[49] Bifurcated proceedings in the United States can be employed in some circumstances when individual damages calculations are prohibitively complex or burdensome, but there are certain issues, such as liability, that can be resolved together. In the Unites States, however, the constitutional right to jury trial imposes some limits on the bifurcation of overlapping issues, and determinations of “liability” short of a judgment have questionable legal effect. Plaintiffs in the United States routinely argue that bifurcation can encourage settlement and can conserve court resources. These issues are sometimes hotly contested in the United States.[50]
Despite the possible benefits of bifurcation, it is not clear that bifurcated representative actions will gain much traction in the UK context. Bifurcated proceedings may only be practical in cases of reasonably large individual damages claims; otherwise, even if liability is established in a first stage, claimants are unlikely to pursue proceedings, similar to Lloyd v. Google, consisting of numerous small individual damages claims due to the disproportionate costs, fees, and time that would be required. Further, because many UK cases with multiple litigants are third-party–funded, it is difficult to see what incentive a funder might have to pursue a bifurcated proceeding. It is unlikely that funders would bring a case on a point of principle without knowing which claimants, if any, might pursue subsequent damages claims.
Accordingly, rather than risking an untested bifurcated representative action, claimants may continue to avoid the “formal” GLOs or representative actions in favour of the less problematic and rigid alternatives commonly used to pursue collective actions in the United Kingdom that are discussed above.
For the time being, Lloyd v. Google will likely ensure that representative actions will be sparingly used. More generally, Lloyd v. Google appears to reinforce the premise that, outside the competition sphere, opt-in proceedings are the predominant realistic avenue for collective action in the United Kingdom for the foreseeable future.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
London
Chris Warren-Smith
Paul Mesquitta
Trainee Cary Marshall contributed to this LawFlash
[1] Id. at [5].
[2] Id. at [138].
[3] Lloyd v. Google [2019] EWCA Civ 1599, [88]-[90].
[4] Practical Law Practice Note, “Group Litigation and Group Litigation Orders,” https://uk.practicallaw.thomsonreuters.com/w-028-3312.
[5] The United Kingdom is home to the relatively new collective proceedings regime, introduced by the Consumer Rights Act 2015. This act established a class action regime, somewhat similar to regimes found in the United States, for private competition litigation in the CAT. Recently, the CAT certified three of its very first opt-out collective actions in Walter Hugh Merricks CBE v. Mastercard Incorporated and Others [2021] CAT 28, judgment of 18 Aug. 2021, Justin Le Patourel v. BT Group PLC (case no. 1381/7/7/21), and the consolidated cases of Justin Gutmann v. London & South Eastern Railway Limited (case no. 1305/7/7/19) and Justin Gutmann v. First MTR South Western Trains Limited and Another (case no. 1304/7/7/18). See id.; see also Camila Sanger, Peter Wickham and James Lawrence, “The Class Actions Law Review: United Kingdom - England & Wales” in The Class Actions Law Review (Apr. 28, 2021), https://www.lexology.com/indepth/the-class-actions-law-review/united-kingdom-england--wales (accessed Nov. 18, 2021). However, because of the limited applicability of this regime, we do not consider it in detail here.
[6] CPR 3.1(2).
[7] See Al Sadeq v. Dechert LLP and others [2021] EWHC 1149 (QB), [103] (finding that, considering the overriding objective, a joint trial was appropriate because the claims shared a common background, contained overlapping issues, and had the same legal teams).
[8] In which the Court allowed joint proceedings in the cases of FL-2017-000001 (the SL claim) and FL-2016-000019 (the MLB claim).
[9] Joining case numbers FL-2019-000017, FL-2021-000004, and FL-2021-000006.
[10] Case numbers FL-2019-000007 and FL-2020-000035.
[11] Case number FL-2019-000006.
[12] Case number FL-2021-000011.
[13] CPR 19.10.
[14] See Group Litigation Orders, https://www.gov.uk/guidance/group-litigation-orders#list-of-all-group-litigation-orders, for a list of all orders made since the regime’s inception.
[15] Practical Law Practice Note, “Group Litigation and Group Litigation Orders.”
[16] CPR 19.12(1).
[17] Lloyd v. Google LLC [2021] UKSC 50, [25].
[18] Weaver v. British Airways Plc (“The British Airways Data Event Group Litigation”). This claim settled in summer 2021.
[19] Vedanta Resources PLC v. Lungowe (“The Nchanga Copper Mine Group Litigation”). This GLO, granted in 2020, was the most recent one granted by an English court. The claim subsequently settled in 2021.
[20] The RBS Rights Issue Litigation. This claim settled in 2017.
[21] Lloyd v. Google LLC [2021] UKSC 50, [25]-[28].
[22] CPR 19.6.
[23] Lloyd v. Google LLC [2021] UKSC 50, [77].
[24] See, e.g., Jalla v. Shell Int’l Trading & Shipping Co. Ltd. [2021] EWCA Civ 1389, [94], [96]-[97], [103] (holding that, because each individual or community affected by an oil spill would need to prove that they had suffered loss or damage as a result of the defendants’ breach, they did not have the same interest for all practical purposes).
[25] Lloyd v. Google LLC [2021] UKSC 50, [9]-[14].
[26] Id. at [144].
[27] Id. at [71].
[28] Id. at [75].
[29] Id. at [77].
[30] Id. at [78].
[31] Id. at [79].
[32] Id. at [80].
[33] Id.
[34] Id. at [82]. The Court also raised, however, that an award of damages in either of these cases might still create problems in regards to how the damages should be distributed, and commented that one such issue might be whether there is any legal basis for paying some legal damages to litigation funders without the consent of each individual claimant. Id. at [83].
[35] Id. at [82].
[36] Id. at [82], [52]-[53].
[37] Id. at [81].
[38] Id. at [85].
[39] 1 Federal Class Action Deskbook § 3.24[2][b][i].
[40] Fed. R. Civ. P. 23(b)(3).
[41] 1 Federal Class Action Deskbook § 3.24[2][b][i].
[42] Id.
[43] Id.
[44] Mastercard Incorporated and others v. Walter Hugh Merricks CBE [2020] UKSC 51, [3]-[4].
[45] Id. at [30]-[34].
[46] Id. at [58], [76]-[77].
[47] Lloyd v. Google LLC [2021] UKSC 50, [82].
[48] Although, hypothetically, this approach could succeed, there would also be potential to argue other quantum calculations.
[49] 1 Federal Class Action Deskbook § 3.24[2][b][ii].
[50] See Jeremy M. Creelan and Daniel H. Wolf, “‘Tyson Foods’: Bifurcation Taking Center Stage?,” [2016] New York Law Journal, https://jenner.com/system/assets/publications/15195/original/Creelan_Wolf_NYLJ_May_23_2016.pdf?1464011914.