This week the Supreme Court handed down judgment in the case of Lloyd v Google. Richard Lloyd (the former director of Which? rather than the ex-Television guitarist) had brought a “representative” action against Google for breach of his rights under data protection law, essentially the placing of certain cookies without a lawful basis. A representative action is one in which the claimant makes claims not only on his or her own behalf but also that of others - in this case 5 million or more unidentified individuals alleged to have had their rights similarly infringed. My colleague Jonny McDonald neatly summarises the issues that were at stake here.
In its earlier judgment, the Court of Appeal had decided that damages could in principle be awarded for mere loss of control of data – without proof of damage. The Supreme Court however was not impressed with Mr Lloyd’s claim and found that the representative action failed, the claimant having failed to produce any proof that wrongful use was made of personal data, or that the individual data subjects in the represented class actually suffered actual damage or distress.
Project Red Card is the campaign by up to 850 footballers and managers to hold to task certain gambling, gaming and data processing companies for the alleged processing of personal data in breach of those individuals’ rights. This Supreme Court judgment is certainly a blow for the campaign because it places an onus on them as claimants – if they want to secure damages – to prove actual damage or distress; it will not be enough merely to show that those individuals “lost control” of their data. So, the team will have to work harder to produce evidence of damage or distress and to persuade any court to accept such evidence. Furthermore, any settlement negotiations will become tougher, the possibility of a judgment in their favour for mere loss of control being off the table.
While this blow is certainly significant, it is unlikely to be terminal to Project Red Card. It makes claiming damages harder, but certainly not impossible, and does not materially undermine the prospect of injunctive relief. We can expect the Project Red Card team to continue their battle, albeit with somewhat diminished artillery.
techUK, the UK's trade association for technology firms, said that if the judgment had gone the other way, it would "have opened the door for speculative and vexatious claims to be made against data controllers".