Challenge to Google’s data collection and sharing policy


Re: Google v Vidal-Hall & Ors [2015] EWCA Civ 311

The claimants alleged that the appellant, Google, had secretly collected browser generated information via the use of cookies without their knowledge or consent, and provided the information to third parties that had allowed targeted advertising to be served on them. It was alleged that the browser generated information and/or the targeted advertising contained private information and personal data. The respondents sought damages for misuse of private information, and compensation under the Data Protection Act 1998, s 13 for distress despite the fact that they had suffered no pecuniary loss.

The two main issues in the appeal were (i) whether misuse of private information was a tort for the purposes of CPR PD 6B, para 3.1(9); (ii) the meaning of “damage” in the DPA 1998, s 13, and whether there could be a claim for compensation without pecuniary loss.

Held: the Court dismissed the appeal and maintained the decision of the QBD. With regard to (i) misuse of private information was to be recognised as a tort for the purposes of service out of the jurisdiction. The Court noted that recognising it as a tort did not create a new cause of action, but merely gave the correct label to the existing cause of action. The Court held there was no satisfactory or principled reason why misuse of private information should not be categorised as a tort; it was a civil wrong with no equitable characteristics.

With regard to (ii) the Court noted the obiter dicta of Buxton LJ in Johnson v Medical Defence Union Ltd [2007] EWCA Civ 262 in which he said that damage must include pecuniary loss. However, the Court declined to follow these dicta. The Court noted that “damage” was also referred to in the Directive 95/46 (“Data Protection Directive”). The Data Protection Directive encapsulated a right to compensation for breach of an individual’s non-pecuniary rights at art 23.

The Court said it was important that data subjects had an effective remedy for a distressing invasion of privacy falling short of pecuniary damage, especially as the Charter of Fundamental Rights of the European Union, arts 7 and 8 made specific provision for the protection of personal data.

It followed that the DPA 1998, s 13 had not effectively transposed art 23 of the Data Protection Directive into domestic law. Despite the Marleasing principle, s 13(2) could not be interpreted so as to be compatible with art 23 because such a construction would be too strained and it would alter a fundamental feature of the legislation.

However, although such a Marleasing interpretation was unavailable the Court decided that the direct horizontal effect of the EU Charter required it to disapply s 13(2) with a result that compensation would be recoverable under s 13(1) for distress even though no pecuniary loss was alleged.

Ben Silverstone, Hugh Tomlinson QC and Antony White QC were involved in this case.