21 July 2016
DataGuidance confirmed, on 18 July 2016, with Christopher Knight, Barrister at 11 King’s Bench Walk, that Google, Inc. had withdrawn its appeal to the UK Supreme Court in the case of Google v. Vidal-Hall EWCA Civ 311. The Court of Appeal (‘the Court’) previously held that Section 13(2) of the Data Protection Act 1998 (‘DPA’), which provides that an individual who suffers distress by reason of any contravention by a data controller is entitled to compensation only if they suffer damage, was incompatible with Article 23 of the Data Protection Directive (95/46/EC) (‘the Directive’). In addition, the Court disapplied Section 13(2) of the DPA on the grounds that it conflicts with the rights guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
Knight told DataGuidance, “Practitioners in data protection law warned as soon as the Court’s judgement was released that an increase in litigation was likely: the difficulty in obtaining damages was the main disincentive to bringing proceedings. Quantum still remains relatively low (for the moment), but the removal of Section 13(2) of the DPA opens the door very much wider to claims because the vast majority of data breaches will cause little or no pecuniary loss; they go to privacy intrusion, i.e. distress. Claims have certainly increased since Vidal-Hall and will be only likely to continue now the Supreme Court will not be overturning the decision. Already we have started to see the first group litigation for data breaches. In theory of course, the Supreme Court could await the same point being taken in a different appeal. It had accepted that it was arguable that the Court was wrong. But that means nothing in and of itself, and it is likely to be some time before a case is in a position to try and take the point to the highest court again.”
“The withdrawal of Google’s appeal is slightly disappointing for data protection lawyers, who have been deprived of their best chance of a Supreme Court judgment on how the DPA works and the extent to which it properly implements the Directive. We are, however, left with a full and thorough judgement which was going to be difficult to overturn”
In assessing whether there could be a claim for compensation without pecuniary loss, in particular, in light of Section 13(2) of the DPA, the Court ruled, ‘What is required in order to make Section 13(2) compatible with EU law is the disapplication of Section 13(2), no more and no less. The consequence of this would be that compensation would be recoverable under Section 13(1) for any damage suffered as a result of a contravention by a data controller of any of the requirements of the DPA. No legislative choices have to be made by the court.’
Knight added, “The withdrawal of Google’s appeal is slightly disappointing for data protection lawyers, who have been deprived of their best chance of a Supreme Court judgment on how the DPA works and the extent to which it properly implements the Directive. We are, however, left with a full and thorough judgement which was going to be difficult to overturn. As a result, the Court’s conclusion that the requirement to show pecuniary loss before claiming damages for distress is incompatible with the Directive and must be disapplied under the Charter (using the right to an effective remedy) stands and Section 13(2) of the DPA is no more. The UK Parliament could, of course, amend the DPA to recognise this formally but it is unlikely to do so. The Court’s judgement already has the necessary effect. It may well be that when a general revision of data protection law takes place – as is probably still necessary in the light of the General Data Protection Regulation – Section 13(2) may be formally repealed. In the meantime it may catch those less familiar with the case law unaware.”
Alexis Kateifides | Privacy Analyst