Image description: A building with the sign saying ‘Google’.

On 10 November 2021, the Supreme Court of the United Kingdom handed down its judgement in the case of Lloyd v Google LLC [2021] UKSC 50, ruling in favour of Google. Mr Richard Lloyd—a notable consumer rights advocate and former director of Which?—issued a claim against Google alleging a breach of its duties as a data controller under section 4(4) of the Data Protection Act 1998. It was alleged that Google secretly tracked the internet activity of roughly 4 million iPhone users in 2011-12 and used the collected data for commercial purposes without those individuals’ knowledge or consent. Google had already settled charges brought by the United States Federal Trade Commission in 2012, agreeing to pay a civil penalty of $22.5 million USD, in addition to settling consumer actions in the United States totaling $17 million USD. The Court ultimately refused Mr Lloyd’s application for permission to serve Google, a Delaware corporation, outside the jurisdiction of England and Wales.

The landmark case has been closely followed not only by those concerned with data protection and privacy, particularly on the substantive grounds of ‘loss of control’ data cases, but also, and perhaps more importantly, with the far-reaching procedural impacts of the case for the type of collective access to justice that is achievable through the long-standing representative action. Rule 19.6 of the Civil Procedure Rules (‘CPR’) allows for a claim to brought by one or more persons as representative of others who have the ‘same interest’ in the claim. In refusing Mr Lloyd’s application, the Court indicated that a bifurcated two-stage process could be workable in principle moving forward in such cases, whereby a declaration on liability may be brought by a representative and individuals may thereafter bring claims for damages—a limited approach that is good news for data controllers as it effectively restricts their exposure to the type of mass litigation Mr Lloyd sought to advance. This bifurcated approach, the Court acknowledged, may not be viable for funders, without whom such litigation will often simply not be feasible.

The reason why Lloyd v Google has elicited critical attention is precisely because of this far-reaching impact, within and beyond the data protection context. England and Wales do not have a generic class action regime. To date, class actions are only available in the Competition Appeal Tribunal. This is due to the UK government electing to pursue a sectoral approach as opposed to introducing a trans-substantive regime, like those in practically every other state with class actions and other collective redress mechanisms, including Australia, Canada, USA, and South Africa. This situation has left a major access to justice gap for a wide range of collective justiciable problems, not least all manner of human rights cases that involve groups of people whose claims are individually non-viable: claims that are economically impractical or irrational to pursue on individual bases, as well as claims involving non-economic barriers, such as social and psychological barriers, that may be overcome through collectivisation which brings a strength-in-numbers dynamic into force—where vulnerable people can band together against powerful wrongdoers, typically transnational corporations. That is why claimants like Mr Lloyd have tried to use CPR Rule 19.6 in the absence of a more suitable procedure such as a class action.

Although the Court appears to have broadened the previously strict ‘same interest’ test for representative actions, Google’s victory reinforces the limitations of reliance on CPR Rule 19.6 over more progressive solutions such as robust class action legislation to deal with mass harms. Despite repeated calls for reform, including by this author as well as the Civil Justice Council who advocated in favour of introducing a generic class action regime in 2008, the UK government has resisted such calls. As it happens, the Court did observe that ‘a detailed legislative framework would be preferable’ to the present approach. That would be a step in the right direction. Will the UK government now act progressively and introduce such legislation to address the extant access to justice gaps, not only sectorally for data protection claims, but to cover all collective justiciable problems?