Google just about manages to avoid another massive fine

The High Court in the UK has quashed an attempted class-action lawsuit against Google for the illegal collection of iPhone user’s data during 2011-2012.

The case, which was first heard in May, was brought forward by a group called ‘Google You Owe Us’, headed up by Richard Lloyd, a former Executive Director at Which. Lloyd believes in acting illegally, Google should financially compensate the iPhone users who were affected. The number of affected users has been estimated at 4.4 million, meaning Google would have been liable for damages between £1 and £3 billion. As it stands, the class-action suit can no longer proceed as it would be impossible to accurately calculate the number of iPhone users who have been impacted sufficiently.

Google, which has already admitted to wrong-doing, used a practise now known as the ‘Safari Workaround’ to obtain sensitive information without obtaining permission from the user. As a data controller in this instance, Google has breached its responsibilities under the Data Protection Act, though this case is not to punish illegal activity, but to seek compensation for users as a result of the illegal activity.

For those who are familiar with legal jargon, Justice Mark Warby concluded:

“In my judgment the facts alleged in the Particulars of Claim do not support the contention that the Representative Claimant or any of those whom he represents have suffered ‘damage’ within the meaning of DPA s 13. If that was wrong, the Court would inevitably refuse to allow the  claim to continue as a representative action because members of the Class do not have the ‘same interest’ within the meaning of CPR 19.6(1) and/or it is impossible reliably to ascertain the members of the represented Class.”

Section 13 of the Data Protection Act states individuals who suffer ‘damage’ by reason of any contravention by a data controller (in this case, Google) are entitled to compensation. Civil Procedure Rules (CPR) section 19.6(1) states each individual in the class would have to have the same ‘damage’, though as there has been only one case brought forward in the last six years, the damage cannot be logically concluded or attributed.

The case was brought to the courts in 2017. Lloyd claims Google profited from illegally collecting and processing information on iPhone users, which was then used in the ‘DoubleClick’ advertising business to create a hyper-targeted advertising service.

In the simplest of terms, Google managed to find a way of collecting information about users without going through the accepted opt-in route. Google wrote code which bypassed the opt-in on the Safari browser, and placed a third-party cookie onto the iPhones. This practise, known now as the ‘Safari Workaround’, essentially allowed Google to track iPhone users, collecting information without seeking the appropriate opt-in.

Through the collection of sensitive information including race, social class, location data and interests, Google was able to build a detailed profile of individuals and organize the users into categories such as ‘football fans’. This categorization is critical to advertisers, who want to make sure ROI is as high as possible for every pound spent. At the time of the incident, 2011-12, such hyper-targeted would have been a relatively new concept, with Google pushing the boundaries of what would be considered acceptable.

Google has already admitted to wrong-doing, and has been punished by the relevant authorities in the US, paying out multi-million sums. In the UK, such investigations would fall into the jurisdiction of the Information Commissioner’s Office, though it has not taken any action to date. What is worth noting is that this ruling against Lloyd should not restrict any action from the ICO, as it is related to class-action suits against Google compensating victims of the wrong-doing, not the wrong-doing itself. It’s a nuance, but worth noting, as the ICO could in theory take action.

For Google, this ruling will certainly come as a relief. Not only does it save the accountants from having to sign another multi-billion pound cheque, but it sets precedent. In stating it would not be possible for Lloyd to understand and identify the ‘damage’ done to each of the individual users, Justice Warby has made it more difficult for consumer groups to organize class action suits against major organizations.

The ripples of this ruling go further than the technology world. Consumer groups throughout the UK would have been watching this saga with interest; the ruling would have set precedent as to whether class-action suits are a realistic possibility in the UK. Justice Warby has not ruled out class-action suits, though he has simply stated Lloyd was not able to attribute an appropriate amount to the ‘damage’ column. More work on the foundations will be needed on the future for such class-actions suits to progress in the future.