Lloyd vs. Google: what blocking of £3.2bn lawsuit means for tech users

The UK Supreme Court has blocked a £3.2bn lawsuit against Google, which it was hoped would result in millions of iPhone users receiving payouts from the internet giant.

Consumer rights champion Richard Lloyd – the former director of consumer rights group Which? – began a lawsuit against Google in 2017. He alleged that the company had “breached its duties as a data controller” by collecting web-browsing data from around 4.4 million Apple iPhone users between 2011 and 2012.

But the 60-page judgment said that Lloyd’s case hadn’t proven “what, if any, wrongful use was made by Google of the personal data of any individual” affected by the data breach. Because of this, it added, “a claim for damages cannot succeed”.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Lloyd, who was representing more than four million iPhone users in England and Wales, said he was “bitterly disappointed” by the ruling.

“Although the Court once again recognised that our action is the only practical way that millions of British people can get access to fair redress, they’ve slammed the door shut on this case by ruling that everyone affected must go to court individually,” he said.

‘Safari workaround’

Lloyd was suing Google over the company’s alleged capture of data containing information about health, race, ethnicity, sexuality and finance a decade ago. The data in question was collected illegally through Apple’s Safari web browser, even when iPhone users selected a “do not track” privacy setting, he claimed.

The case states that Google bypassed Safari’s privacy settings to track users’ internet browsing history and then sell targeted advertising, using a method which has since been dubbed the “Safari workaround”.

When the workaround was discovered by Stanford University researcher Jonathan Mayer in 2012, first reported by the Wall Street Journal, Google said the loophole was unintentional. “We didn’t anticipate that this would happen,” said Rachel Whetstone, senior vice president of communications and public policy.

Representative action

Lloyd was not only representing himself but also millions of residents in England and Wales whose data was collected in this way during that period. This was a landmark case because it was the first time in UK history that an individual brought a class action on behalf of many others, without all those affected actively opting in.

This was also where the case faltered, with the court ruling that it was “doomed to fail”, reported The Law Society Gazette. It would have had a “real prospect of success” if pursued by Lloyd as an individual but could not be proven on behalf of millions of others.

The judge “did not rule out the possibility of future mass-action lawsuits if damages could be calculated”, said the BBC, which will “have implications for similar mass-action lawsuits”.

Indeed, a similar case concerning the use of children’s data was recently launched against TikTok by Anne Longfield, the former children’s commissioner, on behalf of millions of young people in the EU and UK. Facebook is also involved in a lawsuit, which alleges that user data was improperly handled.

‘A dark day’

Lloyd has been supported by the campaign group Google You Owe Us, which works to ensure “that big companies like Google respect our privacy in the future”.

The group said the Supreme Court’s ruling was a “bitter blow to UK consumers”. In a statement, Lloyd’s solicitor James Oldnall described it as “a dark day when corporate greed is valued over our right to privacy”.

“The ruling today gives Google and rest of Big Tech the green light to continue misusing our data without consent, knowing they will go unpunished,” he added.

Landmark case

Lloyd vs. Google was described as “one of the most significant cases in recent legal history”, said Sky News. In Lloyd’s letter of claim, he suggested that affected users should each receive £750 in compensation, a sum which could have totalled more than £1bn if the judges had ruled against Google.

The legal action was funded by Therium, a global litigation financing firm. Even though the lawsuit has been blocked, the millions of claimants who are part of this representative action are not liable for any costs.

Lloyd vs. Google had been ticking along for around four years. It was initially dismissed by the High Court, “which ruled it was difficult to calculate how many people had been affected or whether they had suffered damage as a result of the breach”, said the BBC.

But a later Court of Appeal ruling in October 2019 determined that Lloyd’s case was a suitable method for people to seek mass redress for data breaches. Google argued against this decision, which is why the matter went to the Supreme Court.

Arguments for the case were heard earlier this year, with the judgment finally handed down today.

‘Open the floodgates’

Those critical of Big Tech’s power will be disappointed by the ruling. Writing for The Times earlier this year, former Liberal Democrat leader Vince Cable said he hoped that the judges “make the decision the technology firms fear”.

Lloyd vs. Google could have made it “easier to bring collective damages claims for data breaches against corporate miscreants in the civil courts”, he wrote. “That could cost the tech giants billions and finally provide an incentive for them to acknowledge the primacy of our data and privacy rights.”

Tech UK, the trade group which represents Google and other technology companies, earlier warned that the ruling could “open the floodgates” to mass litigations being brought on behalf of millions of people, which could adversely affect smaller businesses.

In response to the judgment, Google said: “This claim was related to events that took place a decade ago and that we addressed at the time. People want to know that they are safe and secure online, which is why for years we’ve focused on building products and infrastructure that respect and protect people’s privacy.”