Rocket science

One of the more significant cases from 2021, will prove to be that of Lloyd v Google LLC [2021] UKSC 50 in which Lord Leggatt giving the judgment of the Supreme Court dealt a hammer blow to the concept of representative actions and narrowed the category of data breach claims where a remedy can be sought by, requiring proof of damage by an individual claimant.

158. The judge took the view that, even if the legal foundation for the claim made in this action were sound, he should exercise the discretion conferred by CPR rule 19.6(2) by refusing to allow the claim to be continued as a representative action. He characterised the claim as “officious litigation, embarked upon on behalf of individuals who have not authorised it” and in which the main beneficiaries of any award of damages would be the funders and the lawyers. He thought that the representative claimant “should not be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated”: [2019] 1 WLR 1265, paras 102-104. The Court of Appeal formed a very different view of the merits of the representative claim. They regarded the fact that the members of the represented class had not authorised the claim as an irrelevant factor, which the judge had wrongly taken into account, and considered that it was open to them to exercise the discretion afresh. They saw this litigation as the only way of obtaining a civil compensatory remedy for what, if proved, was a “wholesale and deliberate misuse of personal data without consent, undertaken with a view to commercial profit”: see [2020] QB 747, para 86. In these circumstances the Court of Appeal took the view that, as a matter of discretion, the claim should be allowed to proceed.
159. It is unnecessary to decide whether the Court of Appeal was entitled to interfere with the judge’s discretionary ruling or whether it would be desirable for a commercially funded class action to be available on the facts alleged in this case. This is because, regardless of what view of it is taken, the claim has no real prospect of success. That in turn is because, in the way the claim has been framed in order to try to bring it as a representative action, the claimant seeks damages under section 13 of the DPA 1998 for each individual member of the represented class without attempting to show that any wrongful use was made by Google of personal data relating to that individual or that the individual suffered any material damage or distress as a result of a breach of the requirements of the Act by Google. For the reasons explained in this judgment, without proof of these matters, a claim for damages cannot succeed.

Although the effect of the Supreme Court’s decision has yet to be felt, data breach as an area of practice will continue to survive and thrive, as the world moves remorselessly from an analogue economy to a digital one. I have noticed a sharp uptick in the last couple of years in costs disputes arising from data breach claims.

Three particular points are of note and which illustrate key points underpinning all these claims: in most of them damages are usually modest, yet claims for costs are always made on the basis that these are complex cases, which warrant allocation to a costs bearing track or should be pursued in the High Court. This requires consideration both of the principles relevant to allocation and also the costs rules which apply when a case settles without allocation to track. The further point is that in publication and privacy claims, ATE insurance premiums remain recoverable in principle, as an additional liability from the opposing party to litigation.

Turning to allocation arguments, an interesting case is that of Johnson v Eastlight Community Homes [2021] EWHC 3069 (QB) where a modestly valued data breach claim was issued in the High Court: the case was not struck out, but Master Thornett was critical of the notion that the claim needed to be issued in the High Court:

24.5 Everything about this case has all of the hallmarks of a Small Claim Track claim that should have been issued in the County Court and so allocated. The suggestion that this is a developing area of law or where, even if principle is established, requires elaborate and complex legal argument is unrealistic if not, at least arguably, opportunistic. Countless examples could be found daily in virtually every County Court in this jurisdiction where limited time and resources and the requirements of the overriding objective combine to oblige the pragmatic and proportionate application of legal principle. The lure of adopting a more elaborate and expensive approach just because the subject matter can so permit is simply unacceptable. Put bluntly, the garment must be cut according to the cloth. So, accordingly, is potentially complex law applied proportionately in lower value claims in a way compatible to the limited resources those cases justify. The only reason why the claim has been subject to detailed legal argument is because the Defendant is appropriately concerned to defend resolutely a claim brought in the High Court where the future costs and time to be incurred by a social housing client would always be grossly in excess of the matter in dispute and with little clear prospect of recovery even if successful. Clearly, the Defendant in raising such challenge also has to act proportionately. However, the Claimant can hardly complain if the Defendant’s response has been contextually proportionate to the very venue chosen by the Claimant in which to litigate.

24.6 Directions are therefore required for Allocation and transfer of this case. I indicated during argument that if the case were to proceed, I would allocate the claim myself before, as seemed inevitable, transferring it to the County Court. If the Claimant wishes to address the court further as to Allocation other than the Small Claims Track then she
may.

Once allocated to the Small Claims track, costs recovery in any case is likely to be nugatory, and the lawyers enthusiasm for pursing such litigation is likely to be extinguished. In a sense, the case is won or lost at the allocation stage.

If a case is swiftly settled, for a sum of less than £10,000 and without additional remedies such as undertakings being provided, then arguments will arise as to whether the case would have been allocated to the Small Claims track with consequential costs consequences. Those arguments can be ventilated on detailed assessment.

Rule 46.13 provides

46.13

(1) Any costs orders made before a claim is allocated will not be affected by allocation.

(2) Where –

(a) claim is allocated to a track; and

(b) the court subsequently re-allocates that claim to a different track,

then unless the court orders otherwise, any special rules about costs applying-(i) to the first track, will apply to the claim up to the date of re-allocation; and

(ii) to the second track, will apply from the date of re-allocation.

(3) Where the court is assessing costs on the standard basis of a claim which concluded without being allocated to a track, it may restrict those costs to costs that would have been allowed on the track to which the claim would have been allocated if allocation had taken place.

(emphasis added)

It will be seen that the fact that a Part 36 offer has been made and accepted creating a deemed costs Order for costs to be assessed on the standard basis does not preclude the court from restricting those costs to the costs allowable on the track to which the case would have been allocated, had matters gone so far.

Rule 46.13(3) predicates that (i) if the court is satisfied that the claim would have been allocated to the Small Claims Track it can (ii) exercise its discretion to restrict the costs to Small Claim Track costs.

This in turn means that the parties will draw their arguments based on consideration of what is the “normal” track per rule 26.6(3) CPR for the case as put and whether consideration of the various factors in rule 26.8 CPR indicate that it might have found a home on another track.

The rule also provides an incentive for the parties to settle a case on the merits as quickly and efficiently as possible, without being overly concerned as to whether they should delay the settlement until after allocation in order to achieve clarity on the costs position.

The rule is an interesting evolution from the case law on costs in low value claims and is  another preliminary Point of Dispute, which can have devastating consequences on a Bill of Costs despite the making of a deemed costs Order on a standard basis.

Turning to the issue of ATE insurance premiums, publication and privacy proceedings are defined to mean proceedings for

(a) defamation;
(b) malicious falsehood;
(c) breach of confidence involving publication to the general public;
(d) misuse of private information, or
(e) harassment, where the defendant is a news publisher
 
it will be observed that data breach is not per se, a claim that falls within the definition of publication and privacy proceedings. But an ATE insurance premium is often sought on the basis that in addition to a claim for data breach there has been a breach of confidence and a misuse of private information: applying the principle that an ATE premium is for these purposes an indivisible item of common costs, not capable of apportionment, recovery of the full premium is sought. But not all such cases will properly include all three claims.
 
In the case of Darren Lee Warren v DSG Retail Limited [2021] EEWHC 2168 (QB) a claim for negligence was also made, but the defendant applied to strike out all the claims except for one made under the Data Protection Act 1998:
 
1. The Defendant (“DSG”) is the well-known retailer operating the ‘Currys PC World’ and ‘Dixons Travel’ brands. Between 24 July 2017 and 25 April 2018, DSG was the victim of a complex cyber-attack (the “Attack”), carried out by sophisticated and methodical criminals (the “Attackers”). The Attackers infiltrated DSG’s systems and installed malware which was running on 5,930 point of sale terminals at the stores. In the course of the Attack, the Attackers accessed the personal data of many of DSG’s customers.
 
2. The Information Commissioner investigated the circumstances of the Attack and decided that DSG breached the seventh data protection principle (DPP7). She issued a Monetary Penalty Notice (MPN) in the amount of £500,000. That is subject to an appeal to be heard later this year before the FTT.
 
3. The Claimant, Darren Lee Warren, had purchased goods from Currys PC World and claims that the following personal information or data concerning him was compromised in the Attack: his name, address, phone number, date of birth and email address.
 
4. As a result of that event, the Claimant has brought this claim against DSG as the relevant data controller for damages limited to £5,000.00. Those damages are not claimed as a result of any personal injury but, as described in more detail below, are damages in respect of distress the Claimant suffered as a result of his personal data
being compromised and lost. The causes of action relied upon are breach of confidence (“BoC”), misuse of private information (“MPI”), breach of the Data Protection Act 1998 (“DPA”), and common law negligence.
 
5. By an Application Notice dated 17 June 2021, DSG seeks summary judgment and/or an order striking out each of these claims apart from the claim for breach of statutory duty arising out of alleged breach of DPP7. DPP7 requires “appropriate technical and organisational measures to be taken against unauthorised or unlawful processing of
data”. Just before the hearing before me the Claimant undertook to discontinue his claims in respect of other alleged breaches of data protection principles.
 
The High Court judge went on to strike out most of the proceedings:
 
43. DSG’s application succeeds. All claims are dismissed and/or struck out save as regards the claim for breach of statutory duty in relation to DPP7. As indicated above, Counsel for the Claimant submitted that by amendment the claim might be saved or improved. It was said that this would be done after the FTT appeal and factual findings in that process. That is not an answer to DSG’s application which concerns the only current pleaded case before the court. This is not a case where I was presented with a draft pleading which sought to cure the problems.
 
44. That remaining claim is transferred to the County Court for directions following expiry of the stay pending the FTT appeal.
 
One of the consequences, of such a ruling would be that no claim for recovery of the ATE insurance premium could be made, as the claim properly analysed did not involve “publication and privacy” proceedings.
 
In summary, although the Google case will have profound effects on the development of data breach litigation, and representative actions more generally, already the existing body of data breach litigation is generating plenty of costs disputes, which show no sign of abating.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: