Shielding Tech: Supreme Court rejects iPhone tracking case

November 15, 2021

3 min read

Sign up to our mailing list! 👇

What's going on here?

On Wednesday 10 November 2021, the UK Supreme Court blocked a class action against Google for its collection of iPhone data in 2011 and 2012.

What does this mean?

Google was taken to court by the former director of Which?, Richard Lloyd, on behalf of 4.4m iPhone users to seek damages for data privacy violations. The case is based on Google’s alleged collection of data through the Safari browsing app on iPhones between 2011 and 2012, including users who had “do not track” turned on. The case began back in 2017 but was before the Supreme Court on Wednesday 10 November 2021, who ruled in Google’s favour. The Court held that the statute Mr Lloyd used for his legal claim, the Data Protection Act 1998, does not permit damages payouts for data breaches. The Court did suggest individual victims could seek compensation through the courts, but rejected the use of representative action suits (where a large group acts together) for data breach damages.

What's the big picture effect?

The most immediate effect of the case is the affected iPhone users will not get any compensation. Although the payouts will have been small, the large number of claimants meant Google’s bill would have been £3.2bn.

As the UK’s first representative action case on data privacy breaches, it has set a few legal precedents:

  1. Representative action can be used to establish liability for breaches, but cannot be used to seek damages;
  2. Those seeking compensation for breaches will need to bring individual cases before the courts; and
  3. It did not set a precedent for the use of ‘opt-out’ representative actions where all potential victims are included unless they explicitly state otherwise (even if they’ve not been identified yet). Instead, individuals still need to be identified, named, and opt-in, adding time and money to a case’s lifespan. 

Tech firms can breathe a sigh of relief. The use of representative action for damages would have seen them faced with an influx of claims for data breaches past and present, and the move to ‘opt-out’ would have made these cases easier to launch. This would cost more money in regulatory compliance, legal fees, and damages payouts. It will discourage a lot of claimants too – the compensation will not always be determinable before the final judgment and it could be a lot less than the legal fees required. The process would be more stressful and time-consuming for claimants, the company at fault, and the courts compared to a representative action. For these reasons, it is fair to judge most claimants won’t take the case any further. 

The Confederation of British Industry (CBI) had feared that if Google were forced to pay out, investors would have shied away from tech firms working with large volumes of data. This could have slowed down innovation and competition and put an end to the UK tech sector’s rapid growth. If start-ups were unable to raise as much money, fewer new jobs would be created and we might have seen market consolidation around larger firms, like Google, who already have an established range of diverse products and millions of global corporate and private clients. Instead, the rejection of the suit has maintained Britain’s status as a favoured home for tech. Research commissioned for the Digital Economy Council showed that in 2019, “UK-based tech firms received more [venture capital] than Germany (£5.4bn) and France (£3.4bn) combined” – this success looks set to continue now tech firms can feel more secure in UK operations.

This decision could also impact similar cases currently ongoing. For example, Anne Longfield, the former Children’s Commissioner, has brought a case against TikTok for its use of children’s data. Longfield alleges the children cannot give informed consent. Similarly, Facebook is facing a representative action over third-party app “This Is Your Digital Life” and its use of data between 2013 and 2015. This was filed on behalf of users whose data was used without their consent when their Facebook friends used the app.

The precedent set last week could mean Tiktok or Facebook will be found liable in the current cases, but lawyers may have a head-start in preparing individual suits to assess the damages and associated compensation required in cases, in line with the Supreme Court’s judgment.

Report written by Phoebe Turner

Share this now!

Check out our recent reports!