Out-Law / Your Daily Need-To-Know

Google to face High Court case on alleged breach of UK data protection rules

Out-Law News | 17 Jan 2014 | 11:30 am | 3 min. read

Google is to face a claim for damages before the High Court from three individuals who claim the company breached UK data protection laws by circumventing privacy settings deployed on their web browsers to serve them with personalised adverts.

The High Court ruled on Thursday that the arguments presented by three individuals met criteria which would merit it hearing an aspect of their case in a full trial.

The group needed the permission of the court to bring a case against Google in the UK since Google is based in the US. Mr Justice Tugendhat ruled that the group's case can be heard after dismissing Google's arguments that thresholds for having the case heard in the UK had not been met.

Editor and publisher Judith Vidal-Hall and IT security company directors Robert Hann and Marc Bradshaw are suing Google for damages. They first lodged a legal claim against the company early last year.

They argue that the company breached their privacy rights by clandestinely tracking and collating information on their internet usage on the Apple Safari browser between summer 2011 and spring 2012. Google has admitted to the tracking activity in regulatory settlements in the US but has never admitted that the activity was unlawful.

Mr Justice Tugendhat ruled that the group could raise a claim against Google that the company misused their "private information". He said their claims were sufficiently serious to be assessed in a full trial. He also said that there is a "serious issue to be tried" as to whether Google breached the UK's Data Protection Act (DPA) and whether it gave rise to liability to compensate Vidal-Hall, Hann and Bradshaw.

The three individuals have "clearly established that this jurisdiction is the appropriate one in which to try" those claims, he said.

Under section 13 of the DPA a person is generally entitled to compensation if they suffer damage as a result of violations of a section of the DPA by organisations that control their personal data. Individuals are also generally entitled to compensation from those data controllers if they suffer distress in addition to damage.

Organisations do have a defence to this right to compensation if they can "prove that [they] had taken such care as in all the circumstances was reasonably required to comply with the requirement [concerned]."

In challenging the right of the group to have their case heard before the High Court, Google argued that the information it collected from internet users' web browsers did not constitute personal data. Data protection laws only apply if the information concerned is personal data.

The company said that the information it collected should be classed as anonymous since it was aggregated and "sent to separate websites and advertising services". It said it "kept the collected browser-generated information segregated from any information held by it from which an individual could be identified".

However, Mr Justice Tugendhat said that it was "sufficiently arguable" that the data could be used to identify Vidal-Hall, Hann and Bradshaw and serve them with personalised adverts. He said it was justified to consider their claims against Google at a full trial as a result.

"[Google] would not collect and collate the information unless doing so enabled it to produce something of value," Mr Justice Tugendhat said. "The value it produces is the facility for targeted advertising of which [Vidal-Hall, Hann and Bradshaw] complain, and which yields the spectacular revenues for which Google is famous."

"The fact, if it be a fact, that Google personnel do not themselves identify any of those from whom they collect the browser-generated information is irrelevant. The point is whether [Vidal-Hall, Hann or]Bradshaw is identifiable," he said.

"The essence of [Vidal-Hall, Hann and Bradshaw's] complaint is the damage suffered by the sending back to their screens of information in the form of targeted advertisements generated from the browser-generated information. At the point at which the advertisement is visible on a user's screen, the user is likely to be identifiable to a third party viewer. Not all the information that can be deduced or inferred by a person viewing a screen which shows targeted advertisements will be private information. Far from it ... But what is specific about the complaints in this case is that the information that was, or may have been, apparent from the screens was, on particular occasions, private information," the judge added.

"These are not generic complaints. They are complaints about particular information about particular individuals, displayed on particular occasions (even though the precise dates and times of the occasions are not identified)," Tugendhat said.