Full case report
Vidal-Hall v Google Inc
Reference  EWHC 13 (QB)
Court High Court, Queen's Bench Division
Judge Tugendhat J
Date of Judgment 16 Jan 2014
Privacy – Breach of Confidence – Data Protection – misuse of private information – damage under the Data Protection Act
The first, second and third claimants (the Cs) were individuals who had used Apple devices to access the internet, and who had also used various Google services. D was Google Inc, which was registered in Delaware, and based in California and could not be served within the jurisdiction in accordance with the CPR.
The Cs’ claim was based on the distress suffered from learning that their personal characteristics formed the basis for D’s targeted advertisements, or from having learnt that such matters might have come to the knowledge of third parties who had used or seen their devices. The Cs’ claims were exclusively for distress and anxiety, not financial damage.
The Cs used Apple’s Safari browser, which was set to block Third Party Cookies which would enable the tracking and collation of browser activity. The Cs pleaded that a Safari workaround operated by D allowed it to obtain and record information about their internet use and use it for the purposes of its AdSense advertising service. They pleaded that D collated their private and personal information and used it to serve adverts to them via Adsense.
The Cs’ claims were in misuse of private information, breach of confidence, and under the Data Protection Act 1998 (DPA). The Cs claimed general and aggravated damages, an account of profits, an injunction and other relief.
The Cs were granted permission by the Master to serve the claim form on D in California. In order to obtain permission to serve out, the Cs relied on two grounds in paragraph 3.1 of Practice Direction 6B, those found in paras 3.1(2) and (9). These permit service out in cases where:
“(2) A claim is made for an injunction ordering the defendant to do or refrain from doing an act within the jurisdiction.
(9) A claim is made in tort where (a) damage was sustained within the jurisdiction; or (b) the damage sustained resulted from an act committed within the jurisdiction.”
At the start of the hearing, the Cs issued an application notice for permission to rely on two further grounds, which permit service out in cases where
“(11) The whole subject matter of a claim relates to property located within the jurisdiction.
(16) A claim is made for restitution where the defendant’s alleged liability arises out of acts committed within the jurisdiction.”
D applied for an order declaring that the English court had no jurisdiction to try the claims, and setting aside the service of the claim form, and the order of the Master.
On D’s application:
(1) Should the Master’s order for service out of the jurisdiction be set aside on the basis that the Cs did not come within the grounds in PD 6B, para 3.1, being
(a) 3.1(2); and
(b) 3.1(9); there were four subsidiary issues under this ground:
i. were the claims in tort?
ii. was the claim for damage within the meaning of 3.1(9)(a)?
iii. was the act complained of within the jurisdiction?
iv. could the Cs be permitted to rely on this ground for the DPA claims, firstly because it was too late, and, secondly, because damage recoverable under the DPA does not include damage for distress unless there is also financial damage?
(2) Was there a serious issue to be tried or a real and substantial tort? There were three subsidiary questions arising from this issue:
(a) Were the claims a Jameel abuse of process?
(b) Was the information private?
(c) Was the data personal data within the meaning of the DPA?
(3) Did the English court have jurisdiction to try the claim?
On the Cs’ cross application:
(4) Could they serve proceedings out of the jurisdiction on the two further grounds in PD 6B, being
(a) 3.1(11); and
Dismissing D’s application to set aside permission to serve out, and dismissing the Cs’ application to rely on two further grounds to serve out.
(1) Of the available grounds for granting permission to serve out:
(a) The Cs could not bring themselves within the ground in 3.1(2). The fact that D had on other occasions interfered with the privacy rights of other persons was not a basis on which the court could contemplate granting an injunction.
(i) There was no dispute that the DPA claim counted as a claim in tort; there was no real dispute that the claim for breach of confidence was not a tort; and, in relation to misuse of private information, this was a tort within the meaning of ground 3.1(9).
(ii) Damages for distress are recoverable in a claim for misuse of private information, and the Cs’ claim for misuse of private information fell within ground (9)(a).
(iii) The publication complained of by the Cs was effected within the jurisdiction.
(iv) Firstly, the Cs were not debarred from relying on this ground for the DPA claim because they did so at this late stage. Second, the Cs each had a sufficiently arguable case that their Art 8 rights were engaged, and that they did suffer sufficiently serious damage. Although the meaning of damage under the DPA was a question of law and the general rule might have suggested that the judge should decide it, this was a controversial question of law in a developing area and it was desirable that the facts should be found. The judge did not decide the question. However, his preliminary view was that damage in s 13 of the DPA did include non pecuniary damage.
(a) The effect of the judge’s conclusions on distress and whether the DPA claim could be brought within ground (9) was that, on recoverable damage, there was a sufficiently strong case to amount to serious issue to be tried, or a real and substantial tort.
Having held that the Cs’ article 8 rights were engaged and that they would overcome the threshold of seriousness, the Judge did not attach weight to Google’s dissemination of information through advertising in any balancing exercise with Article 8 rights.
This was not a case in which it would have been just to set aside service on the grounds that the game would not be worth the candle.
(b) The information that was apparent from the Cs’ screens was, on particular occasions, private information.
(c) The Cs had sufficiently arguable cases that their information was personal data for the purposes of the DPA s1.
(3) The Cs had clearly established that this jurisdiction was the appropriate one.
(a) The question of whether property included information of the kind in question was a question of law of some difficulty and should have been argued in circumstances where the parties had had a proper opportunity to put the relevant evidence and submissions of law before the court.
(b) The claim in restitution was the subject of very little elaboration by the Cs, and the judge noted the observations of the judge in Ashton Investments Ltd v Rusal  1 Lloyd’s Rep 311 on a similar point that the claim in that case was not in substance one in restitution.
There are two main points of interest in the decision. The first is that it confirms that misuse of private information is a tort. Although this had been stated in a number of earlier judgments, which were cited here, there was a lingering doubt about the status of the cause of action. The fact that the issue was fully argued here with reference to all of the relevant authorities, and the expertise of the judge in this field, do make this a significant statement of the law.
The second is that the judge indicated in a preliminary view that damages for a breach of the DPA could include non pecuniary damage. The impact of the DPA in privacy law has to date been limited by the requirement that damage for distress could only be recovered if pecuniary damage had been suffered. This development has the potential to make claims under the DPA far more common in the field of privacy law.
Note: The Upper Tribunal was invited, but declined to follow Tugendhat J’s prelimunary view on the meaning of damage under the DPA when considering another provision of the Act. See here for further details.
Olswangs LLP for the Cs; Bristows LLP for D.
More from 5RB
“known for its indisputable quality in the areas of defamation, privacy, contempt and data protection.” Get the lowdown here.
New 3rd Edition of The Law of Privacy and the Media, published by OUP. Further details here.