Lexis Nexis Interview: Misuse of private information claims – where are we after Lloyd v Google?

Percy Preston of Brett Wilson LLP is interviewed about the future of misuse of private information claims after the Supreme Court's decision in Lloyd v Google [2021] UKSC 50

What are the key points the Supreme Court made in Lloyd v Google regarding misuse of private information claims?

It is important to note that the Supreme Court’s analysis of the tort of misuse of private information in Lloyd v Google is confined to obiter comment. The claimant framed his case as an attempt to recover damages under the Data Protection Act 1998 (DPA 1998) and although the court was invited to consider the relationship between the UK’s statutory data protection regime on the one hand, and the tort of misuse of private information on the other, Lord Leggatt’s unanimous judgment ultimately rested on the construction of DPA 2018, s 13.

This notwithstanding, the court did address several issues of importance to misuse of private information claims:

• The Court affirmed the principle, outlined in the Court of Appeal in Gulati v MGN [2015] EWHC 1482, that damages in a claim for misuse of private information may be awarded if it “prevents the claimant from exercising his or her right to control the use of the information.” This is in addition to any award based on distress or damage arising from the tort;
• Though the Court stopped short of asserting the existence of an independent tort of invasion of privacy, Lord Leggatt’s judgment suggests [para 98] that a privacy claim may be possible without the need for misuse; and
• Depending on the circumstances of the case, damages for misuse of private information may be awarded on an equivalent basis as those awarded for wrongful use of property, even where there has been no financial loss suffered.

In light of the comments in paragraph 98, is a claim for invasion of privacy (without the misuse element) now likely to succeed?

In Wainwright v Home Office [2004] 2 AC 406, the House of Lords stated that there is no common law tort of “invasion of privacy”.  In Campbell v MGN [2004] UKHL 22, Lord Nicholls characterised the “essence of the tort” as “misuse of private information” [para 14]. Strictly speaking, these remain authoritative statements of the law in this jurisdiction.

Whilst Lord Leggatt’s analysis of this question is confined to a few lines of his judgment at paragraph 98, he does say that cases after Campbell such as PJS v News Group Newspapers Ltd [2016] UKSC 26 are authority for the principle that “intrusion on privacy, without any misuse of private information, is actionable”. It might, however, be a stretch to suggest that this brief obiter remark represents authority for the existence of a freestanding tort of invasion of privacy; in most cases, misuse remains “the essence of the tort”.

What, if anything, are the practical implications for assessment of damages in misuse of private information claims?

At paragraph 141 of the judgment, Lord Leggatt suggests that a claim for misuse of private information based on the factual allegations in Lloyd “would naturally lend itself to an award of user damages.”  Although Mr Lloyd did not advance a claim for misuse of private information, Lord Leggatt’s judgment takes on the potentially awkward assimilation between user damages, awarded for wrongful use of property where there has been no financial loss or physical damage to the property, and misuse of private information cases where ‘information’ rather than property is at stake.

The Court seeks to reconcile the two by framing the basis of privacy as “the protection of a person’s freedom to choose and right to control whether and when others have access to his or private affairs” [para 142].  In support of this statement, Lord Leggatt cited both the fact that some people regularly exploit “facets of their private lives” for commercial gain and that the defendant’s “very purpose in wrongfully obtaining and using private information is to exploit its commercial value.” [para 142]. Privacy in information, Lord Leggatt suggests, is therefore “a commercial asset.”  It follows that damages in misuse of private information cases can be awarded on a user basis.  Lord Leggatt confirms that whether an individual had in fact chosen to exploit these rights for commercial gain is irrelevant to the question of awarding damages; what’s important is that the owner was in principle entitled to payment [para 142].

What, if anything, is the significance of Lord Leggatt’s reasoning? User damages are assessed by determining what a reasonable person would have paid for the right of the user [see paras 139-140].  In the right circumstances, and depending on the court’s assessment, we could be seeing higher awards for damages in misuse of private information claims.

Are we now likely to see more class actions for misuse of private information or are there still too many hurdles for these to succeed?

The Supreme Court’s ruling in Lloyd v Google doesn’t rule out the possibility of class actions for misuse of private information in principle. However, the question as to whether information attracts a reasonable expectation of privacy is, by its nature, dependent on an assessment of the circumstances related to the person and information in question. Indeed, Lord Leggatt speculates that this may explain why the claimant in Lloyd did not attempt to bring a claim for misuse of private information. To establish a reasonable expectation of privacy “it would be necessary to adduce evidence of facts particular to each individual claimant” [para 106]. This would obviously not be practical when bringing a claim on behalf of millions of people.

Moreover, where claimants have suffered different levels of damage, representative proceedings will not be possible (Lloyd attempted to avoid this problem by pursuing uniform user damages rather than distress).  Bringing linked claims via a Group Litigation Order will likely raise serious funding and cost recovery issues in most cases unless the damages sought by individuals are substantial.

Another potential barrier to class actions for misuse of private information claims relates to the circumstances in which such a claim is likely to arise. At paragraph 133, Lord Leggatt reaffirms that the tort misuse of private involves “strict liability for deliberate acts, not a tort based on a want of care.” In the context of large data breaches  - a situation likely to give rise to a mass claim - this would require a deliberate act from the defendant, not just negligence.

Percy Preston was interviewed by Barbora Kozusnikova

This article was first published on Lexis® PSL on 21 December 2021 and is reproduced with permission and thanks.