Google has been granted permission by the UK Supreme Court to appeal the Court of Appeal decision in Vidal-Hall v Google, which allows data subjects in the UK to recover damages for mere distress where there has been a breach of their data protection rights.
The case concerned Google installing tracking cookies in Apple Safari browsers and collecting, without consent, information about users’ online behaviour. As we reported here, the Court of Appeal in the UK decided that data protection legislation limiting recovery to economic damage could not be interpreted as being compatible with the meaning of “damage” in the Data Protection Directive. Finding that the restriction on recovery for non-economic damage conflicted with the privacy and data protection rights contained in the EU Charter of Fundamental Rights, it struck down the relevant provision in the UK’s data protection legislation.
The UK Supreme Court has now granted Google permission to appeal both the Data Protection Directive question and the striking down of the restriction on recovery pursuant to the EU Charter of Fundamental Rights. Permission to appeal a further issue, on whether claims for misuse of private information are claims made in tort, was not granted.
It is likely to take some time for the UK Supreme Court to rule on Google’s appeal. In the meantime, the Court of Appeal’s views on damages for distress alone are likely to be relied on by claimants seeking damages in Ireland, where civil actions for data breaches have already increased dramatically.
Organisations should review their data protection incident detection and complaint response management measures on an ongoing basis. Effective data protection policies and practices are crucial to protect organisations from unwanted civil actions.
Contributed by Leo Moore and Niamh Gavin