Tag: confidential information

The Google/Safari users case: a potential revolution in DPA litigation?

Posted on | by Robin Hopkins

I posted earlier on Tugendhat J’s judgment this morning in Vidal-Hall and Others v Google Inc [2014] EWHC 13 (QB). The judgment is now available here – thanks as ever to Bailii.

This is what the case is about: a group of claimants say that, by tracking and collating information relating to their internet usage on the Apple Safari browser without their consent, Google (a) misused their private information (b) breached their confidences, and (c) breached its duties under the Data Protection Act 1998 – in particular, under the first, second, sixth and seventh data protection principles. They sought damages and injunctive relief.

As regards damages, “what they claim damages for is the damage they suffered by reason of the fact that the information collected from their devices was used to generate advertisements which were displayed on their screens. These were targeted to their apparent interests (as deduced from the information collected from the devices they used). The advertisements that they saw disclosed information about themselves. This was, or might have been, disclosed also to other persons who either had viewed, or might have viewed, these same advertisements on the screen of each Claimant’s device” (paragraph 24).

It is important to note that “what each of the Claimants claims in the present case is that they have suffered acute distress and anxiety. None of them claims any financial or special damage. And none of them claims that any third party, who may have had sight of the screen of a device used by them, in fact thereby discovered information about that Claimant which was detrimental” (paragraph 25).

The Claimants needed permission to serve proceedings on the US-based Google. They got permission and served their claim forms. Google then sought to have that service nullified, by seeking an order declaring that the English court has no jurisdiction to try these particular claims (i.e. it was not saying that it could never be sued in the English courts).

Tugendhat J disagreed – as things stand, the claims will now progress before the High Court (although Google says it intends to appeal).

Today’s judgment focused in part on construction of the CPR rules about service outside of this jurisdiction. I wanted to highlight some of the other points.

One of the issues was whether the breach of confidence and misuse of private information claims were “torts”. Tugendhat J said this of the approach: “Judges commonly adopt one or both of two approaches to resolving issues as to the meaning of a legal term, in this case the word “tort”. One approach is to look back to the history or evolution of the disputed term. The other is to look forward to the legislative purpose of the rule in which the disputed word appears”. Having looked to the history, he observed that “history does not determine identity. The fact that dogs evolved from wolves does not mean that dogs are wolves”.

The outcome (paragraphs 68-71): misuse of private information is a tort (and the oft-cited proposition that “the tort of invasion of privacy is unknown in English law” needs revisiting) but breach of confidence is not (given Kitetechnology BV v Unicor GmbH Plastmaschinen [1995] FSR 765).

Google also objected to the DPA claims being heard. This was partly because they were raised late; this objection was dismissed.

Google also said that, based on Johnson v MDU [2007] EWCA Civ 262; (2007) 96 BMLR 99, financial loss was required before damages under section 13 of the DPA could be awarded. Here, the Claimants alleged no financial loss. The Claimants argued against the Johnson proposition: they relied on Copland v UK 62617/00 [2007] ECHR 253, argued for a construction of the DPA that accords with Directive 95/46/EC as regards relief, and argued that – unlike in Johnson – this was a case in which their Article 8 ECHR rights were engaged. Tugendhat J has allowed this to proceed to trial, where it will be determined: “This is a controversial question of law in a developing area, and it is desirable that the facts should be found”.

If the Johnson approach is overturned – i.e. if the requirement for financial loss is dispensed with, at least for some types of DPA claim – then this could revolutionise data protection litigation in the UK. Claims under section 13 could be brought without claimants having suffered financially due to the alleged DPA breaches they have suffered.

Tugendhat went on to find that there were sufficiently serious issues to be tried here so as to justify service out of the jurisdiction – it could not be said that they were “not worth the candle”.

Further, there was an arguable case that the underlying information was, contrary to Google’s case, “private” and that it constituted “personal data” for DPA purposes (Google say the ‘identification’ limb of that definition is not met here).

Tugendhat was also satisfied that this jurisdiction was “clearly the appropriate one” (paragraph 134). He accepted the argument of Hugh Tomlinson QC (for the Claimants) that “in the world in which Google Inc operates, the location of documents is likely to be insignificant, since they are likely to be in electronic form, accessible from anywhere in the world”.

Subject to an appeal from Google, the claims will proceed in the UK. Allegations about Google’s conduct in other countries are unlikely to feature. Tugendhat J indicated a focus on what Google has done in the UK, to these individuals: “I think it very unlikely that a court would permit the Claimants in this case to adduce evidence of what Mr Tench refers to as alleged wrongdoing by Google Inc against other individuals, in particular given that it occurred in other parts of the world, governed by laws other than the law of England” (paragraph 47).

Robin Hopkins @hopkinsrobin

LANDFILL OPERATOR’S INFORMATION NEITHER CONFIDENTIAL NOR COMMERCIALLY SENSITIVE

Posted on | by Robin Hopkins

First-Tier Tribunal caselaw this past week has focused on the intersection between the common law of confidence and statutory rights of access to information. Moss v IC & Home Office (EA/2011/0081) (see Anya’s post here), the Tribunal analysed section 41(2) of FOIA (information provided in confidence). Shortly thereafter, the Tribunal handed down its decision in Rory Jones (on behalf of Swansea Friends of the Earth) v IC, The Environment Agency and SI Green Ltd (EA/2011/0156). This concerned the slightly different provision under regulation 12(5)(e) of the EIR. Regulation 12(5)(e) EIR provides that “a public authority may refuse to disclose information to the extent that its disclosure would adversely affect… the confidentiality of commercial or industrial information where such confidentiality is provided by law to protect a legitimate economic interest”.

When a landfill operator such as SI Green (UK) Ltd (“Green”) obtains a permit from the Environment Agency (EA”) to operate a waste landfill, financial provision is made for covering the costs of something going wrong. Most commonly, this is done by means of a bond. In the event that any of the events specified by the bond occur, the amount secured by the bond is paid directly to the EA which can then use the funds to put matters right.

In this case, the appellant requested information relating to financial guarantee arrangements put in place by Green pursuant to its EA permit for operating a waste landfill site at Cwmrhydycierw Quarry near Swansea. The EA provided a redacted version of two documents, a performance agreement and the associated bond. It relied on regulation 12(5)(e) EIR in redacting information concerned with the amount of the bonded sum Green is required to secure for each year of operation of the landfill and going forward through a period of 60 years after operations terminate. It contended that this was commercially sensitive confidential information.

The Tribunal agreed with the Appellant that regulation 12(5)(e) was not engaged, because the redacted information was not subject to confidentiality provided by law. First, it was not provided by legislation. The Pollution Prevention and Control (England and Wales) Regulations 2000 enable landfill operators to apply for any information they provide to the EA to be excluded from the public register on the grounds that it is commercially confidential. In this case, Green had made such an application for different information to that redacted here.

Secondly, the information was not subject to common law confidentiality either. As in the Moss case, the Tribunal stuck to the 3-limb test laid down in Coco v AN Clark. In this case, the respondents’ case came unstuck on the second limb, which requires that the information must have been imparted in circumstances importing an obligation of confidence. In this respect, the Tribunal applied regulation 12(5)(e) in a very similar way to s. 41(2) of FOIA. It held that “that element [the second Coco limb] implies the communication of the information by one party to the other. The evidence in the present case, however, is that the information came into existence through a process of negotiation between the parties”. It added that “we recognise that section 41 refers more explicitly to information being “obtained” by the public authority from any other person. That is not the language of regulation 12(5)(e). However, we consider that the same element is imported by the incorporation of the common law test of breach of confidence into regulation 12(5)(e) of the EIR.”

As the exception was not engaged, the public interest test was not necessary. Nevertheless, the Tribunal held that even if the exception had been engaged, the public interest favoured disclosure. The respondents’ cases were based largely on the assumption that the redacted information would reveal useful information about Green’s operating costs in relation to the landfill site in question. The Tribunal found that the evidence before it fell “far short” of supporting that assertion. On the other hand, the public interest in disclosure was made out: “the purpose of the bond is to provide the public with protection should things go seriously wrong. Disclosing the information would allow the public to understand the level of protection that is being provided to them and for them to feel confident that the provision is sufficient to deal with potential difficulties.”

Robin Hopkins