A collective lawsuit against Google for allegedly tracking the personal data of 4m iPhone users can proceed in the UK courts, three judges ruled on Wednesday.
The Court of Appeal said Richard Lloyd, a former director of the consumer rights group Which?, could press ahead with a lawsuit against Google under the UK 1998 Data Protection Act and serve legal papers on Google in the US.
Mr Lloyd claims that Google secretly tracked the online behaviour of iPhone users in the UK between August 2011 and February 2012, bypassing the privacy settings on the handsets and collecting data from the Safari browser on users’ internet surfing habits as well as their ethnicity, health, sexuality, political views and finances.
Google then is said to have aggregated the information to create groups with labels such as “football lovers” and offered advertisers the chance to target these groups through its DoubleClick ad sales platform. It has already paid millions of dollars to US states and the US Federal Trade Commission over the Safari security bypass.
Mr Lloyd has previously estimated that if he wins at trial, damages could run to £750 per iPhone user, or a total cost of £3.3bn to Google. But it will be up to the High Court to determine any damages if he wins against Google at a future trial.
The Court of Appeal reversed an earlier decision by the High Court that had blocked the claim. Sir Geoffrey Vos, chancellor of the High Court, said that the lawsuit should proceed and added, “this case, quite properly if the allegations are proved, seeks to call Google to account for its allegedly wholesale and deliberate misuse of personal data without consent, undertaken with a view to commercial profit”.
Google will appeal to the Supreme Court. It said: “Protecting the privacy and security of our users has always been our number one priority. This case relates to events that took place nearly a decade ago and that we addressed at the time. We believe it has no merit and should be dismissed.”
Mr Lloyd called the ruling “a big decision”. “It says very clearly to big tech companies and anyone else that they can be held to account in this country,” he said.
This is the first time such a collective action — where one person represents a group with a shared grievance, akin to a US-style class action — has been brought in Britain against a leading tech company over alleged misuse of data.
Get alerts on Google LLC when a new story is published