Vidal -Hall & Ors v Google Inc

The Claimants allege that the Defendant (“Google Inc”) has misused their private information, and acted in breach of confidence, and/or in breach of the statutory duties under the Data Protection Act 1998 s.4(4) (“the DPA”), by tracking and collating, without the Claimants’ consent or knowledge, information relating to the Claimants’ internet usage on the Apple Safari internet browser (“the Tracking and Collation”) between Summer 2011 and about 17 February 2012 (‘the Relevant Period”). They claim damages or compensation, and other relief, against Google Inc.

The First Claimant is a self employed editor and publisher. The Second Claimant is a company director of an IT security company. The Third Claimant is a company director of an IT services company. They all used Apple devices to access the internet. They were all resident in England and Wales (“the jurisdiction”) during the Relevant Period. They all used various Google services, such as its Search Engine, Google Maps and Gmail.

The Defendant provides its Search Engine facility and other services to internet users in this jurisdiction (and throughout the world). These are so well known that they need no description in this judgment. It provides these services for no monetary charge to the user of the device. It can do this because it collects information from the users of its services which it then processes in such a way that it can sell to suppliers what appears as space on the users’ screens. This can be used by them for advertisements which are targeted at the apparent interests of the users of devices who access the internet. Google Inc analyses the information it has collected from the users, in order to deduce from it what the interests of the users of each device are likely to be.

A claim form has to be served in accordance with the Civil Procedure Rules. Google Inc is a corporation registered in Delaware and its principal place of business is in California. Although Google UK Ltd has offices in the jurisdiction, Google Inc cannot be served within the Jurisdiction in accordance with CPR. The Claimants need the permission of the Court to serve it out of the jurisdiction. The conditions under which a defendant can be served out of the jurisdiction are laid down by law, in particular CPR r.6 and Practice Direction 6B. Permission may be granted in respect of a particular claim if the conditions in any one of the grounds are satisfied.

On 12 June 2013 the Claimants were granted permission by the Master to serve the claim form on Google Inc in Mountain View, California.

On 12 August 2013 Google Inc applied to this court for an order declaring that the English court has no jurisdiction to try these claims, and setting aside service of the claim form, and the order of the Master.

I have to decide whether to grant Google Inc’s application. If I decide a point in favour of Google Inc in respect of any of the Claimants’ claims, then the Claimants will have to bring those claims (if they can) in California or elsewhere in the USA.

It is not Google Inc’s case that they can never be sued in this jurisdiction. It accepts that in some cases it can be. And there are a number of cases decided in this court where it has been sued here. It is Google Inc’s case that the claims in this particular action do not fulfil the conditions required to be fulfilled for permission to be granted for service out of the jurisdiction.

The general principles which the court must apply on this application are not in dispute. They can be taken from Mr Tomlinson’s skeleton argument. In order to obtain permission to serve out a claimant must state which ground in paragraph 3.1 of Practice Direction 6B is relied on (CPR r6.37(1)(a)). The court will not give permission unless satisfied that England and Wales is the proper place in which to bring the claim (CPR r6.37(3)).

The Claimants stated that they relied on two grounds: paras 3.1(2) and (9). These permit service out in cases where:

“(2)

A claim is made for an injunction ordering the defendant to do or refrain from doing an act within the jurisdiction.

(9)

A claim is made in tort where (a) damage was sustained within the jurisdiction; or (b) the damage sustained resulted from an act committed within the jurisdiction.”

At the start of the hearing the Claimants issued an Application Notice dated 16 December asking for permission to rely on further grounds. The grounds permit service out in cases where:

“(11)

The whole subject matter of a claim relates to property located within the jurisdiction.

(16)

A claim is made for restitution where the defendant’s alleged liability arises out of acts committed within the jurisdiction.”

In relation to the injunction (para 3.1(2)), the discretion to grant permission will not be exercised unless: (i) an injunction is a genuine part of the substantive relief sought and has not been claimed merely to bring the case within the rule; and (ii) there is a reasonable prospect of an injunction being granted: see Civil Procedure Vol 1 2013 ed at 6.37.27.

In relation to claims in tort the requirement in para 3.1(9)(b) obliges the court to look at the tort alleged in a common sense way, and ask whether damage has resulted from substantial and efficacious acts committed within the jurisdiction, regardless of whether or not such acts have been committed elsewhere: see Civil Procedure Vol 1 2013 ed at 6.37.43.

Claimants are in general required to show, in relation to each claim, that they have a good arguable case that it falls within the ground relied on. That is sometimes expressed as a requirement that they should show that they have much the better of the argument. But where (as here) there are disputes between the parties on a number of points of law there is a degree of uncertainty as to whether that test applies. See Dicey & Morris on Conflict of Laws 15^th ed para 11-147. In some cases claimants must go further: the court must decide the question of law when it is raised on the application to set aside (which is what this application is).

But in other cases that may not be the best course, in particular where the question of law is in a developing area and the facts are in dispute. In AK Investment CJSC v Kyrgyz Mobil Ltd [2011] UKPC 7, [2011] 4 All ER 1027 Lord Collins said at paras [84]-[86]:

“84 The general rule is that it is not normally appropriate in a summary procedure (such as an application to strike out or for summary judgment) to decide a controversial question of law in a developing area, particularly because it is desirable that the facts should be found so that any further development of the law should be on the basis of actual and not hypothetical facts: e.g. Lonrho Plc. v. Fayed [1992] 1 A.C. 448 , 469 (approving Dyson v Att-Gen [1911] 1 KB 410, 414: summary procedure "ought not to be applied to an action involving serious investigation of ancient law and questions of general importance ..."); X (Minors) v Bedfordshire County Council [1995] 2 AC 633 at 741 ("Where the law is not settled but is in a state of development … it is normally inappropriate to decide novel questions on hypothetical facts"); Barrett v Enfield London BC [2001] 2 AC 550, 557 (strike out cases); Home and Overseas Insurance Co. Ltd. v Mentor Insurance Co. (U.K.) Ltd. [1990] 1 WLR 153 (summary judgment). In the context of interlocutory injunctions, in the famous case of American Cyanamid Co v Ethicon Ltd [1975] AC 396, 407 it was held that the court must be satisfied that the claim is not frivolous or vexatious, in other words, that there is a serious question to be tried. It was no part of the court's function "to decide difficult questions of law which call for detailed argument and mature consideration."

85 In Seaconsar Far East Ltd. v Bank Markazi Jomhouri Islami Iran [1994] 1 AC 438, 452, Lord Goff said that if, at the end of the day, there remained a substantial question of fact or law or both, arising on the facts disclosed by the affidavits, which the plaintiff bona fide desired to try, the court should, as a rule, allow the service of the writ. The standard of proof in respect of the cause of action could broadly be stated to be whether, on the affidavit evidence before the court, there was a serious question to be tried.

86 There is no reason why the same principle should not apply to the question whether, in a service out of the jurisdiction case …, a claim is "bound to fail" as well as to the question whether there is a "serious issue to be tried"…”

There are two requirements in addition to showing a good arguable case that each claim comes within the ground relied on. The second requirement is that a claimant must satisfy the court that there is a serious issue to be tried on the merits of the claim, i.e. a substantial question of fact or law or both. In other words, there has to be a real, as opposed to a fanciful, prospect of success on the claim.

The third requirement is that the claimant must satisfy the court that in all the circumstances England is clearly or distinctly the appropriate forum for the trial of the dispute and that in all the circumstances the court ought to exercise its discretion to permit service of the proceedings out of the jurisdiction. Where a claimant seeks leave to serve proceedings on a foreign defendant out of the jurisdiction, the task of the court is to identify the forum in which the case can be suitably tried for the interests of all the parties and for the ends of justice. In such a case the burden is on the claimant to persuade the court that England is clearly or distinctly the appropriate forum. See, for example VTB Capital Plc v Nutriek International Corp [2012] 2 Lloyd's Rep 313; [99] to [101].

The Claimants also ask for permission to rely on ground (9) in relation to the claims under the DPA. Originally they had only relied on ground (2) for the DPA claim.

Google Inc objects to my giving permission to the Claimants to rely, at this hearing, on grounds which they did not rely on before the Master. If I refuse permission to the Claimants to rely on these new grounds, then the Claimants will have to make a fresh application to the court for permission to serve out. Google Inc can then oppose it (if so advised). Google Inc submits that it should be permitted to put in evidence to deal with the new grounds, and that the Claimants gave such late notice of their intention to rely on the new grounds that they have not had a proper opportunity of considering the new evidence they might wish to rely on. The notice was very late, just before the hearing.

As to the original grounds relied on by the Claimants, Google Inc’s case is that:

The Particulars of Claim are drafted in sections. There is a general section relating to all three Claimants. There then follow the Claimant Specific Particulars of claim. These are six further sections, two in relation to each Claimant, one open and the other Confidential.

The Claimants complain that Google Inc collected information from their computers or other devices used to access the internet. But their complaint is not simply the ordinary complaint in disclosure cases: that they have suffered damage from the fact that that their information was disclosed to Google Inc. In the Claimant Specific Particulars of Claim, each Claimant describes their position in life, their internet usage, and similar matters. In the Confidential Schedules to the Claimant Specific Particulars of Claim each Claimant describes their personal characteristics, interests, wishes or ambitions, which each relies on to support their claim that they suffered distress, when they learnt that such matters were forming the basis for advertisements targeted at them, or when they learnt that, as a result of such targeted advertisements, such matters had in fact, or might well have, come to the knowledge of third parties who they had permitted to use their devices, or to view their screens.

So what they claim damages for is the damage they suffered by reason of the fact that the information collected from their devices was used to generate advertisements which were displayed on their screens. These were targeted to their apparent interests (as deduced from the information collected from the devices they used). The advertisements that they saw disclosed information about themselves. This was, or might have been, disclosed also to other persons who either had viewed, or might have viewed, these same advertisements on the screen of each Claimant’s device.

To take an example, unrelated to any of the Claimants, if the main user of a device for accessing the internet is a lawyer who uses it to search for and read websites, then the advertisements targeted back to his device by the use of the information collected by Google Inc will be likely to disclose, by implication, that that user of the device is a lawyer. That a set of targeted advertisements may reveal a user to be a lawyer is not likely to cause him or her to suffer any damage. But if the targeted advertisements apparently reveal other information about the users, whether about their personalities, or their immediate plans or ambitions, then if these matters are sensitive, or relate to protected characteristics (eg beliefs), or to secret wishes or ambitions, then the fear that others who see the screen may find out those matters, and act upon what they have seen, may well be worrying and distressing.

What each of the Claimants claims in the present case is that they have suffered acute distress and anxiety. None of them claims any financial or special damage. And none of them claims that any third party, who may have had sight of the screen of a device used by them, in fact thereby discovered information about that Claimant which was detrimental. To put the gravity of the claims in context, none of the Claimants claims to have been shunned or discriminated against as a result of a third party drawing inferences about a Claimant from what appeared on the screen of that Claimant’s device. The Claimants’ claims would have been much more serious if, for example, a Claimant had lost a job, or a partner, by reason of a third party inferring from advertisements seen on that Claimant’s screen something the viewer regarded as adverse to that Claimant.

In order to determine whether the claims, or any of them, fall within any ground it is necessary to set out parts of the contents of the Particulars of Claim. Much of the Particulars of Claim are devoted to explaining what is meant by the technical terms used, and how Google Inc’s systems work. It is unnecessary to set these out.

The technical terms explained include: “Browsers”, “Cookies” of various different types, and Google Inc’s “DoubleClick advertising service”.

The Claimants use the term “Browser-Generated Information” to refer to information which is automatically submitted to websites and services by a browser on connecting to the internet (but not, without more, retained). They claim that it includes the IP address from which the device is connected to the internet, and the specific URL of the webpage that the browser is displaying.

According to the Particulars of Claim, a particular type of cookie, called a Third Party Cookie:

“4.3(b) … is a cookie sent to a browser by a website other than the website the browser is on. A Third Party Cookie may be sent to a browser via an advertisement appearing on the website. In such cases the Third Party Cookie may be used to enable the Tracking and Collation of browsing activity across all sites or advertisements in the network operating the Third Party Cookie. The purpose of such Tracking and Collation is to gather information about the sites visited by a browser over time in order to target advertising to the apparent interests demonstrated by a user’s browsing history.”

A particular type of browser is Safari. The Claimants plead:

“5.1

Safari is the internet browser installed by Apple on all its products designed to have internet access, namely iMac, Mac, iPad, iPhone and iPod Touch.

5.2

Unlike many other internet browsers, all versions of Safari made available by Apple since the summer of 2011 were and are set by default to block Third Party Cookies. One of the main reasons why Safari was developed with this default setting was to prevent advertising-related tracking of the sort described at paragraph 4.3(b) above occurring by default, that is, without the knowledge or consent of the user (the “default privacy settings”).

5.3

Since the default privacy settings would prevent the use of certain popular web functions, such as the social ‘like’ buttons used to integrate third-party social features into websites, Apple implemented into the default privacy settings a number of specific exceptions to the default block on Third Party Cookies including as follows:

(a)

Safari allowed Third Party Cookies to be sent to it if, during the process of exchanging information with a third party domain to load third party content, the browser submitted a form to the third party domain (the “Form Submission Rule”)

(b)

Safari allowed Third Party Cookies to be sent to it if one cookie from that domain was already present on the browser (the “One In, All In Rule”)”

The effect of the Double Click ID Cookie is said to be:

“6.2

… the Defendant’s DoubleClick service provides subscribing advertisers with a service called AdSense. For the purpose of this service, subscribing advertisers provide Adsense with browsing information received as a result of the use of the DoubleClick ID Cookie in relation to the individual browsers visiting their websites, as to which see further paragraph 7 below…
7.2 … The cookie value of the Defendant’s DoubleClick ID Cookie is unique to the browser to which it is sent.

7.2

Where an individual browser’s design and settings allow it to accept Third Party Cookies, the DoubleClick ID Cookie is sent to that browser during the normal exchange of information that accompanies the display of a Google advertisement, namely, during the submission of Browser-Generated Information.

7.3

Once the DoubleClick ID Cookie has been sent to an individual browser, the DoubleClick ID Cookie allows the Defendant to recognise when that browser visits a website displaying an advertisement from the Defendant’s vast advertising network and to correlate the Browser-Generated Information for individual browsers, thereby obtaining the following information: (a) The website visited.(b) The date on which the website was visited; (c) The time at which the website was visited; (d) The duration of the visit to the website; (e) The pages of the website visited; (f) The time spent visiting each page of the website; (g) The advertisement(s) viewed; (h) Information as to where the advertisement(s) was/were placed on the website visited; (i) The IP Address of the browser, as a result of which it is often possible to determine approximate geographical location (to the nearest town or city).

7.4

Since the information set out above would be obtained by the Defendant on each occasion that the browser visited any website displaying an advertisement from the Defendant’s advertising network, over time the Defendant thereby obtained not only the information set out at paragraph 7.3 above in relation to each such website but also information as to:

(a)

the order in which websites were visited; and

(b)

the frequency with which websites were visited.

7.5

As a result of the placing of a DoubleClick ID Cookie on to a user’s browser, the Defendant was thereby able to and did obtain and collate private and/or personal information relating to users, including information relating to: (a)internet surfing habits as set out at paragraphs 7.3 and 7.4 above;(b) interests, hobbies and pastimes;(c) news reading habits;(d) shopping habits;(e) social class;(f) racial or ethnic origin; (g) political affiliation or opinion;(h) religious beliefs or beliefs of a similar nature; (i) trade union membership; (j) physical health; (k) mental health;(l) sexuality;(m) sexual interests; (n) age; (o) gender;(p) financial situation;(q) geographical location.

7.6

The Defendant then aggregated browsers displaying sufficiently similar patterns, including those of the Claimants, into groups with labels such as “football lovers’, “current affairs enthusiasts,” which group labels its DoubleClick service then offered to advertisers subscribing to Adsense to choose from when selecting the type of people that they wanted to direct their advertisements to.”

Each Claimant claims that during the Relevant Period, they used the Safari browser to access the internet, including sites and/or services owned and/or operated by the Defendant and/or viewed sites containing advertisements within the Adsense network.

There is also what is referred to as “The Intermediary Cookie” which (as set out in para 9 of the Particulars of Claim) was sent to the Safari browsers used by the Claimants. As to this the Claimants plead:

“10.1

The effect of the Intermediary Cookie’s association with the same domain name as the DoubleClick ID Cookie was that once the Intermediary Cookie had been sent to a Safari user’s browser, the One In, All In Rule (see paragraph 5.3(b) above) operated to allow the DoubleClick ID Cookie also to be automatically sent on to the user’s browser, again without the user’s knowledge or consent (the “Safari Workaround”).

10.2

As a result of the operation of the Safari Workaround during the Relevant Period the Defendant, without Safari users’ knowledge or consent thereby obtained and recorded the private and personal information referred to at paragraph 7.5 above…

The Claimants’ case as to the information obtained by Google Inc is that:

“12.1

During the Claimants’ Safari and Google usage as set out at paragraphs 11.1 to 11.3 above the Intermediary Cookie and then the DoubleClick ID Cookie were sent to the Claimants’ browsers which affected the Safari Workaround in the circumstances described at paragraphs 10 above.

12.2

As a result of the operation of the Safari Workaround, the Defendant obtained and recorded personal and/or private information relating to the Claimants and each of them falling within one or more of the categories set out at paragraph 7.5 above (the “Private Information”). Details as to which categories of information were obtained in relation to each Claimant are set out in the Confidential Schedule to the Claimant Specific Particulars of Claim….”

The claim in Misuse of Private Information is pleaded as follows:

“13.1

Each Claimant’s Private Information was information in relation to which that Claimant had a reasonable expectation of privacy….
13.3 None of the Claimants had knowledge at any material time of the existence or effect of the Safari Workaround.
14.1 The acts set out at paragraphs 9, 10 and 12 above were wrongful and constituted an unjustified infringement of each Claimant’s right to privacy and a misuse of each Claimant’s private information by the Defendant…”

The Particulars of Breach of Confidence are pleaded as follows:

“15(b) In the circumstances the Defendant was well aware, or alternatively ought to have known, that the Private Information was confidential information owned by each Claimant and that any access to or use of it or any part of it by the Defendant save for the purposes identified at paragraph 3.2 above was unauthorised.

15(c) As a result, the Defendant was during the Relevant Period under a duty of confidence towards the Claimants and each of them in relation to the Private Information and each part thereof and was not and is not entitled to access, obtain, record, or otherwise use or disclose it or Track and Collate it without either the prior consent of the Claimant concerned or alternatively adequate prior notice to him or her.

15(d) In breach of confidence and without the consent of the Claimants the Defendant unlawfully Tracked and Collated the Private Information or parts thereof in carrying out the activities set out at sub-paragraphs 12.2 and 12.3 above.”

The claim under the DPA is pleaded as follows:

“16.

Further or alternatively the Defendant processed the Claimants’ personal data during the Relevant Period in breach of its statutory duties as a ‘data controller’ to comply with the data protection principles set out at Schedules 1, 2 and/or 3 of the Data Protection Act 1998 (“the DPA”) as set out below:

(a)

The Private Information is or was at all material times ‘data’ within the meaning of section 1(1) of the DPA.

(b)

The Defendant was a ‘data controller’ within the meaning of section 1(1) of the DPA.

(c)

The Claimants were ‘data subjects’ within the meaning of section 1(1) of the DPA.

(d)

A substantial proportion of the Private Information was ‘personal data’ within the meaning of section 1(1) of the DPA.

(e)

Some of the Private Information was ‘sensitive personal data’ within the meaning of section 2 of the DPA.

17.

Pursuant to section 4(4) of the DPA the Defendant was under a duty to comply with the data protection principles in relation to all the personal data of which it was the data controller.

18.

The Defendant failed to comply with the data protection principles and thereby acted in breach of it aforementioned duty.

PARTICULARS OF BREACH

(a)

Contrary to the first data protection principle the Private Information was not processed fairly and lawfully:

(i)

Contrary to Schedule 1, Part II paragraph 2(1)(a), the Claimants were not provided with and nor did they have made readily available to them the information referred to at paragraph 2(3) therein.

(ii)

The Private Information was obtained without the knowledge or consent of the Claimants and in circumstances where the Defendant had made public statements to the effect that it would not obtain the Private Information from them: see Schedule 1, Part II, paragraph 1(1).

(iii)

None of the conditions in Schedule 2 was met.

(iv)

Further, in the case of the Private Information constituting sensitive personal data, none of the conditions in Schedule 3 was also met.

(b)

Contrary to the second data protection principle, the Private Information was not obtained only for one or more specified and lawful purposes, or alternatively was further processed in a manner incompatible with that purpose or those purposes.

(c)

Contrary to the sixth data protection principle, the Private Information was not processed in accordance with the rights of the Claimants under the DPA (see sections 7, 10, 11, 12 and 14), because the Claimants did not know and the Defendant took no steps to make them aware of the fact that it was processing their data by means of the Safari Workaround. Further, the Defendant made the public statement to the effect that it would not process the Claimants’ Private Information in that way.

(d)

Contrary to the seventh data protection principle, the Defendant failed to ensure that appropriate technical and organisational measures were taken against unauthorised or unlawful processing of the Claimants’ Private Information. Sub-paragraph (a) herein is repeated.”

There is a claim for general damages as follows:

“By reason of the Defendant’s misuse of the Claimants’ Private Information and/or breach of confidence as set out above, the Claimants and each of them have suffered damage to personal dignity, autonomy, and integrity, and have been caused anxiety and distress. Further or alternatively the Claimants were caused damage and distress, in respect of which each claims compensation pursuant to section 13 of the DPA. Particulars of the matters relied on in support of each Claimant’s claim for damages and/or compensation pursuant to section 13 of the DPA are set out in the Claimant Specific Particulars of Claim.”

In addition there is a claim for aggravated damages. To support this plea it is alleged that Google Inc ought to have been, and it is to be inferred that it was, aware of the Safari Workaround from at least a very early stage during the Relevant Period, but it chose to do nothing about it until third parties revealed what was happening.

There is a claim for an account of profits which, it is alleged, Google Inc made as a result of the misuse of each of the Claimant’s private information or by its breach of confidence.

In addition to damages, an account of profits and an injunction, the Claimants claim other relief, including confirmation that, in effect, the conduct complained of has ceased and the information deleted, and disclosure of the use to which the Claimants’ information had been put.

Mr Tench the solicitor for the Claimants has made a witness statement in opposition to Google Inc’s application In it he informs the court that there are numerous other persons, some 170, who claim to have used Safari, who also claim, that as a result of the Google Inc’s conduct complained of in this action, they have suffered damage similar to that suffered by the Claimants. Mr Tench describes the Claimants as “test claimants”. But this is not a representative action, or group litigation, and I have no evidence as to the facts of any claims other than those of these the Claimants. The application before me relates, and relates only, to the claims brought by the Claimants. While the decisions I make may affect any possible claims that might be brought by others, what I have to consider is the claims in the present proceedings.

A court may grant an injunction to prohibit a defendant from acting in breach of a claimant’s rights. But an injunction will not be granted simply as a result of a finding that a defendant has acted in breach of a claimant’s rights, or because of a subjective fear on the part of the claimant that the defendant may do so. It will be granted only if the court finds there is an appreciable risk that (absent an injunction) the defendant will in the future interfere with the claimant’s rights.

In the present case it is Google Inc’s case that there is no further risk of an interference with the Claimants’ rights of the kind that has occurred, and no evidence (or even allegation) of a risk of any similar kind of interferences. The uncontradicted evidence of Google Inc is that it ceased the conduct complained of, and has destroyed the information of the Claimants which gave rise to the conduct that affected the Claimants.

There is no dispute that, following the discovery of how Google Inc had been collecting the information from Safari browsers in the Relevant Period, Google Inc has faced regulatory sanctions in the USA. In August 2012 it agreed to pay a civil penalty of US$22.5 million to settle charges brought by the United States Federal Trade Commission (“FTC”) that it misrepresented to certain users of the Safari browser that it would not place tracking cookies or serve targeted advertisements to those users. Further, on 11 November 2013 it agreed to pay US$17 million to settle US state consumer-based actions brought against it by United States attorneys general representing 37 US states and the District of Columbia. In addition, the Defendant was required to give a number of undertakings governing its future conduct in its dealings with users in the USA.

For the Claimants Mr Tench states that the Defendant’s past and current behaviour, and responses to enforcement action by authorities, demonstrates that it has an institutionalised disregard for both the privacy of its billions of individual users and for the regulatory regimes of the countries in which it operates. So, submits Mr Tomlinson, there is a good arguable case that there is a need for an injunction, and further that the injunctions are a genuine part of the substantive relief sought and that there is a reasonable prospect that they will be granted for the reasons outlined by Mr Tench.

In my judgment the fact, if it be such, that Google Inc has on other occasions interfered with the privacy rights of other persons is not a basis on which the court could contemplate issuing an injunction in the present case. This view is supported by the fact that the Claimants have not in fact included in their Particulars of Claim any pleading of the other conduct which is referred to only in the witness statement of Mr Tench. If this could be remedied by an amendment, it might be a different matter: I might give the Claimants an opportunity to formulate a draft amendment. No application for permission to amend has yet been made. But as a matter of case management, I think it very unlikely that a court would permit the Claimants in this case to adduce evidence of what Mr Tench refers to as alleged wrongdoing by Google Inc against other individuals, in particular given that it occurred in other parts of the world, governed by laws other than the law of England.

For this reason, in my judgment the Claimants cannot bring themselves within ground 3.1(2).

There are a number of issues under this heading. Google Inc contends that:

Mr White did not advance an argument to dispute that the DPA claim counts as a claim in tort (although he objected to be being required to address the DPA claim under this head at this stage). But he did submit that the claims in breach of confidence and misuse of private information are in substance one type of claim (or cause of action) and that, whether they are the same or separate, they are not claims in tort.

This issue of law cannot be left for decision at any trial, because if the service on Google Inc stands, the issue will not arise at trial. And it is not an issue which depends upon any disputed facts.

There can be no real dispute that a claim for breach of confidence is not a claim in tort: see Kitetechnology BV v Unicor GmbH Plastmaschinen [1995] FSR 765 at 777-778.

But the least that can be said in relation to misuse of private information is that the position may be different (as Arnold J put it in Vestergaard Frandsen A/S v Bestnet Europe Ltd [2009] EWHC 1456 (Ch); [2010] FSR 2 at para [19]).

Judges commonly adopt one or both of two approaches to resolving issues as to the meaning of a legal term, in this case the word “tort”. One approach is to look back to the history or evolution of the disputed term. The other is to look forward to the legislative purpose of the rule in which the disputed word appears. A term may have may have different meanings in different contexts. What is now para 3.1 of the Practice Direction has a history which includes the RSC Order 11 rule 1, and goes back to 1852, when service out of the jurisdiction was first authorised by statute (before that proceedings could only be brought if service could be effected within the jurisdiction). In cases on the meaning of terms in para 3.1 and its predecessors, the courts have adopted the historical approach. Counsel were unable to point to any instance where the court had approached the question by looking for the legislative purpose.

Thus in Metall & Rohstoff v. Donaldson Inc. [1990] 1 Q.B. 391at p473E Slade LJ set out the ground which was then Ord 11 r.1(1) (to which ground 3.1(12) is the current successor (claims about trusts etc)) and said that, no doubt for reasons of policy, the rules clearly contemplate that any other claim which on its proper analysis is founded on a trust shall not fall within the ambit of the rule. But he assumed the reason of policy, without identifying it. And he went to say at p474C-E:

“In our judgment, it is clear beyond argument that a claim which is founded on any of the three categories of constructive trust which we have mentioned cannot be said to be “founded on a tort” within the meaning of R.S.C., Ord. 11, r. 1(1)(f). The law of tort has nothing whatever to do with any such claim. In all such cases the wrongful conduct of the defendant occurs against the background of a pre-existing trust and the claim is founded on that trust. As is stated in Salmond & Heuston on Torts, 19th ed., p. 14, under the heading “Tort and Equity:”

     “No civil injury is to be classed as a tort if it is only a breach of trust or some other merely equitable obligation. The reason for this exclusion is historical only. The law of torts is in its origin a part of the common law, as distinguished from equity, and it was unknown to the Court of Chancery.””

If there ever had been a reason of policy for not permitting service out of the jurisdiction in such cases, then it must have fallen away, because the legislature then introduced what is now ground (16). When I invited Mr White to assist me on what reason of policy there might be for not permitting service out of the jurisdiction in relation to claims based on equitable obligations (other than those specifically mentioned in the grounds in PD para 3.1), including claims for breach of confidence, the only suggestion that he was able to offer was that civil law jurisdictions do not recognise equitable obligations. But there are two observations to be made as to that suggestion. It would not explain a policy to exclude service out in the many common law jurisdictions in the world which do recognise equitable obligations. And civil law jurisdictions have managed to develop civil liability for breaches of an obligation of confidence in relation to personal information without the benefit of a historical equivalent of the law of equity. For example, French law recognised civil liability for interference with a right to privacy even before the Code Civil was amended to give a statutory right in Art 9 (Dicey & Morris on Conflict of Laws 15^th ed para34-092, text to note 465).

Moreover, history does not determine identity. The fact that dogs evolved from wolves does not mean that dogs are wolves. So the editors write that there is an argument for looking beyond the historical domestic divide between law and equity: ibid text to note 472.

Arnold J provides a clear example of a judge refusing to allow history to determine outcome in another context. In Vestegaard at para [19] he said:

“… the doctrine of joint tortfeasorship is normally applied to common law or statutory torts. Strictly speaking, breach of confidence is not a tort: see Kitetechnology BV v Unicor GmbH Plastmaschinen [1995] FSR 765 at 777-778. (Misuse of private personal information may stand in a different position: see Campbell v MGN Ltd [2004] UKHL 22 , [2004] 2 AC 457 at [14] per Lord Nicholls of Birkenhead.) On the other hand, breach of confidence has been treated as being analogous to a tort in cases such as Seager v Copydex Ltd (No 2) [1969] 1 WLR 809 and Dowson & Mason Ltd v Potter [1986] 1 WLR 1419, and it is sufficiently akin to a tort to be dealt with in textbooks on tort such as Clerk & Lindsell. At the risk of being accused of muddling equity and the common law, I believe that it is consistent with equitable principle to hold that a person who participates in a common design with a second person to act in breach of the second person's equitable obligation of confidence is jointly liable with the second person.”

What Lord Nicholls said in Campbell is:

“11 In this country, unlike the United States of America, there is no over-arching, all-embracing cause of action for 'invasion of privacy': see Wainwright v Home Office http://www.bailii.org/uk/cases/UKHL/2003/53.html [2003] 3 WLR 1137. But protection of various aspects of privacy is a fast developing area of the law, …

13 The common law or, more precisely, courts of equity have long afforded protection to the wrongful use of private information by means of the cause of action which became known as breach of confidence. A breach of confidence was restrained as a form of unconscionable conduct, akin to a breach of trust. Today this nomenclature is misleading. The breach of confidence label harks back to the time when the cause of action was based on improper use of information disclosed by one person to another in confidence. To attract protection the information had to be of a confidential nature. But the gist of the cause of action was that information of this character had been disclosed by one person to another in circumstances 'importing an obligation of confidence' even though no contract of non-disclosure existed: see the classic exposition by Megarry J in Coco v A N Clark (Engineers) Ltd [1969] RPC 41, 47-48. The confidence referred to in the phrase 'breach of confidence' was the confidence arising out of a confidential relationship.

14 This cause of action has now firmly shaken off the limiting constraint of the need for an initial confidential relationship. In doing so it has changed its nature. In this country this development was recognised clearly in the judgment of Lord Goff of Chieveley in Attorney-General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109, 281. Now the law imposes a 'duty of confidence' whenever a person receives information he knows or ought to know is fairly and reasonably to be regarded as confidential. Even this formulation is awkward. The continuing use of the phrase 'duty of confidence' and the description of the information as 'confidential' is not altogether comfortable. Information about an individual's private life would not, in ordinary usage, be called 'confidential'. The more natural description today is that such information is private. The essence of the tort is better encapsulated now as misuse of private information.” (emphasis added)

In Campbell the courts were not concerned with service out of the jurisdiction, and Mr White submits that no issue about the legal classification of the civil liability in question was before the House in the case. That is true. But, as is clear from the speeches in that case, Lord Nicholls had a reason for saying what he did.

The case most strongly relied on by Mr White was Douglas v Hello! (No 3) [2006] QB 125. One of the issues before the Court of Appeal in that case was the effect of the law of New York. The claim was based on the publication in the jurisdiction of wedding photographs taken surreptitiously in New York. Lord Phillips said this:

“96 It was not suggested that section 9(1) of the Private International Law (Miscellaneous Provisions) Act 1995 is applicable to this case, but we have none the less considered that question. That section governs the choice of law for determining issues relating to tort. The Douglases' claim in relation to invasion of their privacy might seem most appropriately to fall within the ambit of the law of delict. We have concluded, however, albeit not without hesitation, that the effect of shoe-horning this type of claim into the cause of action of breach of confidence means that it does not fall to be treated as a tort under English law, see Kitechnology BV v Unicor GmbH [1995] IL Pr 568; [1995] FSR 795 at paragraph 40, and more generally Clerk & Lindsell on Torts, (18^th edition, 2000) at footnotes 2 and 3 to paragraph 27-001. Nor has anyone suggested that the facts of this case give rise to a cause of action in tort under the law of New York (see below). Accordingly we have concluded that the parties were correct to have no regard to section 9(1) of the 1995 Act.

97 Dicey & Morris on The Conflict of Laws (13^th edition, 2000) Vol II suggest somewhat tentatively, at paragraph 34-029 and following, that a claim for breach of confidence falls to be categorised as a restitutionary claim for unjust enrichment and that the proper law is the law of the country where the enrichment occurred. While we find this reasoning persuasive, it does not solve the problem on the facts of this case. Even if the Douglases' claim for invasion of their privacy falls to be determined according to principles of English law, these may themselves require consideration of the law of New York. That indeed is the case advanced on behalf of Hello!...

100 We do not consider that the law of New York has any direct application on the facts of this case. The cause of action is based on the publication in this jurisdiction and the complaint is that private information was conveyed to readers in this jurisdiction. The test of whether the information was private so as to attract the protection of English law must be governed by English law. That test, as established by Campbell v MGN, is whether Hello! knew or ought to have known that the Douglases had a reasonable expectation that the information would remain private. Where the events to which the information relates take place outside England – in this instance in New York – the law of the place where they take place may nonetheless be relevant to the question of whether there is a reasonable expectation that the events will remain private.

101 If, in the present case, the law of New York had provided that any member of the public had a right to be present at a wedding taking place in a hotel and to take and publish photographs of that wedding, then photographs of the wedding would be unlikely to have satisfied the test of privacy. That was not the case, however. The law of New York clearly entitled the Douglases to arrange for their wedding to take place in circumstances designed to ensure that events at the wedding remained private, at least so far as photographic detail was concerned. The fact that photographs taken in violation of that privacy might have been published with impunity in New York has no direct bearing on whether the information fell to be treated as private and confidential in England. The question of whether, if unauthorised photographs of the wedding had actually been published in New York, privacy and confidentiality in England would have been destroyed is a different question, and one relevant to the next question that we have to address.

102 To summarise our conclusion at this stage: disregarding the effect of the OK! contract, we are satisfied that the Douglases' claim for invasion of their privacy falls to be determined according to the English law of confidence. That law, as extended to cover private and personal information, protected information about the Douglases' wedding.”

The 1995 Act s.9 includes:

“(1)

The rules in this Part apply for choosing the law (in this Part referred to as “the applicable law”) to be used for determining issues relating to tort or (for the purposes of the law of Scotland) delict.

(2)

The characterisation for the purposes of private international law of issues arising in a claim as issues relating to tort or delict is a matter for the courts of the forum….

(4)

The applicable law shall be used for determining the issues arising in a claim, including in particular the question whether an actionable tort or delict has occurred.”

It is important to note that, at first instance, Lindsay J decided that case on the basis of the law of confidence, and not on the basis of the law of privacy, or misuse of private information. This is clearly stated by the Court of Appeal at paras [24], [29], [83] and [144] (which cites Lindsay J’s words in para [212] of the judgment at first instance [2003] EWHC 786 (Ch)). The same point is made clear from a full reading of Lindsay J’s judgment at paras [180] to [228], and from para [229] (headed Privacy). His judgment was handed down on 11 April 2003, whereas the decision of the House of Lords in Campbell was not made until May 2004.

Mr White submitted that what the Court of Appeal said in Douglas referred to what Lord Nicholls had called the tort of misuse of private information. In my judgment that is a misreading of the case: what the Court of Appeal was referring to was the cause of action which Lindsay J had found proven, namely a breach of confidence.

And the opening words of para [96] (“It was not suggested that section 9(1) of the Private International Law (Miscellaneous Provisions) Act 1995 is applicable to this case…”) make clear that the point was made obiter and not fully argued. As the Court of Appeal stated in paras [100]-[101], the claim was based on publication to readers in this jurisdiction, and New York law has no bearing on whether the information fell to be treated as private and confidential in England.

Mr Tomlinson submits that the passage in Dicey & Morris on Conflict of Laws 15^th ed para 34-092 deserves to be revisited. I agree. The editors state that “the tort of invasion of privacy is unknown in English law”. That is correct, if by that they are referring to a general tort and to Wainwright v Home Office [2003] UKHL 53; [2004] 2 AC406. But it would not be correct to say that the specific tort of misuse of private information is unknown in English law.

This was made clear in OBG Ltd v Allan and Douglas v Hello! [2008] 1 AC 1 at para [255], where Lord Nicholls said:

“As the law has developed breach of confidence, or misuse of confidential information, now covers two distinct causes of action, protecting two different interests: privacy, and secret (“confidential”) information. It is important to keep these two distinct. In some instances information may qualify for protection both on grounds of privacy and confidentiality. In other instances information may be in the public domain, and not qualify for protection as confidential, and yet qualify for protection on the grounds of privacy. Privacy can be invaded by further publication of information or photographs already disclosed to the public. Conversely, and obviously, a trade secret may be protected as confidential information even though no question of personal privacy is involved.”

As Mr Tomlinson notes, there have since been a number of cases in which misuse of private information has been referred to as a tort consistently with OBG and these cannot be dismissed as all errors in the use of the words ‘tort’: Secretary of State for the Home Office v British Union for the Abolition of Vivisection [2008] EWHC 892 (QB), Eady J at para [28]; Imerman v Tchenguiz [2011] Fam 116 Lord Neuberger MR at para [65] (“there is now a tort of misuse of private information”); Walsh v Shanahan [2013] EWCA Civ 411 Rimer LJ at para [55] (“The tort for which Mr Walsh sued was, as Lord Nicholls of Birkenhead explained in Campbell v. Mirror Group Newspapers Ltd…, paragraph 14, one which had firmly shaken off the limiting constraint of the need for an initial confidential relationship and was 'better encapsulated now as misuse of private information'.”).

It follows that I do not read para [96] of the judgment of the Court of Appeal as referring to what Lord Nicholls called the tort of misuse of private information. What they said referred to the equitable claim for breach of confidence.

I conclude that the tort of misuse of private information is a tort within the meaning of ground 3.1(9).

However I am bound by the decision in Kitetechnology to hold that the claim for breach of confidence is not a tort. If that meant that a claim for breach of confidence is not within any of the grounds specified in para 3.1, then I have been referred to no legislative policy which might justify that. However, claims for breach of confidence will commonly come within another ground, because there will often be a sufficiently strong claim for some other relief, such as an injunction or restitution, which are specified in grounds (2) and (16). But if none of the other grounds apply, and breach of confidence is not a tort for the purpose of ground 3.1(9), then it would seem that there might be an anomaly in the law.

The damage alleged is distress and anxiety. Mr White refers to Dicey & Morris on Conflict of Laws 15^th ed para 11.216, where the editors say that the damages sustained within the jurisdiction must “refer to recoverable damage, including recoverable economic loss”. The case referred to is Booth v Phillips [2004] EWHC 1437 (Comm). That was a claim for damages for negligence by a widow both in her own right, namely the loss of her dependency, and as executrix of her husband’s estate, for funeral expenses. Permission was given to serve out under what is now ground 3.1(9) (then CPR r.6.20(8)). The defendant submitted that “damage” meant “damage which completes the cause of action in tort” (a different point from the one made by Mr White).

Mr White refers me to what Mr Teare QC (then sitting as a Deputy High Court Judge) said at para [35]-[36]:

“35 The issue between the parties is therefore one of construction of the rule. I am told there is no English authority which determines the matter but that there are Australian and Canadian cases which support the Claimant's construction.

36 I shall start (and perhaps ought to finish) with the words of the rule themselves. CPR6.20(8)(a) refers to a claim in tort where "damage was sustained within the jurisdiction". There is no reference to the damage which completes the cause of action. The Civil Procedure Act 1997 s.2(7) enjoined the Rules Committee to try "to make rules which are both simple and simply expressed." Having regard to this I do not consider it appropriate to interpret damage in CPR6.20(8)(a) as meaning "the damage which completed the cause of action in tort." It should be given its ordinary and natural meaning, namely, harm which has been sustained by the claimant, whether physical or economic. Further, it is to be observed that CPR6.20(8)(b) refers to a claim in tort where "the damage sustained resulted from an act committed within the jurisdiction." The definite article is used here whereas it is not used in CPR6.20(8)(a). This suggests that it is sufficient for the purposes of sub-paragraph (a) that some damage (not all of the damage) is sustained within the jurisdiction.”

Mr Tomlinson submits that “damage” should be given its natural and ordinary meaning, namely damage which is properly characterised as such and recoverable in the context of the tort in question. Damages for distress are recoverable in a claim for misuse of private information, eg Mosley v News Group Newspapers Ltd [2008] EMLR 679 at [216], [235]-[236]. And damages for distress are recoverable in claims under the Protection from Harassment Act 1997. Further, that damage is not confined to physical or economic harm is demonstrated by the fact that permission may be given to serve out of the jurisdiction in claims for libel (Gatley on Libel and Slander 11^th ed para 26.21).

I accept Mr Tomlinson’s submissions on this point. It follows in my judgment that the Claimants’ claim for misuse of private information falls within ground (9)(a).

Since one of the conditions for ground (9) is satisfied, it is not necessary for to consider whether the claim would also fall within ground (9)(b) (the damage sustained resulted from an act committed within the jurisdiction). But in my view it does.

Damage is alleged to have arisen from what the Claimants, and potentially third parties, have, or might have, seen on the screens of each Claimant. That is what in libel is referred to as publication, and was referred to as publication by the Court of Appeal in Douglas, cited at para 61 above (“The cause of action is based on the publication in this jurisdiction and the complaint is that private information was conveyed to readers in this jurisdiction”). So publication to the Claimants plainly was effected in this jurisdiction.

Focussing on the collecting of the information, Mr Tomlinson derives support from Ashton Investments Ltd v Rusal [2006] EWHC 2545 (Comm) [2007] 1 Lloyd’s Rep 311. In that case Mr Hirst QC (sitting as a Deputy High Court Judge) held at para [62]-[63] that:

“significant damage occurred in England where the [claimant’s] server was improperly accessed [from Russia] and the confidential and privileged information was viewed and downloaded… I also consider that substantial and efficacious acts occurred in London as well as in Russia. That is where the hacking occurred and where access to the server was achieved”.

There were two issues under this heading: first that it is too late, and second that the damage recoverable under the DPA does not include damages for distress unless there is also financial damage.

Mr White’s first submission is that it is too late, and that, to rely on the DPA claims under this ground, the Claimants will have to make a fresh application for permission to serve out. This submission would have succeeded in the past: see Metall at p436E-F and Parker v Schuller (1901) 17 TLR 299.

But Mr Tomlinson submits that this is no longer the law. In NML Capital Ltd v Republic of Argentina [2011] UKSC 31; [2011] 2 AC 495 Lord Phillips referred to these two cases and said, at para [78] that they should no longer be applied, following the introduction of the CPR. Lords Collins and Walker agreed (para [99]) with Lord Phillips. But they held that the question did not arise for decision in the proceedings there in question. As Lord Phillips explained at para [75]:

“74 … Procedural rules should be the servant not the master of the rule of law. Lord Woolf, by his Reports on Access to Justice, brought about a sea change in the attitude of the court to such rules. This included the adoption of the "overriding objective" with which the new CPR begins. CPR 1.1 states that the overriding objective of the Rules is to enable the court to deal with cases justly, and that this involves saving expense and ensuring that cases are dealt with expeditiously.

75 Where an application is made to amend a pleading the normal approach is to grant permission where to do so will cause no prejudice to the other party that cannot be dealt with by an appropriate order for costs. This accords with the overriding objective. Where all that a refusal of permission will achieve is additional cost and delay, the case for permitting the amendment is even stronger. I can see no reason in principle why similar considerations should not apply where an application is made for permission to serve process out of the jurisdiction. It is, of course, highly desirable that care should be taken before serving process on a person who is not within the jurisdiction. But if this is done on a false basis in circumstances where there is a valid basis for subjecting him to the jurisdiction, it is not obvious why it should be mandatory for the claimant to be required to start all over again rather than that the court should have a discretion as to the order that will best serve the overriding objective.”

It follows in my judgment that the Claimants are not to be debarred from relying on this ground for the DPA claims simply because they did not rely on it before the Master and have sought to rely on it only at this late stage.

Mr White’s second submission is based on the DPA s.13(1) which reads:

“(1)

An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2)

An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—

(a)

the individual also suffers damage by reason of the contravention, or (b) [which does not arise]”

In Johnson v MDU [2007] EWCA Civ 262; (2007) 96 BMLR 99 the claim was by a doctor for contravention of the DPA. The damage alleged was loss of employment or loss of insurance. It was agreed that the claimant could make no complaint under Art 8: paras [16] and [74]. After expressly noting that fact, Buxton LJ held that damage recoverable under s.13 in those circumstances was limited to pecuniary loss, and so that damages for distress could be recovered only if pecuniary damage had been suffered, which the claimant had failed to prove (para [77]).

This construction of s.13 was followed by Patten J (as he then was) in Murray v Express Newspapers Ltd [2007] EWHC 1980 (Ch) at paras [89] and [92]. In that case the claimant was an infant. The claim was in respect of photographs taken of him in the street. It was not alleged that the claimant had suffered any distress or damage as a result. So the judge struck out the claim.

On appeal the Court of Appeal took a different view, and directed that there be a trial of all issues between the parties (although in the event the case was settled). The Court’s reasons were as follows [2008] EWCA Civ 446; [2009] Ch 481:

“62 Part of the judge's reasoning which led to his striking out David's claim under the DPA was his conclusion that article 8 was not engaged and that BPL was entitled to publish or procure the publication of the Photograph in the exercise of its right to freedom of expression contained in article 10. If the trial judge were to hold that article 8 is engaged and that the article 8/10 balance should be struck in David's favour, it would follow that BPL's admitted processing of David's personal data was unlawful. The judge expressly recognised the position in [72]. It would also follow that the processing was unfair and that none of the conditions of schedule 2 to the DPA (including the only condition relied upon, namely that in paragraph 6(1)) was met: see [76].

63 In these circumstances, the issues under the DPA should be revisited by the trial judge in the light of his or her conclusions of fact. Those issues include the other issues considered by Patten J under this head, notably (but not restricted to) those relating to causation and damage. Given that there is now to be a trial, we do not think that the claims under the DPA should be struck out, whatever the conclusions of fact may be. They seem to us to raise a number of issues of some importance, including the meaning of 'damage' in section 13(1) of the DPA. It seems to us to be at least arguable that the judge has construed 'damage' too narrowly, having regard to the fact that the purpose of the Act was to enact the provisions of the relevant Directive. All these issues should be authoritatively determined at a trial.”

Mr White recognises the force of those views, but submits that the decision in Johnson v MDU nevertheless remains binding upon me.

Mr White submits that the Claimants have no good arguable case that their Art 8 rights are engaged in the present case. He submits that the distress they allege does not pass the threshold of seriousness that must be passed before a Convention right can be found to be engaged. See eg Ambrosiadou v Coward [2011] EWCA Civ 409; [2011] MRLR 21 at para [30] (in that case the court found that the claimant’s Art 8 rights were engaged in relation to some disclosed information, but not in relation to other disclosed information). He referred me to a decision in the Delaware court made on 9 October 2013 where claimants failed on the grounds that their complaints were insufficiently serious to go forward under the American law that applied to the claims there in question.

Mr Tomlinson submits that there is a good arguable case that the Claimants’ rights under Art 8 are engaged in this case. He cites The Working Party on the protection of individuals with regard to the processing of personal data (“the Article 29 Working Party”), an independent European advisory body on data protection and privacy set up under Article 29 of Directive 95/46/EC. The Working Party has considered this, and related points, on a number of occasions.

In an Opinion of the Article 29 Working Party (1/2008 (WP148) it was stated that:

“The extensive collection and storage of search histories of individuals in a directly or indirectly identifiable form invokes the protection under Article 8 of the European Charter of Fundamental Rights. An individual's search history contains a footprint of that person's interests, relations, and intentions. These data can be subsequently used both for commercial purposes and as a result of requests and fishing operations and/or data mining by law enforcement authorities or national security services.” (p.7)

It went on to say:

“In its Opinion (WP 136) on the concept of personal data, the Working Party has clarified the definition of personal data. An individual's search history is personal data if the individual to which it relates, is identifiable. Though IP addresses in most cases are not directly identifiable by search engines, identification can be achieved by a third party. Internet access providers hold IP address data. Law enforcement and national security authorities can gain access to these data and in some Member States private parties have gained access also through civil litigation. Thus, in most cases – including cases with dynamic IP address allocation – the necessary data will be available to identify the user(s) of the IP address. The Working Party noted in its WP 136 that ‘… unless the Internet Service Provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side’,. These considerations will apply equally to search engine operators.” (p.8)

And further:

“When a cookie contains a unique user ID, this ID is clearly personal data. The use of persistent cookies or similar devices with a unique user ID allows tracking of users of a certain computer even when dynamic IP addresses are used. The behavioural data that is generated through the use of these devices allows focusing even more on the personal characteristics of the individual concerned. This is in line with the fundamental logic of the dominant business model.”

In the present case the identification which is alleged to have given rise to the distress includes identification to third parties who saw, or may have seen, the individual Claimant’s screen and deduced from the targeted advertisements visible on it the personal information about that Claimant’s characteristics or wishes or ambitions. This provides an additional basis for the Claimants to submit that their claims relate to personal data.

Mr Tomlinson submits that the DPA s.13 was enacted to implement Article 23 of Directive 95/46/EC (“the Directive”). That makes the following provision as regards the obligation of Member States to provide for judicial remedy in the form of damages actions against any person who fails to comply with the national measures taken under the Directive:

“Article 23 – Liability

1.

Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.

2.

The controller may be exempted from this liability, in whole or in part, if he provides that he is not responsible for the event giving rise to the damage.”

A UK country study published by the European Commission Directorate-General in June 2010 expressed doubt as to whether liability can be limited to actual pecuniary damage compatibly with the Directive (European Commission Directorate-General Justice, Freedom and Security: Comparative Study of Different Approaches to New Privacy Challenges, In Particular In the Light of Technological Developments (Contract Nr: JLS/2008/C4/011 – 30-CE-0219363/00-28), Country Studies (Douwe Korff, Editor).

On 24 June 2010 the European Commission issued a press release announcing that it had issued a Reasoned Opinion to the UK (the second stage under EU infringement proceedings) requesting it to strengthen data protection powers. Notably, the press release recorded that

“The right to compensation for moral damage when personal information is used inappropriately is also restricted. These powers and rights are protected under the EU Data Protection Directive and must also apply in the UK. As expressed in today’s reasoned opinion, the Commission wants the UK to remedy these and other shortcomings.”

Mr Tomlinson submits that “moral damage” is a recognised EU concept connoting the right to compensation for breach of individual rights where the rights are non-pecuniary or non-property based.

He also cites Copland v UK 62617/00 [2007] ECHR 253; (2007) 45 EHRR 37. The applicant in that case was employed by a college which, it was accepted, was a public body. The complaint was that her email and internet usage was monitored, and the case proceeded on the footing that the UK admitted that fact (albeit that there was an unresolved dispute as to whether the content of the communications were read or intercepted: paras [36] and [40]). The impugned events occurred before the DPA 1998 was in force. The applicant made no claim for pecuniary damage, but claimed non-pecuniary loss for stress, anxiety, low mood and inability to sleep: para [53]. The court upheld the complaint and awarded €3,000 in non-pecuniary damage, holding, at par [44] that:

“the collection and storage of personal information relating to the applicant's telephone, as well as to her e-mail and internet usage, without her knowledge, amounted to an interference with her right to respect for her private life and correspondence within the meaning of Article 8.”

I shall consider further below whether the claims in the present case do relate to personal information. But on the assumption (for present purposes) that they do, it seems to me that Copland supports Mr Tomlinson’s submission that the alleged damage, in the form of stress and anxiety, can amount to damage sufficiently serious to engage the Claimants’ Art 8 rights.

Consideration of Copland also suggests that there might be an anomaly if Johnson v MDU applies to cases where Art 8 is engaged. Since 2000, when both the Human Rights Act 1998 and the DPA came into force, a claim such as that of Ms Copland could now be brought in an English court (whereas it could not be so brought under English law at the time in question). Today the claim could be, and on present practices probably would be, pleaded both under the DPA and as a direct claim under HRA s.6 and Art 8. See for example Clift v Slough BC [2009] 4 All ER 756, [2009] EWHC 1550 (QB), [2010] EMLR 4 paras [44]-[45]. If damages for distress are not recoverable under the DPA absent pecuniary loss, they may nevertheless be recoverable under s.6 of the HRA. If that were so, then there would be a difference between claims against public authorities (where a claim under HRA s.6 is available) and claims against others, such as Google Inc (where it is not). Although in enacting the DPA Parliament might have made different provisions for the liability of public authorities and for those who were not public authorities, in fact Parliament chose to make the same provision for both.

In the present proceedings I cannot make findings as to whether each of the Claimants did suffer what they claimed to have suffered, and, if so, how serious that was. But in my judgment at this stage each has a sufficiently arguable case that their Art 8 rights are engaged, and that they did suffer sufficiently serious damage.

If that is right, Johnson v MDU (where there was no Art 8 right engaged) is not an authority that the claims are bound to fail, absent any claim for pecuniary damage.

Since the meaning of damage under DPA s.13 is a question of law, the general rule might suggest that I should decide it, since damage (which Mr Tomlinson accepts means recoverable damage) is a jurisdictional requirement under ground (9): see para 14 above. However, unlike some jurisdictional issues of law (eg whether misuse of private information is a tort), the meaning of damage under s.13 is a question which might arise for decision at trial, if the permission to serve out is not set aside.

This is a controversial question of law in a developing area, and it is desirable that the facts should be found. It would therefore be the better course in the present case that I should not decide this question on this application.

I shall therefore not decide it. However, in case it is of any assistance in the future, my preliminary view of the question is that Mr Tomlinson’s submissions are to be preferred, and so that damage in s.13 does include non-pecuniary damage.

In my judgment, having regard to the overriding objective, the Claimants should be permitted to rely on ground (9) in relation to the DPA claim. Accordingly, and subject to consideration of the remaining points, I would refuse to set aside the Master’s order.

One argument advanced by Mr White is that there is no significant distress that can reasonably have been suffered by the Claimants by reason of the conduct complained of.

I have already considered aspects of this argument in considering whether the DPA claim can be brought within ground (9). I have in mind my conclusions (set out above) in considering the question whether there is a real or substantial tort.

It is important also to bear in mind that I am considering the claims of these Claimants. The conclusions that I have reached are based on each Claimant’s case, and each case is different. The effect of what I decided in relation to ground (9) is that, on the evidence before me, there is, in respect of the issue of recoverable damage, a sufficiently strong case to amount to a serious issue to be tried, or a real and substantial tort. And for the avoidance of misunderstanding, I have not decided that any other user of the Safari browser in the Relevant Period would have a sufficiently strong case on damage.

Nevertheless, Mr White submits that the cost of the litigation would be out of all proportion to any award of damages which the Claimants might obtain. He cites Jameel v Dow Jones & Co Inc [2005] QB 956 at para [50] (“the game would not be worth the candle”), and other cases in which the court has struck out claims, or set aside permission to serve out, on this basis. These include a privacy action, Price v Powell [2012] EWHC 3527, where I declined to strike out the action, while accepting that such actions could in principle be struck out under that jurisdiction. In Jameel at para [55] Lord Phillips of Worth Matravers MR said:

“There have been two recent developments which have rendered the court more ready to entertain a submission that pursuit of a libel action is an abuse of process. The first is the introduction of the new Civil Procedure Rules. Pursuit of the overriding objective requires an approach by the court to litigation that is both more flexible and more pro-active. The second is the coming into effect of the Human Rights Act. Section 6 requires the court, as a public authority, to administer the law in a manner which is compatible with Convention rights, insofar as it is possible to do so. Keeping a proper balance between the Article 10 right of freedom of expression and the protection of individual reputation must, so it seems to us, require the court to bring to a stop as an abuse of process defamation proceedings that are not serving the legitimate purpose of protecting the claimant's reputation, which includes compensating the claimant only if that reputation has been unlawfully damaged.”

Jameel, and most of the other cases in which the jurisdiction has been applied, have been libel actions. This is significant, because the actions concerned the exercise of, and could themselves be said to be interferences with, the rights of the defendants to freedom of expression under Art 10. The breach of confidence case which I did find to be an abuse of process, and that Mr White cited, was Abbey v Gilligan [2012] EWHC; [2013] EMLR 12: see paras [177]-[184]. The defendant in that case was a journalist, and the claim concerned information published in a newspaper. So the defendant’s Art 10 rights were engaged in that action.

I have held that there is a good arguable case that the Claimants’ Art 8 rights are engaged, and that they will overcome the threshold of seriousness. In those circumstances, for any breach of a Convention right a person has a right to an effective remedy. Until this judgment was circulated in draft I had not understood that Google Inc had, in the present case, suggested that its Art 10 rights, or any other Convention rights, are engaged. However, at that point Mr White drew my attention to a single sentence in his skeleton argument which reads: “Claims for misuse of private information/breach of confidence raise precisely the same Article 8/Article 10 issues as libel claims”. And he added that the Art 10 rights of Google Inc “plainly are [engaged] by reason of its right to disseminate information to others (for example in the form of advertising) and the right of internet users to receive that information”. I do not accept that the Browser Generated Information collected by Google Inc, or the information (derived therefrom) that it sells to its customers, is advertising. Rather I understand it to be a form of commercial information which ultimately facilitates advertising by others, and which is collected and communicated to further the private interests of Google Inc. Accordingly, the weight that can be attached to it as speech is less than that which attaches to political, journalistic or artistic expression, and is unlikely to be found to weigh significantly in the balance against the Article 8 rights relied on by the Claimants: see Gatley para 15.18(9).

As I noted in Abbey v Gilligan, Jameel abuse is not confined to defamation claims. In Sullivan v Bristol Film Studios Ltd [2012] EMLR 27, on an interim application, the judge had struck out a claim for breach of copyright applying the Jameel jurisdiction. It was significant in that case that the claimant claimed £800,000 in damages, but the judge considered the claim could only be for £50. In the Court of Appeal Lewison LJ said this, with the agreement of the other members of the court:

"29.

Section 15 (2) of the County Courts Act 1994 precludes the county court from hearing actions for libel or slander. Thus to some extent defamation actions are a special case. What is important however is that Lord Phillips recognised that a small claim should normally be dealt with by a proportionate procedure. The mere fact that a claim is small should not automatically result in the court refusing to hear it at all. If I am entitled to recover a debt of £50 I should, in principle, have access to justice to enable me to recover it if my debtor does not pay. It would be an affront to justice if my claim were simply struck out. The real question, to my mind, is whether in any particular case there is a proportionate procedure by which the merits of a claim can be investigated. In my judgment it is only if there is no proportionate procedure by which a claim can be adjudicated that it would be right to strike it out as an abuse of process".

Mr White submits that the present case will take days to try and that the costs will be out of all proportion to any benefit to the Claimants. He mentioned a figure for costs of £1.2m, but without explaining how it was arrived at. Mr Tomlinson submits that it is too soon to assess what time and costs will be required to be devoted to this action. The technical matters have been fully aired in the USA, and there appears to be little dispute about them on the Particulars of Claim and the witness statements. There is as yet no Defence.

I have already decided that there is no real prospect of the grant of an injunction. That issue will not need to be investigated. There is a claim for aggravated damages in the Particulars of Claim para 20. It focuses on what it is said Google Inc ought to have been aware of. It is not a long plea, and it remains to be seen how much will be disputed, and, if it is disputed, how much the Claimants will be advised to pursue through to any trial. I am not persuaded that there is a real prospect of the claims in this action giving rise to the length and costs of trial that Mr White suggests.

In my judgment this is not a case in which it would be just to set aside service on the ground that the game is not worth the candle.

Mr White submits that the Browser-Generated Information was not private. It is anonymous. The aggregation of such information sent to separate websites and advertising services cannot make it private information. One hundred times zero is zero, so one hundred pieces of non-private information cannot become private information when collected together.

I find this a surprising submission to be made on behalf of Google Inc. It would not collect and collate the information unless doing so enabled it to produce something of value. The value it produces is the facility for targeted advertising of which the Claimants complain, and which yields the spectacular revenues for which Google Inc is famous.

The fact, if it be a fact, that Google Inc personnel do not themselves identify any of those from whom they collect the Browser-Generated Information is irrelevant. The point is whether any Claimant is identifiable. Moreover, that is to focus attention on the transfer of information from the user to Google Inc, whereas the complaint of the Claimants does not stop at that point: indeed the essence of the Claimants’ complaint is the damage suffered by the sending back to their screens of information in the form of targeted advertisements generated from the Browser-Generated Information. At the point at which the advertisement is visible on a user’s screen, the user is likely to be identifiable to a third party viewer.

Not all the information that can be deduced or inferred by a person viewing a screen which shows targeted advertisements will be private information. Far from it. For example, if lawyers’ screens might show advertisements from which it could be inferred that they were lawyers, then that would, in most circumstances, not disclose information that was private (although it might be personal). But what is specific about the complaints in this case is that the information that was, or may have been, apparent from the screens was, on particular occasions, private information. The particular types of information specified in each of the Confidential Schedules is information for which each Claimant has a sufficiently strong case that that information was private.

These are not generic complaints. They are complaints about particular information about particular individuals, displayed on particular occasions (even though the precise dates and times of the occasions are not identified).

In my judgment the Claimants have a sufficiently good case on this point that it would be wrong to set aside the Master’s order in relation to the claims for misuse of private information.

It is not in issue that Google Inc was a data controller in respect of information collected automatically and originating from the Claimants’ browsers.

It is in issue whether Google Inc has processed personal information within the meaning of DPA s.1. That section defines “personal data” as meaning

“data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller”.

Mr White submits that on the evidence, Google Inc kept the collected Browser-Generated Information segregated from any information held by it from which an individual could be identified. For the purposes of this hearing I shall assume that it did.

Mr Tomlinson submits the DPA was passed by Parliament in implementation of the Protection of Data Directive 95/46/EC, the stated object of which was to protect privacy rights in respect of the processing of personal data. It therefore falls within the ambit of EU law and has to be understood and applied in accordance with the general principles of EU law. Article 2(a) of the Directive defines “personal data” as meaning “any information relating to an identified or identifiable natural person”.

He submits that the specific information of which the Claimants complain in this case falls within that definition, in addition to being private (for the reasons set out above). He submits that, as explained by the Working Party (cited above) the individuals from whose browsers the Browser Generated Information is collected can be identified.

Further, the potential identification of which the Claimants complain in this action includes the identification of themselves by third parties viewing their screens as persons having the characteristics which can be inferred from the targeted advertisement.

In my judgment the cases of the Claimants on this point are sufficiently arguable so that it would not be right for this court to set aside the permission to serve out granted by the Master.

I am satisfied that there is a serious issue to be tried in each of the Claimants’ claims.

The CPR 6.37(3) provides that the Court will not give permission unless satisfied that England and Wales is the proper place in which to bring the claim. I understand there to be no dispute that I can proceed on the basis of the following summary of the applicable law set out in Mr Tomlinson’s Skeleton argument on this point.

Subject to the differences set out below, the criteria that govern the application of the principle of forum conveniens are the same as those that govern the application of the principle of forum non conveniens where a stay is sought in respect of proceedings started in the jurisdiction. Those criteria are set out in Spiliada Maritime Corp v Cansulex Ltd [1987] AC 460, and are as follows:

Mr White submits that the issues at trial are likely to focus on the conduct of Google Inc and its compilation of the Browser-Generated Information. The relevant documents are likely to be in California.

Mr Tomlinson submits that there is unlikely to be a dispute requiring focus at trial on the conduct and documents of Google Inc. In any event, in the world in which Google Inc operates, the location of documents is likely to be insignificant, since they are likely to be in electronic form, accessible from anywhere in the world.

By contrast, the focus of attention is likely to be on the damage that each Claimant claims to have suffered. They are individuals resident here, for whom bringing proceedings in the USA would be likely to be very burdensome (Google Inc has not suggested which state would be the appropriate one). The issues of English law raised by Google Inc are complicated ones, and in a developing area. If an American court had to resolve these issues no doubt it could do so, aided by expert evidence on English law. But that would be costly for all parties, and it would be better for all parties that the issues of English law be resolved by an English court, with the usual right of appeal, which would not be available if the issues were resolved by an American court deciding English law as a question of fact.

I accept Mr Tomlinson’s submission that the Claimants have clearly established that this jurisdiction is the appropriate one.

By their Application Notice dated 16 December 2013 the Claimants ask for permission to serve these proceedings in the USA on grounds (11) and (16), as set out in para 11 above.

This may matter, at least in theory. I have held that the claim in breach of confidence is not within ground (9), if the information were to be found not to be private or personal, but to be confidential, then this cause of action could determine the outcome of the proceedings.

Mr White objects, not only on the basis which I have rejected (namely that a claimant can never rely on new grounds) but also on the basis that the application is too late. He submits that Google Inc should have an opportunity of considering what further evidence to adduce on the location of information (ground (11)) and the location where the material acts were committed (ground (16)).

Mr Tomlinson submits that all the relevant evidence that could be adduced has been adduced for Google Inc. He submits that confidential information is property for this purpose. He referred to Ashton at para [68], where it is recorded that counsel for the defendant did not challenge that information contained in digital form on a server in London, which was the subject matter of that action, satisfied the test under what is now ground (11). The Prayer for relief includes a claim for an order that Google Inc give information as to what has been done with the Claimants’ information.

In addition to his complaint that this application has been made so late that Google Inc has not had time to consider putting in further evidence, Mr White submits that neither side has given sufficient consideration to the law on these two new grounds. He refers to case law in which it has been said that information is not property, eg Boardman v Phipps [1967] 2 AC 46.

In my judgment there is force in Mr White’s submissions on this point in relation to Ground (11). The question whether “property” includes information of the kind here in question may not arise for consideration at any trial. It is a question of law of some difficulty. If it is to be argued on an application to set aside (or to oppose) permission to serve out, then in my judgment it should be argued in circumstances where the parties have had a proper opportunity to put the relevant evidence and submissions of law before the court.

I take a similar view in relation to the claim in restitution and ground (16). That claim is the subject of very little elaboration by the Claimants, whether in the Particulars of Claim, or in the evidence. And without forming any view on the point, I note the observations on a similar point in Ashton para [69]:

“Part 6.20(15) allows service out where the claim is made for restitution and the Defendant's alleged liability arises out of acts committed within the jurisdiction. Mr Doctor cited Douglas & ors v. Hello! Limited [2003] EWCA 139 [2003] EMLR 585 at §§23-26 for the proposition that paragraph 15 has been successfully relied upon for service out of claims for equitable relief for breach of duty. That is a pretty frail foundation – the focus of the Court of Appeal was whether there was a sufficient case of tortious conduct to justify service out. It is far too sweeping an assertion that any claim for equitable relief in respect of a breach of confidence is a claim in restitution. Some may be, but each case needs to be looked at closely on its own facts. The Particulars of Claim includes a claim for an account of profits but that does not seem a very realistic remedy on the facts of this case – it seems improbable indeed that the Defendants will have sold any ill-gotten information. This case is not in substance a claim in restitution and I am not satisfied that Part 6.20(15) can be properly invoked”.

The Claimants’ application to rely on grounds (11) and (16) will be dismissed.

In summary:

I invite the parties to submit an agreed order to reflect these conclusions.