Vidal-Hall v Google Inc

[2015] EWCA Civ 311

Independent editorial summary — not the official judgment. Read the full judgment via the source link.

This page mainly applies to England and Wales. Scotland and Northern Ireland may have different rules — check the jurisdiction before relying on this information.

Ratio Decidendi

Breach of the Data Protection Act 1998 can give rise to a claim for compensation for distress alone, without requiring pecuniary loss. The misuse of private information is a tort. Service of proceedings on Google outside the jurisdiction was permitted.

Facts

Three claimants alleged that Google had tracked their internet browsing activity on Apple Safari browsers using cookies, circumventing the browser's default privacy settings, and then used this data for targeted advertising without their knowledge or consent. They claimed damages for breach of the Data Protection Act 1998 and misuse of private information.

Judgment Summary

The Court of Appeal held that s.13 DPA 1998, interpreted in light of EU Directive 95/46/EC, permitted claims for distress alone without proving financial loss. The court also confirmed that misuse of private information is a tort (not merely an equitable wrong), enabling service out of the jurisdiction. This was a significant expansion of data protection remedies.

Key Quotes

"Since what the Directive purports to protect is privacy rather than economic rights, it would be strange if the Directive could not compensate those individuals whose data privacy had been invaded by a data controller so as to cause them emotional distress (but not pecuniary damage). It is the distressing invasion of privacy which must be taken to be the primary form of damage (commonly referred to in the European context as “moral damage”) and the data subject should have an effective remedy in respect of that damage."
— Lord Dyson MR and Sharp LJ at [77](verbatim, verified against the judgment)

Subsequent Treatment

Good law

Confirmed by the Data Protection Act 2018 (s.168) which explicitly permits compensation for distress without pecuniary damage. A landmark in data privacy litigation.