UK Supreme Court Blocks Mass Legal Action Over Alleged Tracking of iOS Safari Users

The UK Supreme Court has blocked a mass legal action against Google over claims that it secretly tracked millions of iPhone users’ web browsing activity while telling them that it did not.

Google scored a win in the UK on Wednesday as the country’s Supreme Court blocked a class action lawsuit against the company, in which it was accused of secretly tracking millions of iPhone users, reads a new report from Bloomberg. Had it been allowed to continue, the lawsuit could have cost Google $4.3 billion USD.

The case had been brought by UK consumer rights champion Richard Lloyd, former director of Which on behalf of 5.4 million iPhone users in the UK. Lloyd’s cased was based upon Google tracking iPhone users through Apple’s Safari browser between 2011 and 2012. Using cookies, Google collected data on health, race, ethnicity, sexuality and finance even though users had chosen not to be tracked in their privacy settings.

The court said that the claim of collective damages didn’t line up with the Data Protection Act, which provides for “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.” The court said that the claim would have to prove material damage or distress, not just that data had been unlawfully processed, and that to recover compensation it would have to be proven on an individual basis.

“In order to recover compensation for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that individual suffered some damage as a result,” said George Leggatt, the judge at the ruling.

David Barker of Pinsent Masons — the firm Google hired to fight this case — wrote that the decision upholds the notion that compensation can only be asked for where real harm has been caused. And that, put simply, Google’s aggregation of personal data was insufficient to cause any real-world harm or mental distress.