Goliath in court: Will the UK Supreme Court give free pass to data abusers?

NL

Share on facebook
Share on linkedin
Share on twitter

Dr. Rebecca Rumbul, lead claimant for The Privacy Collective, weighs in on the importance of Richard Lloyd’s claim against Google, and explains how the outcome of this week's Supreme Court case will have serious long term implications for our ability to control how our personal data is used by tech giants.

This is a huge week in the fight against Big Tech’s increasingly serious abuse of our right to control where and how our personal information is used.

It’s truly a defining moment for UK digital rights…

The Supreme Court is currently hearing one of the most important cases that you will likely never have heard of.

Consumer champion Richard Lloyd is taking on tech Goliath Google in a landmark case that will have significant and wide ranging ramifications for the tech industry. 

If he’s successful it will hand back power to individuals to hold tech giants accountable for their misuse of personal data.

As little as ten years ago, the phrase ‘if you don’t like it, don’t use it’ was still considered a legitimate response to what were, at the time, niche concerns about online privacy. 

Happily, times are moving on. 

The internet is now universally acknowledged to be compulsory, rather than optional, and the past year in lockdown has firmly cemented this fact. Alongside this, we have all developed a far greater understanding and concern for how our behaviour is tracked online. 

The past ten years have demonstrated with alarming clarity how algorithms and tracking software are increasingly being used to manipulate us through ads targeting our weaknesses and news feeds optimised for outrage.  

While Lloyd’s case regards a specific personal data issue concerning Google and the Safari browser, the two key points of law the Supreme Court is ruling on will ultimately determine whether similar cases concerning wholesale abuses of tracking and personal data collection can be brought in future. 

Google has joined forces with other tech giants and their lobbyists against Lloyd. They will throw the full weight of their corporate influence and power at this case to sink it. However, a ruling in favour of Lloyd can be the only outcome, if we are to retain our legal rights, our faith in the system and our freedom from online manipulation.  

First, the Supreme Court will rule on whether compensation can be sought for the “loss of control” of personal data, without needing to further specify financial loss or distress. 

It is imperative that the Court rule in Lloyd’s favour here. The “loss of control” of personal data is absolutely a harm in itself. 

Where multi-billion dollar companies are collecting personal data and profiling individuals without their consent, this loss of control is a genuine harm because of the potential for those profiles to be sold on, to be used against the interests of the individual or to be lost or stolen. 

Second, the Court will consider whether Lloyd can actually sue Google as a representative claimant on behalf of all individuals affected, based on the argument that the whole class has experienced the same harm, and therefore has the same interest in the case. 

It is absolutely crucial that the Court finds in Lloyd’s favour here. While representative class actions have rarely been brought in the UK, they are a vital weapon in the fight for the individual’s right to privacy. 

I really despise the suggestion being raised in the Supreme Court hearing that a 'loss of personal data' can be 'trivial' because 'no clear damage' is evident. Its data that has been deliberately and covertly taken by a large multinational for their own gain, without consent.

— Rebecca Rumbul (@RebeccaRumbul) April 28, 2021

In a week when Google have reported monster revenues of $55.31 billion over the first three months of 2021, it’s made clear that the financial incentives for tech giants to misuse personal data reaches into the many billions of dollars. Class actions, and the risk of meaningfully large settlements, are the only genuine deterrent. 

If representative actions are rejected as a legally viable route to claim collective redress, the alternative is that individuals be pitted against corporate giants like Google, with their teams of lawyers. And in the event of that individual winning their case, even a large individual settlement wouldn’t register on those corporations’ bottom lines, or deter them from continuing their abuse. This is why Richard’s case is so important. 

In the highly complex tech world of AI algorithms and machine learning, it takes specialist knowledge to even understand how our rights are being violated, how it can harm us and the serious implications of letting data abusers continue unchecked. In this world, the rationale for allowing informed representatives to claim compensation on the behalf of all those affected is obvious.  

If the Supreme Court finds in Lloyd’s favour, it will enable other similar claims to be brought against various tech companies that have for far too long helped themselves to our personal data without our consent or without compensating us for it.

As is common with all forms of abuse, the abuser blames the abused. In our case, these corporations claim that we consented to being continually surveilled, our behaviour profiled and our hopes, fears, relationship problems, health issues and financial difficulties, etc used to manipulate us. Our position is that clear consent for this was obviously not given, which is unlawful and needs to be stopped.

As the Lead Claimant for The Privacy Collective, I am bringing a representative action case against Salesforce and Oracle for their unlawful collection and auctioning of personal data. 

Both Salesforce and Oracle have agreements with vast networks of websites which place their tracking cookies on our internet browsers and track our behaviour across the internet, hoovering up data on our activity to create highly detailed marketing profiles. 

This surveillance goes way beyond the basic demographic profiling that many assume. Through analysing our behaviour they can tell with high levels of probability what we like, what we hate, what we want, what we’re afraid of, our strengths… and our weaknesses. 

Once these cookies are on a browser, every click, every search and every site visit is continuously being analysed to identify the triggers which marketers can then use to get us to buy their product, vote for their party, read their fake news or anything else they want us to do. These profiles are sold over and over again through an automated process called real-time bidding. 

As is common with all forms of abuse, the abuser blames the abused. In our case, these corporations claim that we consented to being continually surveilled, our behaviour profiled and our hopes, fears, relationship problems, health issues and financial difficulties, etc used to manipulate us. Our position is that clear consent for this was obviously not given, which is unlawful and needs to be stopped.

To reiterate the point, without a positive finding in favour of Lloyd, it would be the responsibility of every individual that has experienced these harms, which is everyone who uses the internet, to make an individual claim to every company that has abused their data. This is clearly absurd, unworkable and unfair. 

The ICO, the UK regulator for personal data, has no capacity to deal with this volume of individual claims, and no power to award compensation. A finding against Lloyd in this case would essentially mean that the England and Wales legal system was handing the tech giants a free pass to misuse personal data with impunity. 

Google has joined forces with other tech giants and their lobbyists against Lloyd. They will throw the full weight of their corporate influence and power at this case to sink it. However, a ruling in favour of Lloyd can be the only outcome, if we are to retain our legal rights, our faith in the system and our freedom from online manipulation. 

--

About Rebecca Rumbul

Dr Rebecca Rumbul is an internationally-recognised expert in democracy, digital and information rights. 

As Research Director at global NGO mySociety, she is a lead convenor in digital civics and consults widely on parliamentary digital development with international development agencies. 

As a Non-Executive Director of the Advertising Standards Authority UK, she has a keen interest in advertising regulation and the growing use of AdTech, and as Trustee of the Hansard Society, Rebecca works to promote excellence in legislation and governance. 

With previous experience of working in Data Protection at the Information Commissioner’s Office, Rebecca also holds significant expertise in the regulation of personal data. As lead claimant for The Privacy Collective, Rebecca is committed to using legal routes to hold big tech properly to account for abuses of personal data, on behalf of all those affected.