Yesterday, Google both won, and lost. The tech giant avoided a £3.2bn claim over alleged unlawful tracking and selling of users’ data. In another breath, the EU courts rejected an appeal to overturn a €2.8bn fine. In cash terms, let’s call it even.
An important door was left open in the UK case. The Court of Appeal had previously found that “loss of control of personal data” was damage in itself. The Supreme Court disagreed. For them, the claimant had not shown damage or distress to individuals.
But, they made clear compensation claims could be made if brought differently. For example, by establishing that Google breached privacy laws first, then pursuing individual compensation claims.
The regulator, the Information Commissioner’s Office agreed compensation should be awarded for “loss of control”. Combined with an increase in GDPR enforcement, businesses still face a “double jeopardy” mix of damages claims and fines if this shift comes to fruition.