The Court of Appeal decision in Google Inc v Vidal-Hall [2015] EWCA Civ 311 (27 March 2015) (Dyson MR and Sharp LJ in a joint judgment; McFarlane LJ concurring), affirming the judgment of Tugendhat J (at [2014] EWHC 13 (QB) (16 January 2014)), is a very important decision on damages for invasion of privacy, and it raises significant questions about the correctness of of Feeney J’s reasoning in the earlier Irish case of Collins v FBD Insurance plc [2013] IEHC 137 (14 March 2013).

The three claimants alleged that the defendant had tracked and collated private information about the their internet usage via their Apple Safari browser without their knowledge and consent, contrary to the defendant’s publicly stated position that such activity could not be conducted for Safari users unless they had expressly allowed it to happen (much of the technical and regulatory background is set out here by Alexander Hanff; and Judith Vidal-Hall explains here and here how she came to take on the giant that is Google). The Court held that the claimants could maintain claims against the defendant, in tort for misuse of private information, and for compensation pursuant section 13 of the Data Protection Act, 1998. The Court held that, as a matter of EU law, the section 13 claim must include compensation for for distress (non-pecuniary loss, or general damages) and must not be confined to compensation for actual damage (pecuniary loss, or special damages). However, whilst section 13(1) provides a claim for “compensation” for “damage” for contravention of the Act, section 13(2) provides more limited claims for “compensation” for “distress” (where the claimant “also suffers damage” (s13(2)(a); emphasis added), and where the contravention relates to processing of data for “special purposes” (s13(2)(b)). Nevertheless, to the extent that 13(2) put limits on claims for compensation for distress, it was dis-applied as inconsistent with the Data Protection Directive (Directive 95/46/EC).

Google has applied for permission to appeal to the Supreme Court, and a decision on the application is awaited. Meanwhile, an analysis of the decision of the Court of Appeal is instructive in the context of the decision of Feeney J in Collins, especially as regards Article 23(1) of the Directive. That Article provides:

Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.

The Court held that section 13(2) of the Act could not be interpreted compatibly with Article 23, and concluded:

105. … What is required in order to make section 13(2) compatible with EU law is the disapplication [in accordance with the principles in Benkharbouche and Janah v Embassy of Sudan [2015] EWCA Civ 33 (05 February 2015)] of section 13(2), no more and no less. The consequence of this would be that compensation would be recoverable under section 13(1) for any damage suffered as a result of a contravention by a data controller of any of the requirements of the DPA. (emphasis in original).

In the process, the divergent conclusions in Johnson v Medical Defence Union [2007] EWCA Civ 262 (28 March 2007) and the earlier Irish case of Collins v FBD Insurance plc [2013] IEHC 137 (14 March 2013) (interpreting the frankly odd section 7 of the Data Protection Act, 1988 (also here)) were rejected. “And thus” – as Christopher Knight remarked – “section 13(2) was no more. May it rest in peace. It has run down the curtain and joined the bleedin’ choir invisible”. As to Collins, the Court said:

71. … We recognise that this is authority for an interpretation of article 23 of the Directive that would exclude compensation for distress. But we are unable to place much weight on it, since it does not address any of the reasoning which … leads us to conclude that “damage” in article 23 includes non-pecuniary loss including distress. This must be right.

In Collins, in the Circuit Court, the plaintiff had been awarded general damages of €15,000 pursuant to section 7, on foot of determinations by the Data Protection Commissioner that the defendant had failed in its obligations to the plaintiff under the 1988 Act. On appeal to the High Court, Feeney J reversed, holding that damages under section 7 were not available in the absence of evidence of actual loss or damage. That section provides:

For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned …

Feeney J held that this section “does not provide, within its terms, for strict liability or for the automatic payment of compensation”, and that whilst what is required under the Directive is a provision relating to compensation, the “section does not in its express terms seek to go beyond the obligation for compensation contained in the Directive” ([3.4]-[3.5]). He therefore concluded:

3.6 Insofar as it may be said that the terms of s. 7 are ambiguous or unclear, s. 7 must be interpreted in the light of Article 23 of the Directive. … It is submitted by the defendant that the Directive limits the obligation to provide for an entitlement to compensation for the data controller to damage suffered by a person who can prove that they have, in fact, suffered damage arising from a breach of their rights pursuant to the legislation. I accept that submission.

There are two serious problems with this analysis. The first is that it seems to conflate damages for distress with strict liability. There is a world of difference between general damages for distress for breach of a duty of care on the one hand, and strict liability or automatic compensation on the other hand. General damages or damages for distress are part of the ordinary compensatory damages payable for breach of a duty of care. For example, as Finlay CJ put it in Conway v INTO [1991] 2 IR 305, 317 “in respect of damages in tort … ordinary compensatory damages … [are] sums calculated to recompense a wronged plaintiff for physical injury, mental distress, anxiety, deprivation of convenience, or other harmful effects of a wrongful act and/or for monies lost or to be lost and/or expenses incurred or to be incurred by reason of the commission of the wrongful act” (emphasis added; see also Shortt v Commissioner of an Garda Síochána [2007] 4 IR 587, [2007] IESC 9 (21 March 2007); Leech v Independent Newspapers [2014] IESC 79 (19 December 2014)). Of course, this dictum draws the usual distinction between such general damages for distress or anxiety, on the one hand, and special damages, such as monies lost or expenses incurred, on the other. But general and special damages are both normal heads of compensatory damages available in tort for breach of a duty of care. Granted, as Fenney J observed in Collins, “the tort of negligence … requires proof of damage” ([4.4]); but, as Finlay CJ made clear in Conway, such damage can and does include distress. Hence, if the damages awarded in the Circuit Court in Collins were general damages for distress, then even though they were were not special damages, they were still normal compensatory damages, and emphatically were not automatic compensation paid on a strict liability basis. If so, then Feeney J should not have reversed that award.

The second problem is that Fenney J’s analysis of the Directive is thoroughly unreasoned. He says that the defendants made a submission, and he says that he accepted it, but that is as far as his reasoning goes. He does not explain the basis on which he accepted that submission, so we are left with simply an assertion without argument, analysis, or proof. It is no surprise then that the Court of Appeal in Vidal-Hall were unpersuaded. On the other hand, that Court conducted a thorough analysis of the issue whether the obligation to provide compensation for damage in Article 23 of the Directive includes non-pecuniary loss, such as damages for distress:

76. In our judgment, the same approach to construction leads to the conclusion that article 23 of the Directive must be given its natural and wide meaning so as to include both material and non-material damage. In reaching this conclusion, we have regard to the aim of the Directive as evidenced by the recitals in the preamble and article 1 (see paras 56 and 57 above).

77. Since what the Directive purports to protect is privacy rather than economic rights, it would be strange if the Directive could not compensate those individuals whose data privacy had been invaded by a data controller so as to cause them emotional distress (but not pecuniary damage). It is the distressing invasion of privacy which must be taken to be the primary form of damage (commonly referred to in the European context as “moral damage”) and the data subject should have an effective remedy in respect of that damage. …

79. In short, article 23 of the Directive does not distinguish between pecuniary and non-pecuniary damage. There is no linguistic reason to interpret the word “damage” in article 23 as being restricted to pecuniary damage. More importantly, for the reasons we have given such a restrictive interpretation would substantially undermine the objective of the Directive which is to protect the right to privacy of individuals with respect to the processing of their personal data.

This was reinforced by an analogy with a similar provision in the Package Holidays Directive (Directive 90/314/EEC), the CJEU in Case C-168/00 Leitner v TUI Deutschland GmbhH [2002] ECR 1-1631 concluded that the “Directive implicitly recognises the existence of a right to compensation for damage other than personal injury, including non-material damage”. And it was further reinforced by a consideration of Article 8 of the European Convention on the right to privacy and of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union on the right to privacy and the right to the protection of personal data, in conjunction with Article 47 of the Charter, on the right to a fair trial and effective remedy. As Steve Peers points out, this judgment offers confirmation of the significant possibilities of using the Charter in human rights litigation. In particular, he emphasises

that the Vidal-Hall litigation concerns the application of a Directive between private parties. The judgment thus clearly demonstrates the importance of the Charter in overcoming the traditional restriction on applying Directives against private parties, where national law is incompatible with the Directives (ie, the lack of ‘horizontal direct effect’ of Directives).

The references to the Convention and the Charter are fortified in an Irish context by constitutional considerations. In Kennedy v Ireland [1987] IR 587, [1988] ILRM 472 (12 January 1987) (doc | pdf), the defendants had unlawfully tapped the plaintiffs’ telephones. Hamilton P held that this infringed their constitutional right to privacy, and he awarded them a total of £50,000 damages for the significant distress that they suffered ([1987] 1 IR 587, 594-595). In Herrity v Associated Newspapers [2009] 1 IR 316, [2008] IEHC 249 (18 July 2008), Dunne J awarded the plaintiff “ordinary and aggravated compensatory damages in the sum of €60,000 for the conscious and deliberate and unjustified breach of the plaintiff’s right to privacy and the undoubted and significant distress caused to the plaintiff as a result of that breach”. In Ogieriakhi v Minister for Justice and Equality (No 2) [2014] IEHC 582 (22 December 2014) Hogan J awarded the plaintiff €20,000 in general damages for breach of his constitutional right to a good name under Article 40.3.2.

Even if Feeney J is right that Article 23 of Data Protection Directive does not provide for general damages, he acknowledged that implementing national legislation can go beyond the requirements in the Directive. Hence, even if Article 23 does not provide for general damages, section 7 of the 1988 Act can. And having regard to Kennedy and Herrity, general damages for distress must be available for breach of the constitutional right to privacy. If the 1988 Act is to be regarded as a statutory means of vindicating that right (see EMI Records v UPC Communications Ireland Ltd [2010] IEHC 377 (11 October 2010) [67] (Charleton J); EMI Records v The Data Protection Commissioner [2012] IEHC 264 (27 June 2012) [7.3] (Charleton J)), then the principle of double construction (see McDonald v Board na gCon [1965] IR 217, 239 (Walsh J); DPP v JC [2015] IESC 31 (15 April 2015) [141] (Hardiman J)) requires that section 7 be given a constitutional construction, and provide for general damages for distress as well as special damages on proof of damage.

The analysis of Article 23 in Vidal-Hall v Google therefore raises serious questions about the correctness of the outcome in Collins v FBD. When these are coupled with the unfortunate equation of general damages for distress with automatic compensation paid on a strict liability basis, the entirety of Feeney J’s ratio falls away. It is therefore to be hoped that, if and when the issue returns to the High Court, section 7 of the Data Protection Act, 1988 will be given an interpretation that reaches general damages for distress as well as special damages on proof of loss or damage caused by the breach.