There are many laws which exist on paper, but cannot easily be enforced practically. One example is data protection law, which relies largely for its enforcement on overworked data protection authorities. Individual ‘data subjects’ whose data protection rights have been infringed can sue the infringing companies directly, but they face a number of barriers in this respect.
In particular, if they have not suffered any direct economic loss, can they sue for non-economic loss? If not, there is probably little point in bringing legal proceedings – and the infringing company faces fewer constraints upon its breach of the law concerned.
Of course, this issue is not unique to data protection law. But this was the subject-matter of the important judgment of the Court of Appeal in Vidal-Hall v Google last week, which relied upon the EU Charter of Rights to strike down UK legislation which limited the ability to sue for non-economic losses as regards EU data protection law. This ruling could have broad implications not only on the enforcement of data protection rights, but also other rights protected by EU law.
The case concerned allegations that Google had infringed the data protection rights of users of Apple’s Safari browser, by getting around protections against tracking which were intended to prevent Google from collecting information on those users’ behaviour online. American litigation on the same issue had foundered due to the inability of plaintiffs to obtain damages for non-economic losses under American law, although Google had reached a settlement with federal and state regulators which entailed payment of a large penalty.
As regards UK/EU law, the Court of Appeal had to address four issues: (a) is there a tort of ‘misuse of private information’; (b) whether it was possible to sue for non-economic damage; (c) whether the information involved was ‘personal data’ for the purposes of data protection law; and (d) whether there was an arguable case in tort and data protection law. The Court decided all four issues in favour of the plaintiffs, but that does not mean they have won the case yet: at this stage, the Court of Appeal was only deciding whether documents could be served on Google in the first place.
Remedies for breach of EU law
This judgment raises many important questions of privacy rights and data protection law, and substantially advances the enforcement of those rights and that law in the UK. There are excellent discussions of these finer points already by Jon Baines, Christopher Knight and Alexander Hanff. My focus here is on the broader importance of this judgment for the enforcement of EU law rights.
The starting point in this case is the EU’s data protection Directive, which provides that any person who has suffered damage due to breach of the Directive can receive compensation from the data controller for that breach. The UK Data Protection Act implements that rule by providing (in s. 13) for separate claims for damages and distress, imposing conditions (a link to damages, or data processing for special purposes) upon any claim for distress. UK courts have interpreted s. 13 of the Act to mean that ‘damages’ can only refer to economic loss, with non-economic loss subject to the more restrictive rules relating to ‘distress’.
However, the Court of Appeal ruled that the rule in the EU Directive had a wider meaning, covering both economic and non-economic loss, basing itself on CJEU case law relating to the EU’s package holidays Directive. It based this argument on its interpretation of the aim of the Directive (protecting privacy rights), read alongside the right to privacy in Article 8 ECHR and the data protection rights in Article 7 of the EU Charter of Fundamental Rights.
But what were the consequences of this finding? First of all, the Court of Appeal rejected the possibility of using the CJEU’s principle of indirect effect, set out in case law since Marleasing, to strike down s. 13(2) of the UK Act. This is undoubtedly correct: CJEU case law makes clear that the principle of indirect effect is a rule of interpretation, requiring national courts to stretch the interpretation of national law on the books as far as possible to ensure that it implements EU law correctly. That principle reaches its limits when national law cannot be interpreted consistently with EU law, as the Court of Appeal determined in this case.
So the Court of Appeal rightly relied instead on Articles 7 and 8 of the Charter (privacy and data protection rights), applying Article 47 of the Charter (the right to a fair trial and effective remedy) to strike down national law, just as it had recently done in Benkharbouche (discussed here). That case involved a claim for employment law rights against foreign embassies, and the Court struck down the relevant provisions of the State Immunity Act to allow the suit to continue (insofar as the claims were based on EU law). The Court of Appeal did limit the impact of Article 47 of the Charter by confirming that it could not be used to strike down legislation where that would involve the courts rewriting a legislative scheme and making complex choices that should be left to the legislature to make. But that was not the case here.
As in Benkharbouche, this judgment offers confirmation of the significant possibilities of using the Charter in human rights litigation. Unlike the prior judgment, it was not necessary in Vidal-Hall to distinguish between claims linked to EU law (where the Charter applies) and claims not connected to EU law (where the Charter does not apply), because all of the claims in this case are linked to EU law. The crucial relevance of that distinction is that the Charter can be used to disapply Acts of Parliament, whereas the Human Rights Act cannot. (Moreover, any UK court can disapply an act of Parliament conflicting with the Charter, whereas only the higher courts can issue declarations of incompatibility with the Human Rights Act).
It is clear from Vidal-Hall that Article 47 can be used not just to strike down Acts of Parliament that confer immunity upon defendants, but also to strike down rules that limit heads of damage that can be recovered. It follows that many other types of restrictions on remedies could be challenged: other forms of standing rules, time limits and restrictions on legal aid, for instance. It is also clear that the ‘complex legislative scheme’ exception should not be interpreted widely: plaintiffs should target their challenges to Acts of Parliament against very precise and specific limitations in order to ensure that the exception does not apply.
The existence of this exception does mean, however, that it might be significantly more difficult to use Article 47 to ask the courts to create an entirely new remedy for breach of EU law, because the counter-argument would be that the creation of new remedies is a complex issue best left to Parliament. On the other hand, plaintiffs in such cases could also argue that the common law should develop to create new forms of remedy to ensure effective protection of Charter rights, just as tort law relating to privacy rights was clarified in Vidal-Hall.
It should be noted here that the Vidal-Hall litigation concerns the application of a Directive between private parties. The judgment thus clearly demonstrates the importance of the Charter in overcoming the traditional restriction on applying Directives against private parties, where national law is incompatible with the Directives (ie, the lack of ‘horizontal direct effect’ of Directives). The alternative option of bringing a Francovich damages action against the state for its breach of EU law is not even discussed here. Obviously it will always be simpler and cheaper for the plaintiffs to follow the direct route of disapplying the Act of Parliament in the main litigation, as compared to having to bring an action against the State instead – especially in cases like Vidal-Hall, where the merits of the case have not even been tried yet.
Furthermore, it should be emphasised that the court was applying Article 47 of the Charter to disapply UK law, not Articles 7 and 8 of the Charter, which set out the substantive rights to privacy and data protection. That is an important distinction because according to last year’s CJEU ruling in AMS (discussed here), not all Charter rights can be enforced by setting aside national law. The CJEU has yet to rule on whether Articles 7 and 8 can be enforced by this route (it dodged this bullet in Satamedia), but it will be hard to avoid it forever.
Finally, what other areas of EU law could this judgment be relevant to? A lot of EU law concerns economic damages in any event (cf the case law on private damages for breach of EU competition law). Even consumer law is largely about economic loss, too: the package holiday judgment referred to by the Court of Appeal is an exception, because in the case of holidays, consumers’ distress arises from being unable to spend their money on holiday as they had planned.
There is at least one obvious other area of EU law where this judgment may also be relevant: the free movement of EU citizens. It is possible to claim for economic loss in such cases, for instance where a person has lost his job as a result of breach of EU free movement law (see the discussion of a recent Irish judgment here). However, often the loss is purely personal: the inability to spend time with a spouse and children. There may also be some economic costs (due to the need to travel to visit a family member, or a job which is lost or cannot be applied for due to breaches of free movement law), but the inherent loss of family life is surely highly significant too. Moreover, the root human right being protected in such cases is in part the same right as that being protected in Vidal-Hall: the right to private and family life (Article 7 of the Charter, Article 8 ECHR). The next UK government should ensure full compliance with the law on ‘Surinder Singh’ cases (as discussed here), if it does not wish to expose taxpayers to considerable liability.
Photo credit: milanox.eu
Barnard & Peers: chapter 6, chapter 9