Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 47 - Right to an effective remedy and to a fair trial
Key facts of the case:
The case was an appeal by Google Inc, which is based in the US, against a decision holding that the English courts had jurisdiction to try the claims by three UK internet users for misuse of private information and breach of the Data Protection Act 1998 (DPA) (which transposes EU Directive 95/46). Google had tracked private information about the claimants’ internet usage without their knowledge or consent by using cookies and given that information to third parties, while Google’s publicly stated position is that such activity would not be performed without users’ consent. The claimants sought damages under Section 13 of the DPA for distress while not having suffered pecuniary loss. In order to obtain permission to serve the proceedings out of the jurisdiction, the claimants successfully established that there was a serious issue to be tried, that their claims came within the “injunction” and “tort” jurisdictional gateways of Paragraph 3.1 (9) of the Civil Procedure Rules Practice Direction 6B (CPR PD 6B) and that England was the correct trial forum.
Outcome of the case:
The court held that the English courts had jurisdiction to try the claims for misuse of private information and the claim under the DPA. The appeal by Google Inc was dismissed. The court held that, on the basis of the CJEU’s decision about Directive 95/46 in Leitner v TUI Deutschland GmbH & Co KG, “damage” could include moral non-pecuniary damage such as distress. The court further held that it was important that there was an effective remedy available for a distressing invasion of privacy as Articles 7 and 8 of the Charter make specific provision for the protection of personal data. Section 13 of the DPA, when interpreted literally as “damage” being pecuniary loss, had not effectively transposed Article 23 of Directive 95/46 into domestic law. Having regard to Article 47 of the Charter, the court disapplied Section 13 of the DPA with the result that compensation would be recoverable for any damage suffered.
78. Additionally, article 8 of the Charter of Fundamental Rights of the European Union ("the Charter") makes specific provision for the protection of the fundamental right to the protection of personal data: "everyone has the right to the protection of personal data concerning him or her". It would be strange if that fundamental right could be breached with relative impunity by a data controller, save in those rare cases where the data subject had suffered pecuniary loss as a result of the breach. It is most unlikely that the Member States intended such a result.
...
95. Mr Tomlinson and Ms Proops submit that section 13(2) should be disapplied on the grounds that it conflicts with the rights guaranteed by articles 7 and 8 of the Charter. We accept their submission. We should make it clear that this argument was not advanced before the judge.
98. As this court stated in Benkharbouche at paras 69 to 85, (i) where there is a breach of a right afforded under EU law, article 47 of the Charter is engaged; (ii) the right to an effective remedy for breach of EU law rights provided for by article 47 embodies a general principle of EU law; (iii) (subject to exceptions which have no application in the present case) that general principle has horizontal effect; (iv) in so far as a provision of national law conflicts with the requirement for an effective remedy in article 47, the domestic courts can and must disapply the conflicting provision; and (v) the only exception to (iv) is that the court may be required to apply a conflicting domestic provision where the court would otherwise have to redesign the fabric of the legislative scheme.
99. Mr White advances three arguments in opposition to this submission. First, he says that the Charter does not expand rights afforded under EU law. That is undoubtedly correct: see, for example, per Lord Kerr in Rugby Football Union v Consolidated Information Services Ltd [2012] UKSC 55, [2012] 1 WLR 3333 at para 26. But as Lord Kerr pointed out at para 30, article 8 was based on the Directive. It did not purport to expand rights afforded by EU law. The claimants are not relying on the Charter to expand EU rights.
100. Secondly, Mr White submits that section 13, read together with sections 40 and 55A of the DPA, is sufficient to constitute an effective remedy. Section 40 provides that, if the Information Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, he may serve an enforcement notice requiring him to take or refrain from taking specified remedial steps. Section 55A(1) gives the Information Commissioner the power, where subsection (2) or (3) applies, to impose a monetary penalty on a data controller if he is satisfied that (i) there has been a serious contravention of the data protection principles and (ii) the contravention was of a kind likely to cause substantial damage or substantial distress. But these further provisions do not allow the award of compensation for distress. For this reason, these two provisions do not make good the failure of section 13(2) to provide for compensation unless one of the conditions specified in the subsection is satisfied.
101. Thirdly, Mr White says that the court cannot simply disapply section 13(2) of the DPA which represents a carefully calibrated Parliamentary choice. The court cannot invoke article 47 of the Charter to rewrite a piece of domestic legislation. In support of this submission, he relies on a passage in the judgment of Lord Mance in R (Chester) v Secretary of State for Justice [2013] UKSC 63, [2014] AC 271. This case concerned the lawfulness of the general ban on prisoners voting. Lord Mance said: […]
102. Mr White fastens on to para 74 and submits that the court cannot devise a legislative scheme which differs from that enacted by Parliament. That, he says, is a matter for Parliament. But at para 74 Lord Mance was not dealing with the possibility of disapplying the legislative prohibition on prisoner voting. He had dealt with that at para 73 (to which we shall return). At para 74, he was considering whether it was possible to interpret the statutory provisions compatibly with EU law. This is the Marleasing question. He concluded that it was not possible so to interpret the provisions because that would flatly contradict the evident intention of the UK legislature. He also gave a second and qualitatively different reason for refusing to interpret the provisions compatibly with EU law. He said that it would be impossible for the court to devise a suitable scheme: there were so many choices to be made (including practical and administrative arrangements) that devising a new scheme was beyond the court's jurisdiction.
103. He dealt with the question of disapplying the legislative prohibition at para 73. He rejected the submission that the court should simply disapply the whole of the prohibition. The reason he gave was that under EU law a ban on eligibility would be justified in respect of a significant number of convicted prisoners. It followed that legislative choices would have to be made in devising a scheme for a ban on prisoners voting which was compatible with EU law. These were choices for Parliament and not the court to make. It would be wrong for the court to disapply the prohibition altogether, because that would deny Parliament the opportunity of enacting a partial prohibition on voting. It is implicit in Lord Mance's reasoning that, if EU law did not permit any prohibition on prisoner voting, the proper course would have been to disapply the relevant legislation.
104. We can now return to Benkharbouche. Having concluded that the relevant provisions of the State Immunity Act 1978 were incompatible with EU law, the court had to decide how to apply the observations of Lord Mance in Chester to which we have referred. The court held that the scope of the disapplication was clear. No choices had to be made by the court in order to devise a substituted scheme.
105. The present case falls on the Benkharbouche rather than the Chester side of the line. What is required in order to make section 13(2) compatible with EU law is the disapplication of section 13(2), no more and no less. The consequence of this would be that compensation would be recoverable under section 13(1) for any damage suffered as a result of a contravention by a data controller of any of the requirements of the DPA. No legislative choices have to be made by the court.
