The High Court has allowed the ‘opt-out’ representative action against the social media platform TikTok for the misuse of children’s personal data to pass an early administrative hurdle, by granting the Claimant permission to serve the claim form out of jurisdiction on certain TikTok entities incorporated in the USA, the Cayman Islands and China. In coming to this decision, Nicklin J found that the claim against TikTok, brought by the former Children's Commissioner for England on behalf of a huge class of children, has a “serious issue to be tried”.
However, the judge explicitly declined to weigh up the overall merits of the case, since this was a one-sided ex parte application by the Claimant on short notice, without the benefit of submissions from TikTok. He noted that the key legal question of whether the Supreme Court's conclusion in Lloyd v Google can properly be distinguished in this case is expected to be decided in mid-June 2022, when TikTok’s application to have the claim against it struck out is due to be heard.
Like the landmark case of Lloyd v Google [2021] UKSC 50, this claim for the misuse of data is being brought as a representative action under CPR 19.6, on behalf of millions of claimants who will automatically fall within the class unless they pro-actively ‘opt-out’. The Supreme Court determined in November last year that the claim against Google could not proceed as an opt-out representative action (you can read more about this decision here), and upheld the original High Court decision to refuse permission to serve Google outside of the jurisdiction. The Claimant therefore needs to distinguish her case against TikTok from the decision in Lloyd v Google.
Meanwhile, it was not all good news for the Claimant at this hearing. Nicklin J was critical of the way that the Claimant had delayed service of this claim upon the foreign Defendants, and he refused the Claimant’s applications to extend the time for service of the claim form and to serve the claim form by alternative means on the American, Cayman and Chinese Defendant entities. He recognised that, in effect, this meant that the Claimant would not be able to pursue this claim against the Chinese entity which is the Fifth Defendant to this claim.
Background
In December 2020, the (now former) UK Children’s Commissioner Anne Longfield issued a claim against six TikTok entities - SMO (a child) v Tiktok Inc and others [2022] EWHC 489 (QB). She is acting as litigation friend to a child, who is bringing the claim as a representative action on behalf of all children who have used TikTok whilst logged into their own account since May 2018. This means that the Claimant is arguing that all such children have the “same interest” in the claim, and should be included in the class automatically unless they opt out.
It is alleged by the Claimant that the Defendants have breached data protection regulation by illegally collecting and processing the personal data of the children, including by transferring the data to China. The Claimant argues that each member of the class should receive at least £1,000. The Defendants deny the allegations.
The Claimant required the permission of the court to serve the claim form on four of the named Defendants which are domiciled outside of this jurisdiction.
Relevance of Lloyd v Google decision
In making this application, the Claimant argued that the claim can be distinguished from Lloyd v Google in three key ways.
- Firstly, the claim is not brought under the Data Protection Act 1998 or the Data Protection Directive (as in Lloyd v Google), but under the Data Protection Act 2018 and the EU’s General Data Protection Regulation, and for misuse of private information. This argument will require the Claimant to show that s.13 Data Protection Act 1998, upon which Mr Lloyd had exclusively relied, is materially different from Art. 82(1) GDPR, despite the two containing similar wording.
- Secondly, the Claimant argued that the class is very different, and that the personal data collected and processed in every instance “extends well beyond the situation in Lloyd”. The Claimant argues that this means the Supreme Court’s finding that representative proceedings are inappropriate where an investigation as to the individual circumstances of the alleged breach is required does not apply here.
- Finally, the Claimant argued that even the “lowest common denominator” claim in the group would pass the de minimis threshold because “the processing of the Children's personal data was unlawful (and in breach of numerous provisions under the GDPR), and the personal data in fact processed in respect of each of the Children was extensive”.
It remains to be seen whether the Court will be convinced by any of these arguments when it considers them fully (and the counter-arguments doubtlessly advanced by the Defendants) at the strike-out application in June. As explained below, the court did not comment on the merits of any of these individual arguments at this hearing.
Decision
In his judgment handed down on 8 March 2022, Nicklin J decided that, given this was an ex parte application heard at very short notice, he should not determine the legal question of whether the Supreme Court's conclusion in Lloyd v Google can properly be distinguished from this case. His finding was therefore limited to confirming, having heard only the Claimant’s arguments, that he is satisfied that that there is a serious issue to be tried. This means he found that overall the Claimant’s arguments distinguishing this claim from Lloyd v Google have a real (as opposed to fanciful) prospect of success. The judge explicitly stated that nothing in his judgment prejudges the arguments that will be made at the forthcoming strike out application.
The Claimant was therefore granted permission to serve the claim form on the First, Fourth, Fifth and Sixth Defendants out of the jurisdiction.
Nicklin J refused to grant any extension of time for serving the claim form on the remaining Defendants, because service had been left “until practically the last minute” with “no good reason” for failing to serve it earlier. Similarly, he refused to authorise service of the claim form by alternative means upon the Fifth Defendant, Beijing Bytedance, on the basis that there were no exceptional circumstances that necessitated this – service had simply been left too late to allow for ordinary service. The judge also criticised the Claimant’s solicitors for “the way in which these applications have been presented to the Court” - at short notice and as an application to be made without submissions from the Defendants and without a hearing.
The judge said that he recognised that “the effect of my decisions will be that it will be practically impossible for the Claimant now to effect service of the Claim Form in this action on the Fifth Defendant.” Instead, it would be necessary for the Claimant to issue a new (separate) claim against the Fifth Defendant.
In discussing the practicalities of two separate actions, the judge noted that if the summary judgment application due to be heard this summer is successful, that would effectively bring an end to the claim against all Defendants. He also noted the high likelihood of an appeal, whatever the outcome of that application, which should allow a new claim against the Fifth Defendant to catch up with the existing claim.
The Second Defendant’s application for summary judgment against the Claimant will be heard in mid-June 2022, at which point the Court is expected to decide whether the Claimant’s attempts to distinguish this case from the decision in Lloyd v Google should succeed.
