Prismall v Google: Court of Appeal upholds strike out of representative action claim for misuse of private information

In its recent judgment in Prismall v Google UK Ltd and DeepMind Technologies Ltd [2024] EWCA Civ 1516, the Court of Appeal upheld the High Court's decision to strike out a representative action relating to misuse of private information. This case highlights the challenges that claimants face in satisfying the 'same interest' test which must be met when bringing a representative action under CPR 19.8. 

Background 

Mr Prismall had sought to bring a representative claim for damages for loss of control arising out of alleged misuse of private information on behalf of approximately 1.6 million people whose patient-identifiable medical records were transferred from the Royal Free London NHS Foundation Trust to Google and DeepMind between October 2015 and September 2017.

The data was used to develop an app called "Streams," designed to identify and treat acute kidney injury patients. However, Google and DeepMind also had rights to use the data for broader purposes beyond direct patient care, including to develop and prove capabilities to enhance future commercial prospects. 

Mr Prismall needed to show that each member of the represented class had:

• A reasonable expectation of privacy in the relevant information (taking into account all the circumstances of the case and subject to a seriousness threshold).
• The 'same interest' in the claim.  

This 'same interest' test has presented challenges for claimants seeking to bring representative actions in the context of data privacy claims which are likely to require an individualised assessment of damages.

One way in which claimants have sought to resolve this issue is by pursuing actions on the basis of there being a "lowest common denominator" claimant claiming an 'irreducible minimum harm' ie each member of the class seeks a uniform sum of damages based on the loss suffered by the "lowest common denominator claimant". This was the approach adopted by Mr Prismall.  

High Court decision

In May 2023, the High Court struck out the claim at first instance finding that, in relation to the "lowest common denominator" claimant, the data in question was anodyne and/or already in the public domain, such that they did not have a realistic prospect of establishing a reasonable expectation of privacy.

Accordingly, the High Court found that the "lowest common denominator" claimant did not meet the threshold for bringing a claim for misuse of private information.  

Court of Appeal decision

Mr Prismall appealed on several grounds, including arguing that the judge had erred in rejecting the submission that all patient-related information generated within the doctor-patient relationship inherently gives rise to a reasonable expectation of privacy, regardless of whether the information is already in the public domain.

The Court of Appeal ultimately upheld the High Court's decision, finding that, whilst the starting point was that there was normally a reasonable expectation of privacy for any patient identifiable information in medical notes, that was not always the end point. It was important here that the claim was framed as being for the tort of misuse of private information, which involves a threshold of seriousness. The Court of Appeal held that if patients choose to make private information public, the fact that the information is public, and the manner in which it has entered the public domain will inevitably form part of the relevant circumstances to be considered in determining whether the seriousness threshold has been met.

In this case, this meant that a claim for misuse of private information would not invariably succeed and accordingly the Court of Appeal agreed that the 'lowest common denominator' claimant did not meet threshold for bringing a claim. 

Where do we go from here? 

The Court of Appeal noted that it considered that a representative action claim for misuse of private information "is always going to be very difficult to bring" because relevant circumstances will affect whether there is a reasonable expectation of privacy for any particular claimant, which will itself affect whether all of the represented class have the 'same interest'. 

Whilst the floodgates therefore currently remain shut for bringing representative actions in the context of data privacy claims, it remains to be seen whether adopting a bifurcated approach would overcome this. That would mean that common issues of fact and law could be determined on a representative basis, with issues requiring individual determination (whether relating to liability or damages) being dealt with at a later stage. 

The Court of Appeal had approved such an approach in Commission Recovery Ltd v Marks & Clerk LLP & Long Acre Renewals (A firm) [2024] EWCA Civ 9, confirming that the case could proceed with common issues being determined on a representative basis, even if they did not lead to a conclusion on liability. The Court of Appeal did note that the class representative had not put forward any plan as to how the litigation would be taken to a point where there would be money judgments in favour of those who had opted in, but held that it was not for the Court to second-guess the claimant's decision that it was commercially worth its while to continue the litigation where it was not clearly a futile exercise. 

The preliminary issues trial was due to take place in January 2025 and was expected to provide further useful guidance, although the case ultimately settled on confidential terms prior to trial. This does however remain an area to watch.