End of the road for data privacy representative actions? Prismall v Google and DeepMind [2023]

Published 30 June 2023

In the recent High Court decision of Andrew Prismall v Google UK Limited and Deepmind Technologies Limited and LCM Funding UK Limited [2023] EWHC 1169 (KB), Mrs Justice Heather Williams DBE brought the case to an early conclusion, ruling that Andrew Prismall and the 1.6 million class members he represented could not advance to trial. Mrs Justice Heather Williams DBE summarily dismissed the claim by granting an application to strike out and for summary judgment in the misuse of private information (MPI) claim on the basis that the representative claim had no prospect of succeeding. The Prismall case was the only live attempt in the English Courts at an opt-out representative action for MPI.

The viability of representative actions in the context of data privacy claims has been uncertain since Supreme Court's decision in Lloyd v Google [2021] UKSC 50, with many such claims for breaches of data protection legislation being discontinued. Readers will recall that Lloyd v Google (previous article linked here) involved a claim for a breach of data protection legislation (DPA 1998) only. A representative action remained 'theoretically' viable for MPI, and this was tested in Prismall.

Mr Prismall issued his claim on behalf of 1.6 million class members as a representative action under what is now CPR 19.8 (formerly CPR 19.6) i.e. the opt-out representative action model for Claimants to issue a claim with the “same interest”. The Claimants here used the same model which failed in Lloyd v Google.

The case highlights some of the difficulties Claimants face in putting together claims of this nature. The decision provides further welcomed news by Defendants and their insurers facing similar representative actions because they are no longer viable in both data protection legislation or under the tort of MPI.

It was clear from the Judgment that Claimants need to be able to demonstrate that every single member of a class has suffered more than merely trivial loss and damage in order for a claim to proceed. Identifying loss suffered by the “lowest common denominator” class member was also a difficulty faced by Mr Lloyd in Lloyd v Google. Therefore, this decision is significant as it affirms the need for evidence to show substantial harm or distress.

Background

Andrew Prismall brought a representative action on behalf of 1.6 million patients against Google and DeepMind Technologies. The underlying facts concerned patients medical records transferred by a hospital (The Royal Free London NHS Foundation Trust) to DeepMind Technologies (DeepMind being Google's AI arm) in relation to the development and testing of an app used for the diagnosis and prevention of acute kidney disease.

In 2017, the ICO found that The Royal Free London NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google DeepMind. However, the High Court representative action brought by Mr Prismall did not proceed as a breach of the patients’ data protection rights (the type of claim which failed in Lloyd v Google). Rather, it was framed as a MPI claim to try and circumvent Lloyd v Google. Mr Prismall submitted on behalf of the 1.6 million patients that the mere “loss of control” over their private information (comprising medical records) entitled each member of the class to compensation. Mr Prismall relied on the earlier decision in the MPI case of Gulati v MGN Ltd [2015] EWHC 1482 (arising out of the phone hacking). Mr Prismall argued that all of the class he represented lost control over their private information when it was transferred to DeepMind. Mr Prismall submitted that compensation should be calculated by reference to this minimum harm without the need of evidence proving anything else. Mr Prismall also argued that there was no need for an individual assessment in order to satisfy the “same interest” test necessary to bring a representative claim.

The Defendants (including the litigation funders who were added as a co-defendant) applied to strike out the claim and/or summary judgment. The application was made on the basis that the Claim Form and Particulars of Claim showed no reasonable grounds for bringing the claim.

Judgment

The Court struck out the claim and ruled for summary judgment in Google and DeepMind's favour. The Court held that:

• Reasonable expectation of privacy: Each member of the class did not have a realistic prospect of showing that they had a reasonable expectation of privacy in relation to their medical records. The Court recognised that in MPI claims there is a need for individualisation for each Claimant of the complained information and whether that class member could reasonably expect that information to be private. Mr Prismall in an attempt to circumvent Lloyd v Google, argued his case on the "minimum scenario" (i.e. not every single member of the class nor their special circumstances needed to be individually assessed). This argument failed as the Court rightly concluded that each member of the Claimant class did not cross the de minimis threshold in respect of such an expectation. By removing the individualised assessment and reducing the claim to the 'lowest common denominator' to try and meet the "same interest" criteria, the "claim was bound to fail".

• Loss of control: The Court noted that the data was sensitive insofar as it was medical data but the actual data itself was "anodyne". Further, most of the data was already in the public domain and therefore the data incident caused no greater impact other than loss of control. The Court applied the "common denominator" features as seen in Lloyd v Google and concluded that the class members did not have a viable claim for more than nominal or trivial damages for said loss of control.

• Unlawful interference: The Defendants also raised the compelling argument that there is no real prospect of the Court being satisfied that the transfer of the data was unjustified so as to outweigh the alleged expectation of privacy for each member of the Claimant class. The Court agreed with the Defendants and held that Mr Prismall would be unable to prove on an "irreducible minimum" scenario that each member of the class experienced the alleged wrongful interference with their health data.

In her Judgment, Mrs Justice Williams DBE said: "this is not a situation in which every member of the Claimant class, or indeed any given member of the class, has a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation … For similar reasons there is no realistic prospect of the Court concluding at trial that the members of the class across the board experienced a wrongful interference with their data. It therefore follows that the current claim is bound to fail."

The Judgment includes a very useful summary and affirmation of the legal position that medical data will not always be expected to be private, particularly where that information may be in the public domain (for example on social media posts). The fact that some information relating to members of the Claimant class was in the public domain was a factor in undermining the class.

The Claimants then argued that the Court should permit Mr Prismall to amend the Claim, but this was swiftly rejected. It has been reported that permission to Appeal was also refused by the High Court following the strike out and summary judgment. It is unknown if Mr Prismall has asked for permission to Appeal at the Court of Appeal.

Outcome

This case was one of the few opt-out representative actions that continued post Lloyd v Google, which narrowed the options for bringing such claims under data protection legislation. It has now been confirmed by the High Court that bringing such claims under MPI face similar challenges. 

However, despite these recent Judgments striking out CPR 19.8 representative actions, and the discontinuance of other such privacy claims (for example, claims against YouTube), group litigation continues in the English Courts partly fuelled by the litigation funders as was seen in this case.  This decision has proven that if Claimants are to bring a similar action again, then they will have to show that the data and facts in issue mean that the class as a whole has a more than de minimis claim for loss of control damages.

For now, Defendants can take comfort from this further nail in the coffin for representative actions as it indicated the English Court's willingness to exercise their powers to strike out / give summary judgment in claims which do not meet the relevant de minimis thresholds before substantive costs are incurred.