A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Published 30 junio 2023
In the recent High Court decision of Andrew Prismall v Google UK Limited and Deepmind Technologies Limited and LCM Funding UK Limited  EWHC 1169 (KB), Mrs Justice Heather Williams DBE brought the case to an early conclusion, ruling that Andrew Prismall and the 1.6 million class members he represented could not advance to trial. Mrs Justice Heather Williams DBE summarily dismissed the claim by granting an application to strike out and for summary judgment in the misuse of private information (MPI) claim on the basis that the representative claim had no prospect of succeeding. The Prismall case was the only live attempt in the English Courts at an opt-out representative action for MPI.
The viability of representative actions in the context of data privacy claims has been uncertain since Supreme Court's decision in Lloyd v Google  UKSC 50, with many such claims for breaches of data protection legislation being discontinued. Readers will recall that Lloyd v Google (previous article linked here) involved a claim for a breach of data protection legislation (DPA 1998) only. A representative action remained 'theoretically' viable for MPI, and this was tested in Prismall.
Mr Prismall issued his claim on behalf of 1.6 million class members as a representative action under what is now CPR 19.8 (formerly CPR 19.6) i.e. the opt-out representative action model for Claimants to issue a claim with the “same interest”. The Claimants here used the same model which failed in Lloyd v Google.
The case highlights some of the difficulties Claimants face in putting together claims of this nature. The decision provides further welcomed news by Defendants and their insurers facing similar representative actions because they are no longer viable in both data protection legislation or under the tort of MPI.
It was clear from the Judgment that Claimants need to be able to demonstrate that every single member of a class has suffered more than merely trivial loss and damage in order for a claim to proceed. Identifying loss suffered by the “lowest common denominator” class member was also a difficulty faced by Mr Lloyd in Lloyd v Google. Therefore, this decision is significant as it affirms the need for evidence to show substantial harm or distress.
Andrew Prismall brought a representative action on behalf of 1.6 million patients against Google and DeepMind Technologies. The underlying facts concerned patients medical records transferred by a hospital (The Royal Free London NHS Foundation Trust) to DeepMind Technologies (DeepMind being Google's AI arm) in relation to the development and testing of an app used for the diagnosis and prevention of acute kidney disease.
In 2017, the ICO found that The Royal Free London NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google DeepMind. However, the High Court representative action brought by Mr Prismall did not proceed as a breach of the patients’ data protection rights (the type of claim which failed in Lloyd v Google). Rather, it was framed as a MPI claim to try and circumvent Lloyd v Google. Mr Prismall submitted on behalf of the 1.6 million patients that the mere “loss of control” over their private information (comprising medical records) entitled each member of the class to compensation. Mr Prismall relied on the earlier decision in the MPI case of Gulati v MGN Ltd  EWHC 1482 (arising out of the phone hacking). Mr Prismall argued that all of the class he represented lost control over their private information when it was transferred to DeepMind. Mr Prismall submitted that compensation should be calculated by reference to this minimum harm without the need of evidence proving anything else. Mr Prismall also argued that there was no need for an individual assessment in order to satisfy the “same interest” test necessary to bring a representative claim.
The Defendants (including the litigation funders who were added as a co-defendant) applied to strike out the claim and/or summary judgment. The application was made on the basis that the Claim Form and Particulars of Claim showed no reasonable grounds for bringing the claim.
The Court struck out the claim and ruled for summary judgment in Google and DeepMind's favour. The Court held that:
In her Judgment, Mrs Justice Williams DBE said: "this is not a situation in which every member of the Claimant class, or indeed any given member of the class, has a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation … For similar reasons there is no realistic prospect of the Court concluding at trial that the members of the class across the board experienced a wrongful interference with their data. It therefore follows that the current claim is bound to fail."
The Judgment includes a very useful summary and affirmation of the legal position that medical data will not always be expected to be private, particularly where that information may be in the public domain (for example on social media posts). The fact that some information relating to members of the Claimant class was in the public domain was a factor in undermining the class.
The Claimants then argued that the Court should permit Mr Prismall to amend the Claim, but this was swiftly rejected. It has been reported that permission to Appeal was also refused by the High Court following the strike out and summary judgment. It is unknown if Mr Prismall has asked for permission to Appeal at the Court of Appeal.
This case was one of the few opt-out representative actions that continued post Lloyd v Google, which narrowed the options for bringing such claims under data protection legislation. It has now been confirmed by the High Court that bringing such claims under MPI face similar challenges.
However, despite these recent Judgments striking out CPR 19.8 representative actions, and the discontinuance of other such privacy claims (for example, claims against YouTube), group litigation continues in the English Courts partly fuelled by the litigation funders as was seen in this case. This decision has proven that if Claimants are to bring a similar action again, then they will have to show that the data and facts in issue mean that the class as a whole has a more than de minimis claim for loss of control damages.
For now, Defendants can take comfort from this further nail in the coffin for representative actions as it indicated the English Court's willingness to exercise their powers to strike out / give summary judgment in claims which do not meet the relevant de minimis thresholds before substantive costs are incurred.
London - Walbrook
+44 (0) 20 7894 6925
+44(0)20 7894 6595
Hans Allnutt, Astrid Hardy
Patrick Hill, Sonali Malhotra
Julian Miller, Clare Hughes-Williams
Patrick Hill, Camilla Elliot
Hans Allnutt, Camilla Elliot
Hans Allnutt, Stuart Hunt
Astrid Hardy, Hans Allnutt
Julian Miller, Tom Evans
Jade Kowalski, Astrid Hardy
Louise Gallagher, Katie Anderson