The Court of Appeal has handed down its judgment in the case of Prismall v Google UK Ltd and DeepMind Technologies Ltd [2024] EWCA Civ 1516. 

In upholding the lower court's decision to strike out the claim, the Court of Appeal reinforced the existing stringent requirements for representative actions, emphasising that "a representative class claim for misuse of private information is always going to be very difficult to bring" because it will always be necessary to assess whether each individual claimant has a reasonable expectation of privacy. This, in turn, makes it difficult for a claimant to say that all members of the representative class have 'the same interest' – an essential requirement for bringing an 'opt-out' representative claim." 

Background

A representative action was brought by Andrew Prismall against Google UK Limited and DeepMind Technologies Limited pursuant to what is now Civil Procedure Rule 19.8. This rule allows for the representative action procedure to be used only where the claimant and the represented class have the "same interest" in the claim. 

The claim was brought on behalf of approximately 1.6 million individuals whose medical records were transferred from the Royal Free London NHS Foundation Trust to Google and DeepMind. The data was used to develop an app (Streams) used for identifying and treating acute kidney injury but also for broader purposes beyond direct patient care, in respect of which it was claimed no consent was given. Damages were claimed only for loss of control of the private information (referred to as the "lowest common denominator damages") and any claimant who wanted to claim damages on some further or additional basis could opt out of the representative action and bring an individual claim.

At first instance the High Court struck out the representative claim and granted summary judgment in favour of the Defendants on the basis that the claim did not have a realistic prospect of success. 

It was common ground that the principles relating to misuse of private information were a two-stage test: 

1. Whether the claimant has a reasonable expectation of privacy in the relevant information –an objective test based on the expectation of a reasonable person in the same position.
2. Whether that expectation is outweighed by a countervailing interest of the defendant. 

The High Court concluded that the claimant did not have a realistic prospect of establishing a reasonable expectation of privacy for all class members, or of crossing the de minimis threshold in relation to this expectation. This was for a number of reasons: very limited information was transferred and stored; it was held securely; some of it was already in the public domain; and there was no impact on the individual other than the loss of control itself. 

It was emphasised that all class members needed to have the "same interest" in the claim and given the diverse circumstances of the data used and the varying expectations of privacy among class members, this requirement was not met. 

Furthermore, the High Court did not allow Mr Prismall to amend his claim, on the grounds that this would not remedy the defects in the claim and allow it to meet the relevant legal threshold.  

Court of Appeal decision

The appeal was dismissed unanimously by the Court of Appeal, who agreed with the lower court that the class members did not have a realistic prospect of success in establishing a claim for misuse of private information. 

On the first aspect of the two-stage test set out above, the Court accepted that some categories of data (for example information that identified a patient in medical notes) afforded a prima facie reasonable expectation of privacy. However, this was not the end of the analysis. Whether the  threshold of seriousness was reached would depend on the individual circumstances. The claimant's argument that there would always be a blanket expectation of privacy was rejected. Not every disclosure of medical information would give rise to a reasonable expectation of privacy, in particular if the information was trivial or already in the public domain. 

Impact of this decision

This decision reaffirms the difficulties that will be faced by claimants (and claimant-focussed law firms) in trying to bring opt-out representative actions in data privacy cases following the Supreme Court decision of Lloyd v Google [2021] UKSC 50.

It also demonstrates that the courts will look closely at claims based on a reasonable expectation of privacy, particularly where information is trivial or where it might already have been widely shared on social media, for example.