Court of Appeal rejects class action claim for misuse of private information

Insight

16.12.2024

The Court of Appeal has rejected Andrew Prismall’s representative claim against Google and DeepMind for misuse of private information (MPI). This decision is in line with the Supreme Court’s rejection of representative claims for breaches of data protection laws in Lloyd -v- Google. This is another blow to claimants who had hoped to pursue collective claims for misuse of their information.

Background

We wrote about the first instance decision in Prismall here. However, by way of a brief recap, Andrew Prismall brought a representative action, pursuant to what is now Civil Procedure Rule 19.8, for MPI against Google UK Limited (Google) and DeepMind Technologies Limited (DeepMind). The representative claim sought damages for the loss of control over private information. The action was brought on behalf of approximately 1.6 million people on the so-called opt-out basis (meaning that these individuals did not need to consent to being represented in the claim but could elect to opt-out of it if they wanted to). The claim related to the transfer of patient data (medical records), without the patients’ consent, by the Royal Free London NHS Foundation Trust (the Trust) to Google and DeepMind who then used the data for the purposes of developing an app called “Streams”. This app was intended to be used to identify and treat patients suffering from acute kidney injury.

High Court ruling

At first instance, in May 2023, Justice Heather Williams struck out the claim and granted summary judgment to Google and DeepMind. The Judge applied the reasoning set out by the Supreme Court in 2021 in the data protection claim in Lloyd -v- Google (which we wrote about here). The principal issue was whether each member of the class represented by Mr Prismall could be said to have “the same interest”. To do so it was necessary to identify if there can be a “lowest common denominator” of person whose claim represents the “irreducible minimum scenario” for a claimant whose case would succeed across all of the class.

The Judge decided that this notional claimant’s claim for MPI was bound to fail. This was principally because the lowest common denominator would, among other factors, include: (i) those whose supposedly private information was in fact likely be anodyne; and (ii) those who had placed their medical information into the public domain so undermining a key part of a claim for MPI that there is a reasonable expectation of privacy in that information. Therefore, the representative action could not proceed because the “lowest common denominator” MPI claim would fail.

The Appeal

The appeal mainly focussed on these two key factors underpinning the first instance Judge’s findings. If Mr Prismall could persuade the Court of Appeal that the Judge had been wrong about those factors, then a viable claim covering the whole class might be established.

Mr Prismall said that the Judge had been wrong to reject the argument that all patient related information generated in the course of the relationship between a patient and a healthcare provider gives rise to a reasonable expectation of privacy. He also said the Judge had been wrong in rejecting the submission that the placing of medical information in the public domain by patients does not impact the healthcare provider’s obligation to keep private the information generated in the context of the relationship with patients, or the reasonable expectation of privacy attaching to that information. He argued that any such information would always give rise to a reasonable expectation of privacy. Mr Prismall said this was not general information about a person’s health which was anodyne or already in the public domain and where there might therefore be no reasonable expectation of privacy. The claimant said the Judge had therefore been wrong to say that a patient placing information of a general nature about their health in the public domain would mean that the obligation of a healthcare provider to keep their medical records private was negated.

The Court of Appeal rejected these main grounds of appeal and agreed with the decision of the first instance Judge that the “same interest” test for all 1.6 million represented individuals could not be met. They explained that a claim for MPI must pass a threshold of seriousness. The Court of Appeal said that this de minimis threshold will not always be satisfied in respect of all types of information recorded on medical records. In addition, where a patient had put information relating to their health into the public domain then that is relevant to assessing whether there is any reasonable expectation of privacy. The Court of Appeal said a claim for MPI would be unlikely to succeed where a patient had placed medical information in the public domain.

Conclusion

The Court of Appeal concluded its judgment by saying that a representative claim for misuse of private information was always likely to be very difficult to succeed because of the wide range of circumstances that will affect whether there is a reasonable expectation of privacy for any particular claimant. It would be very difficult to arrive at any notional lowest common denominator that would satisfy the same interest test. In other words, aligned with the decision on the data protection claims asserted in Lloyd -v- Google, the nature of an MPI claim is likely to involve individualised elements for each claimant which means it is almost inevitable that the same interest test cannot be satisfied.

The impact of this ruling and the Supreme Court decision in Lloyd -v- Google is that representative actions for data privacy claims, whether framed as MPI claims or data protection claims, look like non-starters.

The decision of the Court of Appeal is here.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.