On 19 May 2023, Mrs Justice Heather Williams handed down judgment in Prismall v Google UK Limited & Another [2023] EWHC 1169 (KB). She struck out the claim by Andrew Prismall, acting as a Representative Claimant on behalf of about 1.6 million people, and entered summary judgment for the Defendants, Google UK Limited and DeepMind Technologies Ltd.
Beyond the immediate result, the judgment is likely to have material implications for the tort of misuse of private information generally and for representative actions based on that tort in particular.
The Facts
Mr Prismall brought a representative claim on behalf of approximately 1.6 million potential claimants against Google and DeepMind. He sought damages for misuse of private information on the basis that certain medical records held by the Royal Free London NHS Foundation Trust (and its predecessors) had been transferred to DeepMind.
The transfer included: (i) a one-off transfer of historical data in October 2015; and (ii) a live data feed established around the same time for subsequent medical records. These transfers occurred pursuant to an Information Sharing Agreement between Royal Free and Google UK Limited. The reason for the Agreement was DeepMind’s involvement in the development of an application called ‘Streams’. Streams was being designed to assist clinicians at the Royal Free to identify and treat acute kidney injury.
Streams became operational in February 2017. Mr Prismall’s claim was concerned with the use of patient data before February 2017. In particular, his complaint related to: (i) patient-identifiable medical records where the Defendants had a contractual entitlement to use them for purposes wider than direct patient care and/or wider than the Streams project; (ii) storage of the medical records by the Defendants prior to Streams becoming operational; (iii) usage of the medical records in the research and development of Streams; and/or (iv) use of medical records for the development of the general capabilities of Streams: [3].
In broad terms, the ‘class’ on behalf of whom Mr Prismall sought to bring the claim consisted of individuals who attended Royal Free for treatment between 29 September 2010 and 29 September 2015 or whose blood tests data was held by the Royal Free during the same period: [6], [16].
The Defendants applied to strike out the claim under CPR 3.4(2)(a) and/or for summary judgment under CPR 24.2. The Judge granted the application..
The Judgment and Reasoning
The judgment consists of four main strands of reasoning.
First, CPR 19.8 requires that all members of the representative class must have the “same interest”. When applying this requirement to cases where the claimants have varying interests, it is necessary to consider the claim on a “lowest common denominator” basis, assessing it by reference to an “irreducible minimum scenario” that applies to each member of the claimant class: [110], [162], [166]. In the context of misuse of private information, this means that (inter alia) every member of the class must have a realistic prospect of showing that they had a reasonable expectation of privacy: [121].
At [166], the Judge identified the “irreducible minimum scenario” on the facts before her. Among other matters, it included features such as: (i) only a single visit to the hospital; (ii) a medical condition that did not involve any particular sensitivity or stigma; (iii) limited demographic information being recorded by the hospital; (iv) the relevant information being anodyne and stored securely; and (v) the information being in the public domain already. On this scenario, The Judge considered that not every member of the claimant class had a (more than de miminis) reasonable expectation of privacy. As she put it (at [168]):
“…I conclude that each member of the Claimant Class does not have a realistic prospect of establishing a reasonable expectation of privacy… I arrive at this conclusion given, in particular that on the applicable scenario I have identified: very limited information was transferred and stored; although health-related, it was anodyne in nature; this information was held securely and not accessed by anyone during the storage period; the information was already in the public domain; the alleged acts of interference outside of patient direct care were limited to the transfer of the data and to its secure storage for up to 12 months; and that this caused no impact other than the loss of control itself.”
Second, the Judge was not satisfied that each member of the claimant class would be entitled to more than nominal damages. The damages claimed were based on the claimants’ loss of control over the relevant information. The Judge proceeded on the assumption, without deciding, that damages on this basis were available for the tort of misuse of private information: [173]. Nonetheless, she held that some members of the class may be entitled to trivial damages only. This was largely for the same reasons as those outlined above in the context of reasonable expectation of privacy: [175]. In addition, she relied on the fact that the data transfer would have to have been normalised before the launch of the Streams application. Therefore, the loss of control by the claimants, if any, would have lasted a relatively short period of time: [175].
Third, Mr Prismall argued that, even if the claim had no realistic prospect of success, there were compelling reasons why the Court should permit it to proceed: see CPR 24.2(b). The Judge gave this argument short shrift. She was not persuaded that the so-called areas of “evidential uncertainty” were a sufficiently compelling reason: [179]. She was also not satisfied that the position would relevantly improve by the time of trial such that the difficulties relating to reasonable expectation of privacy and the triviality of damages could be overcome: [179].
Fourth, the Judge declined to permit Mr Prismall an opportunity to save the claim by amending it (for example, by narrowing the class of claimants) so as to cure its deficiencies. Her reasoning on this aspect of the case is considered in more detail below. In summary, she held that the difficulties she had identified were inherent in the nature of the claim, and were unlikely to be cured by amendment: [187(iv)]. As she explained at [185(i)]:
“The difficulties that the Representative Claimant faces are inherent in seeking to bring this claim as a representative action when necessary components of establishing both liability and the remedy sought (a reasonable expectation of privacy and loss of control damages) would usually be assessed on an individualised basis and in the present circumstances many relevant variables exist between members of the Claimant Class. …taking a global irreducible minimum approach in circumstances where there are so many variables means that even with some narrowing of the class, it is very unlikely that it can be said that any given member of the class will have a viable claim with a reasonable prospect of success…”
In any event, she said, even if a viable claim were to emerge out of amendments, those amendments would not be addressing specific deficiencies. Rather, the Court would be permitting the claimant to bring a radically redrawn claim: [185(v)]. That outcome, she said, was against the interests of justice.
Comment
The following three broad observations may be made about the wider implications of the decision in Prismall.
Representative actions: data protection or misuse of private information
Representative claimants will often be faced with a choice between relying on the tort of misuse of private information, or basing the claim on data protection legislation, or both. Following the decisions in Gulati v MGN Limited [2017] QB 149 and Lloyd v Google LLC [2022] AC 1217, one may have thought that a misuse of private information claim was more advantageous. In particular, it carries the advantage that, instead of proving material loss, the claimant may seek damages for ‘loss of control’. By contrast, ‘loss of control’ damages are not available in data protection claims.
Indeed, Mr Prismall had initially begun a claim seeking damages for breach of data protection law, which was abandoned following the Supreme Court’s decision in Lloyd v Google: [23].
One of the insights that Prismall offers is that a representative claim for misuse of private information comes with its own difficulties. In any such claim, the representative claimant will need to establish that each member of the claimant class had a reasonable expectation of privacy. This will be judged by reference to the well-known Murray factors: see Murray v Express Newspapers plc [2009] Ch 481 (CA) at [36]. In identifying the “irreducible minimum scenario”, the Court will need to consider the position of members of the claimant class whose claims of privacy fall towards the lower end of the spectrum on some or all of those factors. The cumulative effect of this exercise may often be that some members of the class do not have a reasonable expectation of privacy. This, in turn, will mean that the “same interest” test under CPR 19.8 is not met: [101]. As the Judge recognised, this risk is inherent in the fact that reasonable expectation of privacy “would usually be assessed on an individualised basis and [that]… many variables exist between members of the Claimant Class”: [185(i)].
Two practical consequences follow: (i) a representative claimant will often face an all-important choice as to whether the claim should be based on misuse of private information or breach of data protection legislation (or both); (ii) if that choice comes down in favour of misuse of private information, careful and early consideration will need to be given to framing the claimant class in such a way that each of its members is able to satisfy each element of that tort (including, in particular, the reasonable expectation of privacy).
Elements, defences and the “same interest” test
Prismall makes it clear that if some members of the claimant class are unable to establish a constitutive element of the relevant tort, the claim will fail: see e.g. [101]. The Judge did not need to consider a scenario where a defence operates against some, but not all, members of the class. This is because, on her analysis, not all members had a viable claim in the first place.
However, her view appears to be that there is a relevant distinction between elements of the cause of action and the application of defences. A representative action is impermissible unless all members of the claimant class are able to satisfy every element of the tort: [101]. By contrast, “the existence of a defence that applies to only some members of the class will not preclude the “same interest” test from being met, provided there is no conflict of interest” within the class: [99].
Is there a principled justification for drawing such a sharp distinction between the constitutive elements of a tort and its defences? The answer is very far from obvious. Whether it is because some members of the claimant class are unable to establish a constitutive element, or because the defendant has a valid defence against such members, the consequence is the same: some, but not all, members have a viable claim. It is not easy to understand why a representative action is impermissible in the former scenario whereas it may be allowed to proceed in the latter.
Saving the claim by amendment
Faced with the Court’s objections, Mr Prismall sought permission to provide an amended version of his claim before it was struck out or summary judgment entered. In particular, he raised the possibility of narrowing the claimant class. As explained above, the Judge adopted a robust attitude to this aspect of the case. She held that, on balance, the claim should be struck out instead of offering Mr Prismall a second bite at the cherry: [185].
Importantly, this was not because she considered it impermissible for a claimant to save the claim by (even a late) amendment. She recognised that, where a statement of case is found to be defective, the Court should consider whether the defect might be cured by amendment and, if so, offer the relevant party an opportunity to amend: [65].
The Judge’s objection was more fundamental. She considered that: (i) even an amended claim was unlikely to succeed. As she put it, “where there are so many variables… even with some narrowing of the class, it is very unlikely that it can be said that any given member of the class will have a viable claim with a reasonable prospect of success”: [185(i)]; and (ii) in order to have any prospect of success, the claim would have to be brought on behalf of a “substantially narrower cohort”: [185(v)]. Even if Mr Prismall were to do so, she said, this would not be an exercise in curing a deficiency but, instead, amount to radically redrawing the claim he had initially sought to advance.
One of the consequences of this analysis is that there may have been at least some members of the claimant class who had viable claims against the Defendants: see e.g. [154], [155]. However, there may be limitation difficulties that preclude them from coming to Court following the dismissal of Mr Prismall’s claim: see [184]. By standing by and following the fate of Mr Prismall’s claim, it would appear that those claimants have, forever, lost the opportunity to have their day in Court.
If that is thought unfair‚ it may be said — in defence of the Judge — that it is only a normal consequence of the operation of the limitation rules. Between the roughly one-year period between 28 April 2022 (when Mr Prismall’s claim was issued) and 19 May 2023 (when it was struck out), any members of the claimant class with an imminent expiry of the limitation period would have been well-advised to issue their own claims.
Mariyam Kamil is a barrister at Matrix, practising in media and information law.
Leave a Reply