Misuse of private information as a class action– Prismall considered by the Court of Appeal

Concerns about use (and in particular, misuse) of private and personal information is a common theme in modern data-rich society.  Various remedies are available to those affected, including recourse to the Information Commissioner’s Office, for example. However, if those concerns ultimately culminate in litigation, there are important strategic considerations as to how a case should be presented.  

Often, litigation relating to private and personal information is pursued as a “class action”, with multiple potential claimants coming together to challenge alleged wrongdoings for which would not be economically viable to initiate individual claims; put simply, the costs of pursuing a claim would be vastly disproportionate to the damages one claimant could (even optimistically) achieve if their claim were to be successful.

One technical route of pursuing that kind of class action claim is via a “representative action”.  Rule 19.8 of the Civil Procedure Rules 1998 provides that where one or more person has the same interest in a claim, a claim may be begun by one or more persons having the same interest as representatives of other persona who have that interest. Any judgment or order relating to a claim pursued on those lines is generally binding on all persons represented in the claim. 

The Court of Appeal has recently considered litigation of that nature in the case of Prismall v Google UK Limited and Deepmind Technologies Limited, which provides a concise and helpful overview of the difficulties in class actions being pursued via representative means.

The background to the claim is summarised in the judgment as follows:

“The claim is for damages in respect of both the one-off transfer by the Royal Free London NHS Foundation Trust (the Royal Free Trust) of data in October 2015, and the continuing transfer of data thereafter until 29 September 2017 pursuant to a live data feed. The data which was transferred took the form of patient-identifiable medical records held by the Royal Free Trust of patients, including Mr Prismall, who had attended hospitals in the Royal Free Trust or had blood tests processed by laboratories operated by the Royal Free Trust between 29 September 2010 and 29 September 2015. Google and DeepMind used the data for the purposes of developing an app called "Streams" which was intended to be used to identify and treat patients suffering from Acute Kidney Injury. Google and DeepMind also had, however, a contractual entitlement to use the data for purposes wider than direct patient care and to develop and prove capabilities to enhance future commercial prospects.”

The issue before the Court of Appeal was whether the High Court had been correct to strike out the claim in 2023, which turned to a large extent on whether it could be established on the facts that each of the approximately 1.6 million patients represented within the claim had the same interest in pursuing the litigation. If that were not the case, a representative action would fail. 
 
On the particular facts, the Court of Appeal was not satisfied that was the case, given the wide and differing range of private information which may be in play – and the Court noted evidence provided to it that some patients had given press interviews, which altered the otherwise private nature of their medical information. It concluded that “…We consider that a representative class claim for misuse of private information is always going to be very difficult to bring. This is because relevant circumstances will affect whether there is a reasonable expectation of privacy for any particular claimant, which will itself affect whether all of the represented class have "the same interest".”
 
The judgment of the Court of Appeal underscores the complexities of initiating (in a technically viable manner) class actions in the field of private information (and often inherently associated concerns relating to personal data).  Invariably, the decision is of significant assistance to (actual or potential) defendants to this kind of claim, and the principles confirmed by the Court will be important pre-action considerations for managing expectations of any potential challenge. 
 
We have advised on a wide range of claims and complaints relating to alleged misuse of private information and personal data; please do not hesitate to contact a member of the team if we can assist with matters of this nature.