Clifford Chance
Use of CPR 19.8 representative actions reconsidered by the UK Court of Appeal
The Court of Appeal of England and Wales has heard an appeal by a representative claimant seeking to overturn a decision to strike out and for summary judgment against a misuse of private information ("MOPI") claim issued on behalf of an estimated 1.6 million claimants relating to the alleged transfer, storage and misuse of their patient-identifiable medical records.
The appeal could result in the reinstatement of the class action initiated by Andrew Prismall against Google and its generative AI subsidiary, Deepmind, which was struck out in May 2023 by Mrs Justice Heather Williams DBE on the basis that the CPR 19.8 representative claim had no real prospect of succeeding if it were to proceed to trial (see Clifford Chance's full briefing on the application judgment here).
That decision was considered a significant setback for claimants seeking to bring data privacy claims through a representative action in the UK and reiterated many of the challenges of data privacy class action set out in the Supreme Court's landmark decision in Lloyd v Google LLC [2021] UKSC 50 – a case which involved alleged breaches of data privacy rights under the Data Privacy Act 1998 linked to browser data tracking without the consent or knowledge of users. Whilst the Prismall case had sought to distinguish itself from Lloyd by pursuing a claim under the tort of MOPI (rather than the statutory route), both cases encountered similar challenges with balancing the "same interest" requirement of CPR 19.8 for bringing a class action against the need for an "individualised assessment" in data protection claims.
One of the core difficulties in this case is the broad variety of circumstances of the 1.6 million claimants whose medical data was allegedly misused by Google in the relevant period. During the March 2023 application hearing, differences in the volume and contents of medical data transferred to Google, the extent to which that data was already in the public domain and how much data was actually used (and potentially misused) by Google during the relevant period were identified. With these factors in mind, Mr Prismall accepted that the recovery of individualised damages for members of the claimant class could not be achieved in a class action and that a "lowest common denominator" approach to damages would be required – that is to say, compensation calculated by reference to the irreducible minimum harm suffered by all members of the claimant class. However in her judgment, Mrs Justice Williams ruled that the "lowest common denominator " approach would likely result in no liability for MOPI, or at most nominal damages, based on the facts and circumstances of this case, making the claim unfeasible.
At the appeal hearing on 22 October 2024, Mr Prismall sought to play down the impact of these differences and focused on the core question of whether every member of the claimant class had a reasonable expectation of privacy in relation to their medical records – which he maintained they did. Google emphasised that some of the information in the medical records might already be in the public domain (e.g. through social media posts) and that in such instances, no harm or loss could have been suffered by that individual and, in turn, the entire claimant class, because of the lowest common denominator approach to damages advanced by Mr Prismall.
Mr Prismall also contested the judge's decision to strike out the claim without leave to amend first, describing it as a "draconian" step which ought to be reversed on the grounds that a very significant number of claimants had potentially been affected by the alleged misuse of private information by Google.
To assist the court, Mr Prismall proposed an amendment to limit the claim to individuals who received clinical care or treatment, excluding those who only had an A&E visit with a basic medical file but no treatment. Whilst it is unclear by how much the proposed amendment would reduce the size of the claimant pool, it was argued that this should address Mrs Justice Williams' concerns about less significant claims influencing the lowest common denominator applied to the entire claimant class. However, Google noted that the proposed amendment still failed to address the public domain issue, which appears challenging to overcome.
If the appeal is successful and the claim proceeds, the case will present a renewed opportunity for data privacy class actions to be tested in the English courts under the tort of MOPI following the Supreme Court's decision in Lloyd v Google. The fact that the Prismall case concerns the alleged misuse of medical records – a class of data widely considered to be inherently private – in the advancement of medical technology means that the Court of Appeal may be inclined to reverse the first instance decision to allow the issues to be comprehensively litigated in the broader public interest. On the other hand, both Lloyd and Prismall share the same fundamental problem with the broad spectrum of data and alleged damage to the claimant class, complicating the viability of pursuing these as class actions. Consequently, the Court of Appeal will be mindful that these matters have already been traversed by the Supreme Court and may hesitate to permit Mr Prismall another attempt at a claim that seemingly mirrors many aspects of the Lloyd case.
We are closely following the case and will publish a further post with updates on the appeal judgment in due course.
