All Class, No Action: CoA Upholds Stringent ‘Same Interest’ Test

Introduction

On 11 December 2024, the English Court of Appeal dismissed Andrew Prismall’s representative claim for misuse of private information in Prismall v Google UK Ltd and DeepMind Technologies Limited. The appeal sought to overturn the High Court’s decision to strike out the representative action and award Google and DeepMind summary judgment. The Court of Appeal ruled that not every member of the 1.6 million representative class could show that they had a realistic prospect of establishing a reasonable expectation of privacy in respect of their medical records (the test for summary judgment under CPR 24.3) or of crossing the de minimis threshold in relation to that expectation, such that there was no realistic prospect of establishing misuse of private information of each member of the class, or a realistic prospect of establishing an entitlement to damages for loss of control. As a result, the Court of Appeal dismissed the appeal and affirmed the High Court’s decision to grant summary judgment in favour of Google and DeepMind.

This decision reinforces the Supreme Court’s 2021 ruling in Lloyd v Google (see our previous client alert), emphasising the courts’ strict application of the “same interest” requirement contained in Civil Procedure Rule (“CPR”) 19.8 for representative actions. It also highlights the challenges in pursuing representative actions for misuse of private information.

Background

In Prismall v Google UK Ltd & Anor [2023] EWHC 1169 (KB), the claimant brought a representative action, on behalf of 1.6 million people, for misuse of private information against Google UK Limited (“Google”) and DeepMind Technologies Limited (“DeepMind”), pursuant to CPR 19.8.

CPR 19.8(1) provides that “Where more than one person has the same interest in a claim – (a) the claim may be begun; or (b) the court may order that the claim be continued, by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest” (emphasis added).

The claim was brought on an opt-out basis, meaning class members were included without needing to consent, but could choose to opt out.

The claim sought damages for the unauthorised transfer of patient-identifiable medical records (i) on a one-off basis in October 2015 and (ii) for the continual transfer of data until September 2017 by the Royal Free London NHS Foundation Trust to Google and DeepMind. The data was used to develop the “Streams” app for treating Acute Kidney Injury, without the patients’ knowledge or consent.

Mrs. Justice Heather Williams, sitting in the High Court, dismissed the representative claim and granted summary judgment in favour of Google and DeepMind in her judgment on 19 May 2023. The appellant challenged the High Court’s ruling, questioning if it was correct in its determination that the representative class did not have a realistic prospect of establishing a reasonable expectation of privacy regarding their medical records.

Legal Issues

The case before the High Court and the Court of Appeal focused on two key legal issues under CPR 19.8:

1. To meet the requirements of CPR 19.8(1), it must be demonstrated that each member of the class has a realistic prospect of establishing misuse of private information. This is because the rule stipulates that the person filing the claim and those on whose behalf the claim is brought must share “the same interest”.
2. Per the approach taken by the Supreme Court in Lloyd v Google, each member of the representative class must have a realistic prospect of succeeding in their individual claim.

The Court of Appeal also emphasised that for misuse of private information claims to be proven, it involves a two-stage test:

1. Whether the claimant has a reasonable expectation of privacy in the relevant information. This is an objective assessment that is subject to a de minimis threshold of seriousness, considering all circumstances relevant to the case.
2. If this is shown, the Court then balances the competing rights involved to determine whether that expectation is outweighed by the countervailing interest of the defendant.

High Court Decision

To determine whether the two requirements set out in respect of CPR 19.8 above had been met, the High Court followed the approach outlined in paragraph 145 of Lloyd v Google. This involved evaluating the “lowest common denominator” claimant, meaning a notional claimant in the represented class whose claim reflects the “irreducible minimum scenario” for any claimant in that class. Consequently, Williams J ascertained this lowest common denominator scenario and assessed whether every claimant (i) had experienced the same “irreducible minimum harm” for a viable claim for damages to be made out and (ii) shared a sufficiently common interest.

Williams J found significant variation amongst class members, making it difficult to establish a reasonable expectation of privacy and a common interest, especially since some claimants had publicly shared their data (a critical failing). It was also noted that, for the lowest common denominator claimant, their medical notes contained limited demographic information with no specific medical references.

Williams J also considered whether the data was used exclusively for direct patient care, which would fall outside the scope of a claim for misuse of private information. The judge acknowledged that some data use was for direct patient care, thus falling outside the scope of a claim for misuse of private information. Whilst the representative claim focused on broader commercial use, the storage of data was found to be secure, and the data was only used during the normalisation process for the app prior to it becoming operational. Therefore, this use was deemed an integral step towards direct care and was not the focus of the claim.

Despite claimants being unaware and not consenting to broader data use, the principal adverse effect for the lowest common denominator claimant was deemed to be loss of control over data, with no significant upset or concern caused as a result. These factors led to the conclusion that the claim lacked a realistic prospect of establishing misuse of private information or an entitlement to damages, and the class members did not share a sufficiently common interest to proceed under CPR 19.8.

Court of Appeal Decision

The principal issue on appeal was whether the High Court was wrong in finding that each class member lacked a realistic prospect of establishing a reasonable expectation of privacy and that they failed to meet the de minimis threshold for misuse of private information claims.

The Court of Appeal framed the issues on appeal as follows:

1. Whether the lowest common denominator claimant had a realistic prospect of success, given patient-related information generally gives rise to a reasonable expectation of privacy, even if publicly disclosed.
2. Whether the judge adopted too broad a definition of direct care.
3. Whether the judge was wrong in referring to a lowest common denominator claimant who had not provided any medical information to the doctor.
4. Whether the judge wrongly considered upset or concern as relevant to identifying the lowest common denominator claimant.
5. Whether the judge should have allowed Mr. Prismall to amend his statement of case.

The Court of Appeal unanimously dismissed all five grounds of appeal:

1. The Court of Appeal noted that representative actions for the misuse of private information are challenging due to varying circumstances affecting privacy expectations for each claimant, which impacts whether all the class have the “same interest”. Whilst the lowest common denominator claimant had a reasonable expectation of privacy, not all medical notes met the de minimis threshold. Additionally, agreeing with the High Court, the Court of Appeal noted that a key pitfall of the Claimant’s case was that some of the patient-identifiable data had been made available to the public resulting in there not being an expectation of privacy in relation to this information. The claimant’s arguments that the obligation upon a healthcare provider to ensure the privacy of medical records had not been affected by the publication of such information were dismissed. Indeed, the Court of Appeal noted that such circumstances are highly relevant to the assessment of whether a claim for misuse of private information would be likely to succeed.
2. In respect of issue (2), it was agreed that “direct care” fell outside the scope of misuse of private information claims. The Court of Appeal found that only some data fell under direct care, making it unnecessary to define its exact limits for the appeal as “those who were covered by such use […] were not part of the represented class”.
3. The Court of Appeal rejected the argument that Williams J was incorrect in referring to “no specific reference to the medical condition” for the lowest common denominator claimant, as the class definition included partial records. Even with minimum characteristics defined under section 205(1) of the Data Protection Act 2018, a medical note might pertain to someone who had publicly shared all relevant information, thereby negating a reasonable expectation of privacy. Therefore, the Court of Appeal did not consider this ground of appeal well-founded.
4. The Court of Appeal agreed with the High Court that the only adverse effect for the lowest common denominator claimant was loss of control over data, with no significant upset or concern. Loss of control damages did not require individual assessment, focusing instead on whether the claim was more than de minimis. Williams J’s irreducible minimum scenario was deemed consistent with this approach. Indeed, it was noted that even if Williams J had “regarded upset or concern as relevant […] she would have found that the representative class failed on that basis alone, because it would require individualised assessment of damages”.
5. The Court of Appeal deemed the High Court’s refusal to allow amendments reasonable, because the proposed changes did not address the issue of public disclosure which undermined the expectation of privacy. The decision was considered a reasonable case management step, given the complexities of representative actions for misuse of private information, as highlighted in Lloyd v Google. It was noted that the High Court’s reasons did not apply to class members who attended radiology departments or had blood tests, but an action was not sought for these narrower groups (possibly because it would not have been economically viable to pursue a claim for such a small class).

After rejecting all five grounds of appeal, the Court of Appeal dismissed the appeal against the order granting reverse summary judgment and struck out the claim.

Comment

The Court of Appeal’s decision, though not advancing the case law and largely reaffirming the principles set out in Lloyd v Google, demonstrates the difficulty of fulfilling the “same interest” test under CPR 19.8 in the context of a lowest common denominator claimant scenario. This case highlights the difficulty in bringing a representative claim for misuse of private information due to the inability to carry out an individualised assessment of damages for each class member. Further, it highlights the challenges of succeeding in a claim for misuse of private information when information has been placed in the public domain.

It is worth noting that the High Court and the Court of Appeal did not accept the argument that loss of control damages inevitably involved an individual assessment. As a result, a potential future class seeking to recover damages for loss of control of data may not need to quantify their individual damage if the class succeeds in showing the same interest but will need to show a viable, more than de minimis claim for loss of control damages.

Lastly, both the High Court and the Court of Appeal referred to a bifurcated process for representative actions, whereby liability and quantum are split, which may reduce the difficulty of damages needing to be assessed on an individual basis.

Looking Ahead

Prismall emerges amid the increasing prominence of class actions in England, a point highlighted in Justin Le Patourel v BT Group PLC, the first opt-out collective action in England to reach trial. However, the claimants in Le Patourel were unsuccessful, and as a result, the High Court did not address the division of damages amongst the class. We, therefore, continue to wait for the first opt-out collective action case in England to award aggregate damages.

Prismall represents just one of an array of notable class actions that are going to be heard this year. For instance, the hearing for Dr. Rachael Kent v Apple Inc. and Apple Distribution International Ltd (set for seven weeks) before the Competition Appeal Tribunal (the “CAT”) began on 13 January 2025. Similarly, we await the outcome of two significant cases, namely, (i) Elizabeth Coll’s opt-out collective claim against Google for alleged competition law infringements, and (ii) the CAT’s hearing of the proposed settlement in the next chapter of Walter Hugh Merricks CBE v Mastercard Incorporated and Others (see our previous alert). It is important to note that these cases are distinct from the Prismall case as they fall within the opt-out regime open to claims for breaches of competition law, under the Consumer Rights Act 2015 and will take place before the CAT. Nonetheless, these cases underscore the increasing prominence of class action cases in England, contrasted with the area’s prevailing uncertainty due to the underdeveloped case law in the higher courts. This uncertainty is particularly evident with the CAT’s refusal on 14 January 2025 to certify collective proceedings against Apple and Amazon, marking the first such decision since the Supreme Court’s ruling in Merricks v Mastercard.

It is worth noting that whilst this prominence of class action cases has been driven by various factors, a key reason for this trend is because of the growth of third-party litigation funding which has made such actions easier to finance. We await the Civil Justice Council final report on third-party litigation funding (see the interim report) which is expected in Summer 2025. This review comes after the PAACAR Supreme Court case (a topic MoFo has previously covered) in which it was determined that litigation funding agreements where the funder’s recovery was linked to a share of the damages awarded to the claimant(s) were properly categorised as damages-based agreements and, therefore, had to comply with the relevant statutory requirements, otherwise they would be deemed unenforceable.

We eagerly await these imminent developments.

Senai Habteab Tesfatsion, London Trainee Solicitor, contributed to the drafting of this alert.