Multi-party claims for misuse of data: how do you take them forward? GLOs yes, though they are often seen as too unwieldy. Straightforward multi-claimant litigation using ‘omnibus’ claim forms is fine, but doesn’t get litigation funders the maximum volumes they seek. Representative actions under CPR 19.8 are the ideal vehicle in that sense, but Lloyd v Google effectively killed them as regards data protection claims (no loss of control damages; individualised assessment needed). Can misuse of private information claims (loss of control damages available; individualised assessment perhaps not needed) fare better? The Prismall action was the leading post-Lloyd candidate on this front, but it has suffered another death this Advent.
Panopticon reported in 2023 that the High Court (Mrs Justice Heather Williams) struck out Mr Prismall’s representative claim for misuse of private information. Last week, the Court of Appeal (Dame Victoria Sharp, Lady Justice Nicola Davies and Lord Justice Dingemans) dismissed the appeal: see Prismall v Google UK Limited and DeepMind Technologies Limited [2024] EWCA Civ 1516.
It is, truth be told, not a judgment that takes the jurisprudence or thinking on these issues further forward. It basically just says the High Court got it right. The points made in Panopticon’s previous post hold good.
A quick factual recap: this was a representative claim for damages based on a transfer of patient-identifiable medical records from the Royal Free London NHS Trust to Google and DeepMind in 2015 and a live data feed up to 2017, partly for help with direct care (no complaint about that) but partly for those companies to develop their commercial offerings using NHS patient data (which is the crux of the misuse complaint).
It was common ground that misuse claims on that footing might succeed on a case-by-case basis: there is a presumption that medical data is private. But, in order to survive strike-out/summary judgment as a representative action – which requires that each member of the claimant class has the ‘same interest – every member of the class of approximately 1.6 million patients had to have a realistic prospect of (i) establishing a reasonable expectation of privacy in respect of their medical records, and (ii) doing so in a way that met the minimum threshold of seriousness. Those factors blend into each other, and they need to be assessed on a ‘lowest common denominator’ basis, i.e. taking the position across the class at its lowest. And this was where the claim failed.
Why did it fail? Because some medical data will be trivial or anodyne (‘I banged my leg so I went to the doctor but it was fine’; there might end up being no real medical data here at all), and because at least some people within the class will have shared that minimum medical data publicly (e.g. on social media) in any event. The defendants adduced actual examples of claimant patients doing so, in press interviews. The Court found it distasteful that these patients’ altruism in giving those interviews was used against them (see para 64), but nonetheless found that this factor – the reality that some people will have publicly shared their medical data was “the main reason” the claim failed (para 82). Tinkering with pleadings so as to define the class in a way that excluded people who had shared their medical data was too difficult (para 80). The upshot was that Team Prismall was stuck with a class that included some over-sharers, which was fatal to the reasonable expectation of privacy/seriousness threshold arguments for the whole class under CPR 19.8.
This is really challenging stuff for representative claims. Even with sensitive information that 99.9% of people would keep private, some minority will reveal it on social media, and this – on the High Court and Court of Appeal’s analysis – is enough to kill off the representative claim. As the Court of Appeal put it somewhat understatedly, this illustrates the difficulty “of coming at justice in a digital case involving numerous potential claimants” (para 64).
Game over for coming at justice the CPR 19.8 way?
11KBW’s Tim Pitt-Payne KC and Stephen Kosmin, instructed by Mishcon de Reya, appeared for Mr Prismall.
Robin Hopkins