Acting as the Representative Claimant, Andrew Prismall relied upon CPR 19.8(1) to bring a representative claim for damages in the tort of misuse of private information against Google UK Ltd and DeepMind Technologies Ltd on behalf of a class of approximately 1.6 million people in relation to the transfer of patient-identifiable medical records held by the Royal Free London NHS Foundation Trust.

In September 2015, Deep Mind and the Royal Free entered into an Information Sharing Agreement (ISA). Pursuant to this, a one-off transfer of historical data to DeepMind occurred in October 2015 (the Data Transfer) and a live data feed was also established in respect of subsequent medical records. The ISA stated that its purpose was to gather data to put into a product developed by the Defendants called “Patient Rescue”, which consisted of Patient Safety Alerts for acute kidney injury (AKI) and real time clinical analytics to support treatment. After the ISA was entered into, the product developed into an app known as Streams, which had the same purpose, i.e. to assist clinicians at the Royal Free to identify and treat patients potentially suffering AKI. The app was registered with The Medicines and Healthcare Products Regulatory Agency (MHRA) in August 2016 and became operational in February 2017.

Mr Prismall said that he had received extensive treatment at the Royal Free and had not consented to his medical records being collected, stored or used by the Defendants. He said that his medical records were included in the Data Transfer, which contained the medical records of approximately 1.6 million other patients. Therefore, he said, he had the same interest in the claim as each member of the Claimant Class.

Mr Prismall also said that he and the Claimant Class had a reasonable expectation of privacy in the identifiable and confidential medical information that had been transferred and that unless express consent had been obtained, such information could only be shared for the purposes of “direct care”, which is limited to activities directly contributing to the diagnosis, care and treatment of a patient. He said that the Data Transfer took place without any of the Claimant Class knowing or consenting to it. Further, the purpose of the Data Transfer had not been to provide direct care, but to facilitate the development of Streams. Since the Streams app was not registered with the MHRA until August 2016, he said that it could be inferred that Streams was not available for the provision of direct care to patients before that time and/or that the medical records included in the Data Transfer could not have been reasonably expected by members of the Claimant Class to be collected, stored, and/or used by the Defendants for direct care before such registration.

The claim was confined to “lowest common denominator damages” for loss of control for each member of the class, i.e. compensation calculated by reference to the irreducible minimum harm suffered by all members of the class. Mr Prismall accepted that any class member who wished to seek additional compensation would have to opt out of the class and bring their own claim.

The Defendants applied to strike out the claim under CPR 3.4(2)(a), submitting that no reasonable grounds for bringing the claim had been disclosed, and/or for summary judgment under CPR 24.2, arguing that the representative claim had no real prospect of succeeding and there was no other compelling reason why the case should be disposed of at a trial.

The Defendants argued that:

• the circumstances of the class members were so varied that Mr Prismall had no real prospect of establishing that the Defendants had misused the private information of all members of the Claimant Class and that as some members of the class did not have a viable claim, not all members had the “same interest” within the meaning of CPR 19.8; and, in any event,
• even if a lowest common denominator approach was permissible in principle (which was not accepted) it did not assist the Mr Prismall; as in Lloyd v Google LLC [2022] AC 1217, Mr Prismall was unable to circumvent the requirement for individualised assessment by relying on the lowest common denominator approach because it could not be said of any individual in the Claimant Class that they had a viable claim for more than trivial damages.

Mrs Justice Heather Williams DBE noted that for members of the class to have the “same interest” they all had to have a realistic prospect of establishing a reasonable expectation of privacy in their relevant data and an unlawful interference with it. Determining reasonable expectation of privacy of an individual usually involves an assessment of their individual circumstances. She noted the Defendants’ emphasis on the number of variable circumstances that could arise between class members.

Williams J also noted Mr Prismall’s argument that in establishing the cause of action, variables should not be considered and that the claim should proceed based on an irreducible minimum applicable to all class members. Proceeding this way, Mr Prismall said, meant that the “same interest” criterion was met. It followed that the question of whether there was a realistic prospect of establishing a reasonable expectation of privacy in relation to all its members should be considered by reference to the basic circumstances that would apply to each member of the Claimant Class.

Williams J held that the court’s task was to determine whether every member of the Claimant Class had a realistic prospect of showing a reasonable expectation of privacy in their transferred records. She took Mr Prismall’s approach and established, on the facts, an irreducible minimum scenario that could be applied to every member of the Claimant Class to try and meet the “same interest” test. In that scenario there was, for example, one attendance at the Royal Free, during which limited demographic information was recorded and, although the data transferred was transferred and stored in circumstances which arguably went beyond direct patient care, the storage was secure and the information was not accessed during the 12 months it was kept.

Based on this scenario, Williams J concluded that each member of the Claimant Class did not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation. Williams J found that in the scenario identified: (i) very limited information was transferred and stored; (ii) although health-related, the information was anodyne in nature; (iii) this information was held securely and not accessed by anyone during the storage period; (iv) the information was already in the public domain; (v) the alleged acts of interference outside of patient direct care were limited to the transfer of the data and to its secure storage for up to 12 months; and (vi) that this caused no impact other than the loss of control itself.

Accordingly, Williams J held, the claim as currently advanced on this basis could not succeed. It could not be said that every member of the class had a viable claim. Equally, departing from the lowest common denominator scenario and bringing into account individualised factors for the purposes of showing that a reasonable expectation of privacy existed in certain situations meant that the “same interest” test was not met. Either way, she said, the claim was bound to fail.

Williams J also found that, for similar reasons, there was no realistic prospect of the court concluding at trial that all members of the Claimant Class had experienced a wrongful interference with their personal data. In any event, the Defendants would be able to rely on the objective of the Streams app and the beneficial outcomes that it achieved to justify the interference.

Williams J also held that it could not be said of any member of the Claimant Class that they had a viable claim for more than trivial damages for loss of control of their information. Finally, there was no other compelling reason to permit the claim to proceed to trial.

Williams J ordered the claim to be struck out and summary judgment entered for the Defendants. She did not consider that it was in the interests of justice to permit Mr Prismall to attempt to revise the claim before making that determination. (Andrew Prismall v Google UK Ltd [2023] EWHC169 (KB) (19 May 2023) — to read the judgment in full, click here).