Prismall v Google UK Ltd [2024] EWCA Civ 1516
This was not a class action but a representative action, pursuant to what is now Civil Procedure Rule (CPR) 19.8, for the tort of misuse of private information against the respondents Google UK Limited (Google) and DeepMind Technologies Limited (DeepMind). The action was on behalf of Mr Prismall and a class of persons said to number approximately 1.6 million.
The appeal was against the striking out of his representative claim for misuse of private information in the court below. In a representative action like this the task before the judge is to establish whether the “lowest common denominator” claimant in the class would fail to make their claim. The judge found that the lowest common denominator claimant in the group of persons represented did not have a realistic prospect of success.
Details of the Case
The claim was for damages in respect of both the one-off transfer by the Royal Free London NHS Foundation Trust (the Royal Free Trust) of data in October 2015, and the continuing transfer of data thereafter until 29 September 2017 pursuant to a live data feed. The data which was transferred took the form of patient-identifiable medical records held by the Royal Free Trust of patients, including Mr Prismall, who had attended hospitals in the Royal Free Trust or had blood tests processed by laboratories operated by the Royal Free Trust between 29 September 2010 and 29 September 2015. Google and DeepMind used the data for the purposes of developing an app called “Streams” which was intended to be used to identify and treat patients suffering from Acute Kidney Injury. Google and DeepMind also had, however, a contractual entitlement to use the data for purposes wider than direct patient care and to develop and prove capabilities to enhance future commercial prospects.
At first instance the judge found that each member of the class did not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their medical records or of crossing the de minimis threshold in relation to such an expectation such that there was no realistic prospect of establishing misuse of private information of each member of the class, or a realistic prospect of establishing an entitlement to damages for loss of control. The lowest common denominator was a notional claimant in the class whose claim represented the “irreducible minimum scenario” for a claimant in the class of persons. The judge’s lowest common denominator claimant was premised on the basis that there was one attendance at a trust hospital, which was an attendance not concerning “a medical condition involving any particular sensitivity or stigma” and there being “no specific reference to the medical condition that had prompted the attendance”. The judge had identified for the irreducible minimum scenario for the lowest denominator claimant that “no upset or concern was caused by the data transfer”. The judge found that the lowest common denominator claimant’s claim would fail.
Grounds of claim
Mr Prismall’s claim related to the wrongful use of private patient information by Google and DeepMind in: (1) obtaining patient-identifiable medical records with a contractual entitlement under the Information Sharing Agreement which was wider than direct patient care and the Streams project;
(2) storing the medical records prior to Streams becoming operational;
(3) using the medical records in the research and development of Streams; and
(4) developing and providing their general capabilities by the use of the medical records for the purposes of future commercial prospects.
Damages were claimed for loss of control of the private information only.
The judge said that it was “also well-established that not every disclosure of medical information will give rise to a reasonable expectation of privacy and/or involve an unlawful interference.” If anodyne or trivial information about a brief hospital visit was made public by a patient, the judge saw no reason why that information would attract a reasonable expectation of privacy by dint of it being recorded in a medical record.
The tort of misuse of private information involves two stages. Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If this is shown, then stage two involves a balancing exercise to determine whether that expectation is outweighed by a countervailing interest of the defendant. The development of the tort of misuse of private information was influenced by article 8 of the ECHR which was given domestic effect by the Human Rights Act 1998. n Z v Finland (1998) 25 EHRR 371 for example, at para 95 it was said that: “Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.”
The questions before the Court
(1) whether the lowest common denominator claimant had a real prospect of succeeding in a claim for misuse of private information, because all patient-related information generated in the course of a patient and healthcare provider relationship gives rise to a reasonable expectation of privacy (save for direct care) and because a claim for misuse of private information would succeed even where a patient has placed that medical information in the public domain;
(2) whether the judge adopted too wide a definition of direct care;
(3) whether the judge was wrong to refer to a lowest common denominator claimant who had not given any medical information to the doctor;
(4) whether the judge was wrong to consider upset or concern as being relevant to the identification of the lowest common denominator claimant;
(5) whether the judge should have permitted Mr Prismall an opportunity to amend his statement of case.
The Court’s decision
There is only one condition that has to be satisfied under the Civil Procedure Rules before a representative claim may be begun or allowed to continue, namely that the representative has the “same interest” in the claim as the persons represented. It was accepted by the appellant that if some members of the represented class were not able to establish the ingredients of a claim, then the “same interest” requirement was not met. This meant that it was common ground that recovery of individualised damages for any member of the 1.6 million class could not be pursued by means of a representative action. All that could be recovered is what was referred to as “the lowest common denominator damages” for each member of the class.
The Court dismissed the appeal against the strike out order.
Reasoning behind the judgment
Real prospect of success – The starting point was that there would normally be a reasonable expectation of privacy for any patient-identifiable information in medical notes. However that would not always be the end point because the instant case was concerned with the tort of misuse of private information and not, for example, with a breach of regulatory duties. The tort involved a threshold of seriousness and everything depended on the particular circumstances of the individual case. Consequently, the threshold would not always be satisfied in respect of every message generated in respect of a patient. Patients could make private information public via social media and, if they did, and then brought proceedings where the reasonable expectation of privacy in respect of that information was in issue, the fact that the information was public, and the manner in which it had entered the public domain would inevitably form part of the relevant circumstances to be considered in determining whether the stage one threshold for the tort had been surmounted. A claim for misuse of private information would not invariably succeed where a patient had placed medical information in the public domain; and thus, the “same interest” requirement in CPR r.19(8)(1) was not met. A representative class claim for misuse of private information was always going to be very difficult to bring, (Google LLC v Lloyd [2021] UKSC 50).
Medical information – The judge’s reference to “no specific reference to the medical condition” was consistent with the definition of the class being “patient-identifiable” and “a medical record (whether partial or complete)”. A partial medical record might contain no specific reference to the medical condition. That ground of appeal was not well-founded (para.74).
Upset and concern – It was not apparent from the judgment that the judge had regarded those factors as relevant (para.78).
Amendment – The difficulty with the appellant’s proposed amendments, which sought to make clear who was part of the class and to define medical records, was that they did not deal with the main reason why the judge had found that there was no real prospect of success for the lowest common denominator claimant, namely the publication by that patient of the relevant information on social media. If the lowest common denominator claimant published information about his hospital attendance, they would not have a reasonable expectation of privacy in that information contained in a medical record. The judge had not been wrong to refuse to permit Mr Prismall to amend the class in the particulars of claim. It was a case management decision for good reason. The difficulties of bringing a representative action for misuse of private information had not been surmounted in his claim (paras 82-83).
The post Misuse of private information: Google and DeepMind Technologies appeared first on UK Human Rights Blog.