Prismall v Google UK Ltd & Ors (appeal)

This appeal concerned a representative action under CPR 19.8 for misuse of private information arising from the Royal Free London NHS Foundation Trust’s transfer of patient-identifiable medical records to Google and DeepMind (a one-off transfer in October 2015 and a live data feed until 29 September 2017). The Court of Appeal confirmed that a representative claim under CPR 19.8 requires that the representative and all represented persons have the "same interest" and, following the approach in Lloyd v Google, that each member of a represented class must have a realistic prospect of success when only "lowest common denominator" damages are sought.

The court applied the two-stage test for misuse of private information (reasonable expectation of privacy; balancing exercise) and the Murray factors, emphasising that medical-record information will normally attract a reasonable expectation of privacy but that a threshold of seriousness applies and all circumstances must be considered. The judge below had identified an "irreducible minimum" factual scenario for a notional class member and concluded there was no realistic prospect that each class member could establish a reasonable expectation of privacy or cross the de minimis threshold for loss-of-control damages. The Court of Appeal dismissed the appeal, upholding strike out and reverse summary judgment and agreeing that amendment would not have cured the fundamental difficulty posed by public-domain/publicity variables and the requirement to show a realistic prospect for every class member.

Background and parties: The appellant, Mr Andrew Prismall, brought a representative claim under CPR 19.8 on behalf of himself and a class of about 1.6 million persons, against Google UK Limited and DeepMind Technologies Limited for the tort of misuse of private information in respect of patient-identifiable medical records transferred by the Royal Free Trust and used to develop the Streams app and for other purposes. The claim sought damages for loss of control of private information.

Procedural posture: At first instance Mrs Justice Heather Williams struck out the representative claim and entered summary judgment for the defendants ([2023] EWHC 1169 (KB)). The appeal challenged the judge’s finding that each class member lacked a realistic prospect of establishing a reasonable expectation of privacy and the judge’s refusal to permit amendment.

Issues framed: (i) whether all patient-related information generated in the doctor–patient relationship automatically gives rise to a reasonable expectation of privacy (outside direct care) and whether publication by a patient is irrelevant to that expectation; (ii) whether the judge adopted too wide a definition of "direct care"; (iii) whether the judge wrongly treated the lowest common denominator claimant as potentially having no specific medical content in their record; (iv) whether the judge wrongly treated upset or concern as relevant to the irreducible minimum scenario for loss-of-control damages; and (v) whether the claimant should have been permitted to amend.

Court’s reasoning and conclusions: The court reiterated the two-stage test for misuse of private information and the relevance of the Murray factors and ZXC v Bloomberg. It accepted that medical-record information will normally attract a reasonable expectation of privacy but held that this is not automatic: a threshold of seriousness must be crossed and all circumstances of the individual case matter. Materially, a patient’s publication of information and the manner in which information has entered the public domain are relevant to the objective assessment. The Court held that a representative claim demanding only lowest common denominator damages faces particular difficulty because the "same interest" requirement is not met if some class members cannot establish the necessary elements without individualised evidence (applying Lloyd v Google). The judge’s irreducible minimum scenario was reasonable, and the refusal to permit amendment was a defensible case-management decision because the suggested amendments would not resolve the core difficulty posed by members who had placed relevant information in the public domain. The appeal was dismissed.

This is an appeal from a first-instance strike out and reverse summary judgment. The appeal is dismissed. The Court held that (1) although patient-identifiable medical records will often attract a reasonable expectation of privacy, that expectation is not automatic; a threshold of seriousness applies and the specific circumstances (including whether the patient has placed information into the public domain) are relevant; (2) following Lloyd v Google a representative claim under CPR 19.8 must show that each member of the class has a realistic prospect of success on the lowest common denominator basis, which was not established here; and (3) the judge did not err in refusing permission to amend because the proposed amendments would not have overcome the fundamental difficulty identified.

Appeal from Mrs Justice Heather Williams, High Court of Justice, King’s Bench Division, Media and Communications List, [2023] EWHC 1169 (KB); this Court (Court of Appeal Civil Division) dismissed the appeal, [2024] EWCA Civ 1516.