Andrew Prismall v Google UK Limited & Anor

Patient-identifiable information in medical records will normally attract a reasonable expectation of privacy, but that is a starting point rather than an invariable rule. Liability for misuse of private information requires an objective assessment of all the circumstances and satisfaction of a threshold of seriousness. A patient’s own publication of the relevant information is a material circumstance.

A representative claim under rule 19.8 of the Civil Procedure Rules 1998 cannot proceed where the least favourable claim within the defined class has no realistic prospect of success. The individual circumstances affecting privacy make representative claims for misuse of private information particularly difficult.

The representative claimant sought damages for loss of control on behalf of approximately 1.6 million patients. Their patient-identifiable medical records had been transferred by an NHS trust to the respondents for the development of a clinical application and potentially wider commercial purposes, without their knowledge or consent.

The High Court struck out the representative claim and entered reverse summary judgment for the respondents: [2023] EWHC 1169 (KB). It held that the least favourable member of the class had no realistic prospect of establishing a reasonable expectation of privacy or crossing the de minimis threshold.

The appeal concerned whether all information generated within a patient and healthcare-provider relationship necessarily attracted a reasonable expectation of privacy; the relevance of information already made public by a patient; direct care; the definition of the class; loss-of-control damages; and permission to amend.

1. Appeal dismissed. The judge correctly struck out the representative claim and entered reverse summary judgment for the respondents.

2. Misuse of private information has two stages. The first asks objectively whether a person of ordinary sensibilities, placed in the claimant’s position and faced with the same publicity, would have a reasonable expectation of privacy. This broad inquiry considers all the circumstances and is subject to a threshold of seriousness. Only if that threshold is met does the court balance the claimant’s privacy interest against any countervailing interest of the defendant.

3. Patient-identifiable information in medical notes will normally attract a reasonable expectation of privacy. Medical confidentiality protects both the patient’s privacy and public confidence in medical services. That starting point does not invariably determine liability in the tort. The court rejected the contention that every patient-related HL7 message necessarily satisfied the seriousness threshold.

4. A patient’s own publication of the relevant medical information, and the manner in which it entered the public domain, form part of the circumstances bearing on the first stage. Publication of some information does not necessarily remove the expectation of privacy from all other information in the patient’s medical notes. Nevertheless, the defined class included a person who had publicly disclosed all the relevant information. That person had no realistic prospect of establishing the tort, so the members lacked the same interest required by rule 19.8(1) of the Civil Procedure Rules 1998.

5. Direct care fell outside the pleaded claim because patients impliedly consent to the use of their medical information for treatment. The judge had found that only some of the alleged uses constituted direct care. The precise boundary required no determination on the appeal.

6. The class included partial patient-identifiable medical records, which might contain no specific reference to a medical condition. Section 205(1) of the Data Protection Act 2018, concerning data which reveal health status, did not alter that conclusion. The judge had also treated loss of control, rather than upset or concern, as the relevant adverse effect in the irreducible minimum scenario.

7. The judge was entitled to refuse permission to amend. The proposed amendments did not cure the decisive defect because the class would still include a patient who had publicly disclosed all the information recorded. No order was sought permitting the radiology and blood-test subclasses alone to continue.

1. Court of Appeal (Civil Division): The court dismissed the appeal from the order granting reverse summary judgment and striking out the representative claim: [2024] EWCA Civ 1516.
2. High Court, King’s Bench Division: Heather Williams J struck out the claim, entered summary judgment for the defendants and refused the representative claimant an opportunity to amend: [2023] EWHC 1169 (KB).