Alerter by Thomas Evans – Prismall v Google UK – A rock and a hard place: the tension between lowest common denominators and real prospects of success in representative actions

Click here to download this alerter by Thomas Evans.

PRISMALL V GOOGLE UK [2023] EWHC 1169 (KB)

A rock and a hard place: the tension between lowest common denominators and real prospects of success in representative actions

The High Court struck out a representative action for misuse of private information brought on behalf of 1.6m patients whose medical information was transferred, without their explicit consent, by an NHS trust to a Google subsidiary.  The judgment of Mrs Justice Heather Williams sets out the approach to identifying whether all claimants have the necessary ‘same interest’ in order to pursue a representative action.  It also highlights the risk that stripping back a claim to its lowest common denominator so as to satisfy the ‘same interest’ requirement may result in the pared down claim having no real prospect of success.  Thus, representative claimants may find themselves caught between a rock and a hard place.

INTRODUCTION

The Royal Free London NHS Foundation Trust transferred medical records concerning 1.6m identifiable patients to Deepmind Technologies Ltd (part of the Google group). The data, which was transferred without patients being informed, and without their explicit consent, was used by Deepmind to develop a machine learning application for assisting in identifying and treating acute kidney injuries.

Supported by litigation funders, one such patient – Andrew Prismall – issued a representative claim on behalf of all 1.6m affected patients, alleging that the transfer, storage and use of their medical records constituted the tort of misuse of private information (MOPI).

In order to pursue the claim as a representative action, the Representative Claimant had to assert that all 1.6m Claimants shared ‘the same interest’ within the meaning of CPR r19.8(1)[1]. Adopting the approach taken in Lloyd v Google [2021] UKSC 50, the case was pleaded on the basis of the ‘irreducible minimum harm’ common to all Claimants, or the ‘lowest common denominator’[2].  There was no claim for damages for distress, which would have given rise to differences between Claimants.  Instead, the claim was limited to damages for loss of control of personal information on a per capita basis, which, it was said, could be asserted uniformly by all Claimants.

However, therein lay the same tension which was evident in Lloyd v Google. If a representative claim is pleaded on too broad a basis, there is a risk of differences emerging between Claimants, such that they do not genuinely share the same interest.  But if, to overcome this problem, the claim is reduced to its lowest common denominator, the contrary risk might arise, with the claim, when properly analysed, being so narrow that it has no real prospect of success.[3]  The Defendants sought to expose this tension and issued an application to strike out the claim, or alternatively for summary judgment.

THE TEST FOR MOPI IN THE CONTEXT OF MEDICAL INFORMATION

It was common ground that liability for MOPI is determined according to a two-stage test: was there an objective reasonable expectation of privacy and, if so, was that expectation outweighed by a countervailing interest (§66)? It was also common ground that, generally, there is a de minimis threshold which must be overcome before liability arises (§69).  Further, the authorities established that medical information will “normally, but not invariably, be regarded as giving rise to a reasonable expectation of privacy” (§§68, 71-76[4]), but that context is important and there is no automatic reasonable expectation of privacy.  For example, attendance at a particular clinic from which the nature of an illness can be inferred may be private, but mere attendance at A&E may not be.[5]

THE SAME INTEREST

The medical records transferred to Deepmind varied greatly as between the 1.6m Claimants. Significant volumes of data would have been transferred in respect of some patients, for example, those with acute kidney conditions who attended hospital frequently for tests and treatment.  Very limited information would have been transferred in respect of those at the other end of the spectrum who, for example, attended A&E only once, did not give meaningful details on arrival and who left without being seen (§163).

It therefore appeared that the Claimants did not all have the same interest. In some cases, the Claimants would have had a reasonable expectation of privacy, but not in others.  To try to overcome this problem, two arguments were advanced:

1. 1. Although the information transferred varied between Claimants, it was all, by its nature, intrinsically private information protected by the tort of MOPI; and
   2. The claim, even if reduced to its lowest common denominator, still had a real prospect of success.

The doctor-patient relationship: always a reasonable expectation of privacy?

The Representative Claimant sought to distinguish, as a subset of medical information, a special category of data generated in the course of the doctor-patient relationship. Such information, it was argued, is private by its very nature (§77).  Accordingly, the apparent difficulty created by the fact that different information was transferred in respect of different Claimants was illusory.  It was not necessary to consider the specific facts of each case as the transfer of any medical information from the doctor-patient relationship was sufficient.

The Court rejected this argument (§§124-133). Information generated within the doctor-patient relationship may be private, but is not necessarily and inherently private.  The tort of MOPI, which derives from the Article 8 right to privacy, arises only when a threshold of seriousness is crossed following an analysis of all the facts.  It does not apply to categories of information per se, and to apply it as such, without an assessment of the facts, would result in liability arising for trivial breaches.  Further, information generated within the doctor-patient relationship may already be in the public domain (where, for example, a patient tweets on the way to hospital that they have fractured their ankle) and it is difficult to see why such information, subsequently generated within the doctor-patient relationship, should be private if it has already been made public.

At the irreducible minimum core, was there a real prospect of success?

As the information transferred in respect of all 1.6m Claimants was not inherently private, it became necessary for the Court to consider whether every Claimant had a reasonable expectation of privacy, notwithstanding the fact that, in each case, different information would have been transferred. The Court approached this task by identifying “the basic circumstances that would apply to each member of the Claimant Class” whilst discounting examples of cases in which “highly personalised and substantial medical information was transferred” (§§121-122).  In essence, the task was to describe the characteristics of the weakest Claimant in the group and to test his or her case.  If that case had a real prospect of success, then so would every case; but if it did not, then the Claimants would not all share the same interest and it would be a case of ‘one out all out’.

The Court considered the witness evidence and identified that the lowest common denominator was that, in outline, each Claimant attended hospital only once, that the information sent to Deepmind did not include information of particular sensitivity, contained only limited demographic information, that no upset or concern was caused, and that the only adverse effect was the fact of the sheer loss of control of the data (§166). The Court also assumed that, in the case of the lowest common denominator, the medical records in question would contain information already in the public domain at the time of transfer, as patients would have posted details of their medical history on social media.

The Court ignored the fact some Claimants would have benefitted from the diagnostic and treatment application which was developed, and the 54,000 alerts which it generated (§54). Whilst seemingly not determining the point, the Judge accepted that if a cause of action in MOPI existed at a particular point in time, it would not be destroyed by a subsequent event such as improved treatment, albeit that such an outcome would be relevant to any assessment of individual damages (§167).

Conclusions

Having described the case at its irreducible minimum core, the Judge held that not every Claimant had a realistic prospect of establishing a reasonable expectation of privacy in respect of their own medical records or of crossing the de minimis threshold (§168). As such, since some claims were bound to fail, the Claimants as a whole did not share the same interest.  Noting the tension between identifying the lowest common denominator and a viable cause of action, the Judge held (at §169) that:

“[T]he claim as currently advanced on a global irreducible minimum basis in order to try and meet the “same interest” criterion for a representative action cannot succeed. It cannot be said that every member of the class across the board has a viable claim. Equally, departing from the lowest common denominator scenario and bringing into account individualised factors for the purposes of showing that a reasonable expectation of privacy exists in particular situations would mean that the “same interest” test was not met. Either way the claim is bound to fail.”

Further, the Court highlighted the fact that some Claimants would have publicised their medical details online as a particular cause of tension between there being an irreducible case common to all Claimants and a sustainable cause of action. At §138:

“…either the variables inherent in the nature, degree and content of that publicity means that individualised assessment of each claim is required (so that a representative action is not possible), or if the claims are to be advanced on a global, irreducible minimum basis, then that irreducible minimum has to reflect a situation in which the patient identifiable information was already in the public domain in its entirety.”

Similarly, on the basis of the irreducible minimum facts, it was held that even if a cause of action in MOPI could be established, there would be no realistic prospect of each and every Claimant – on the basis of the minimum facts alone – achieving more than nominal damages for loss of control of data (§175).

Consequences

The representative claim had no real prospect of success. The Court considered whether to permit amendments.  However, there was no draft pleading before the court, and the difficulties faced were inherent such that they could not be cured by an amendment (§§181-185).  The claim form and particulars of claim were therefore struck out and permission to appeal was refused.

Thomas Evans

24 May 2023

[1] “Where more than one person has the same interest in a claim – (a) the claim may be begun… by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.”

[2] The Representative Claimant initially brought proceedings in breach of statutory duty, but discontinued that claim following the Supreme Court decision in Lloyd v Google, leaving only MOPI (§23).  It should be noted that, in Lloyd, Lord Leggatt speculated that the absence of a MOPI claim might have been due to the need to establish individual facts (Lloyd, paras 105-106).

[3] This dilemma is perhaps most acutely faced where the representative action procedure is put to “unusual and innovative use” (Lloyd v Google [2019] EWCA Civ 1599 para 7) in an attempt to mirror, in effect, a class action regime which otherwise does not exist in England and Wales (save in the limited context of competition law).

[4] Citing ZXC v Bloomberg LP [2022] UKSC 5, para 50.

[5] §73, citing ZC v Royal Free London NHS Foundation Trust [2019] EWHC 2040 (QB) para 170.

This alerter is available to download as a PDF below.

To subscribe to Henderson Chambers news, alerters and updates please click here.