Introduction

Prismall v Google UK Ltd & Anor ([2024] EWCA Civ 1516) is a pivotal judgment from the England and Wales Court of Appeal (Civil Division) that addresses significant issues surrounding representative actions in the context of misuse of private information. The appellant, Andrew Prismall, initiated a representative claim under Civil Procedure Rule (CPR) 19.8 against Google UK Limited and DeepMind Technologies Limited. The claim was brought on behalf of Mr. Prismall and an estimated class of 1.6 million individuals whose patient-identifiable medical records were transferred by the Royal Free London NHS Foundation Trust to Google and DeepMind for the development of the "Streams" app, intended to identify and treat Acute Kidney Injury.

The core issues in this case revolve around whether the court erred in striking out the representative claim, particularly focusing on the realistic prospect of each class member establishing a reasonable expectation of privacy and crossing the de minimis threshold necessary for establishing misuse of private information.

Summary of the Judgment

The Court of Appeal upheld the lower court's decision to strike out Mr. Prismall's representative claim. The primary reasoning was that each member of the approximately 1.6 million-person class lacked a realistic prospect of establishing a reasonable expectation of privacy regarding their medical records. Consequently, the threshold required to demonstrate misuse of private information was not met on a class-wide basis. The court emphasized the stringent "same interest" requirement under CPR 19.8(1), which mandates that all class members must share the same interest in the claim's outcome. Additionally, the court reiterated the challenges highlighted in Lloyd v Google LLC [2021] UKSC 50, where the Supreme Court dismissed a similar class action due to the failure of the lowest common denominator members to meet the necessary thresholds for claiming damages.

Analysis

Precedents Cited

The judgment extensively references several key precedents that have shaped the legal landscape for misuse of private information and representative actions:

• Lloyd v Google LLC [2021] UKSC 50: Established stringent requirements for representative actions, emphasizing the necessity for each class member to have a realistic prospect of success.
• ZXC v Bloomberg LP [2022] UKSC 5: Reinforced the principles surrounding reasonable expectation of privacy and the balancing of interests under the European Convention on Human Rights (ECHR).
• Campbell v MGN [2004] UKHL 22: Clarified that not all disclosures of personal information warrant a reasonable expectation of privacy.
• Murray v Express Newspapers plc [2008] EWCA Civ 446: Identified factors (Murray factors) to consider when determining a reasonable expectation of privacy.
• ZC v Royal Free London NHS Foundation Trust [2019] EWHC 2040 (QB): Discussed the privacy implications of mere attendance at medical facilities.

These cases collectively underscore the judiciary's cautious approach towards class actions in privacy contexts, ensuring that individual thresholds are not undermined by collective claims.

Legal Reasoning

The court's legal reasoning was anchored in the two-stage test for misuse of private information:

1. Reasonable Expectation of Privacy: Whether the claimant objectively has a reasonable expectation of privacy in the relevant information.
2. Balancing of Interests: If such an expectation exists, whether it is outweighed by the defendant's countervailing interests.

In this case, the court concurred with the lower judge's assessment that the "lowest common denominator" claimant — representing the minimal scenario — did not meet the threshold for a reasonable expectation of privacy. Factors influencing this decision included the nature of the medical information transferred, the lack of individual adverse effects, and the use of data beyond direct care purposes. The court also rejected the appellant's arguments that the publication of some medical information by class members should not diminish the overall expectation of privacy, maintaining that each case's specific circumstances critically influence the threshold assessment.

Impact

This judgment reaffirms the high bar set for representative actions in cases involving misuse of private information. It emphasizes that:

• Each class member must independently satisfy the threshold for privacy claims.
• Representative actions remain challenging in privacy contexts due to the necessity of homogenous "same interest" among class members.
• The decision underscores the judiciary's commitment to safeguarding individual privacy rights while balancing them against practical considerations in large-scale data usage scenarios.

Future cases will likely reference this judgment to determine the viability of class actions in similar contexts, thereby shaping the contours of collective redress mechanisms in privacy law.

Complex Concepts Simplified

Representative Actions

Representative actions allow one or more individuals to bring a claim on behalf of a larger group with similar interests. Under CPR 19.8, all represented individuals must share the same interest in the claim's outcome. This ensures that the representative can effectively advocate for everyone without conflicting interests.

Lowest Common Denominator Claimant

This term refers to a hypothetical claimant who represents the minimal scenario within a class. Their situation embodies the least favorable conditions for a claim to succeed. If the lowest common denominator cannot meet the legal thresholds, the entire class action is likely untenable.

Misuse of Private Information

This tort involves the unauthorized use of an individual's private information. To establish it, one must demonstrate a reasonable expectation of privacy regarding the information in question and that its use was inappropriate or unlawful under the circumstances.

De Minimis Threshold

This refers to the minimal level of impact or seriousness required for the courts to recognize a claim. In privacy cases, even trivial disclosures might not meet this threshold, especially in large-scale data sharing contexts.

Same Interest Requirement

Under CPR 19.8, all members of a representative class must share the same interest in the litigation's outcome. This means that the factors influencing the success of their claims must be sufficiently similar to justify collective representation.

Conclusion

The Prismall v Google UK Ltd & Anor judgment solidifies the judiciary's stance on the stringent requirements for representative actions in the realm of privacy law. By upholding the principle that each individual in a class must independently meet the thresholds for claiming misuse of private information, the court ensures that collective claims do not dilute individual privacy rights. This decision serves as a critical reference point for future litigation, highlighting the complexities and limitations of pursuing large-scale data misuse claims through representative actions. Practitioners and claimants must recognize the inherent challenges and prepare to demonstrate individual merits within their claims to navigate the evolving landscape of privacy jurisprudence effectively.