Court of Appeal considers the test for CPR 19.8 representative actions in Prismall v Google

Background

Mr Prismall brought a representative action pursuant to CPR 19.8 for the tort of misuse of private information against Google UK Limited and DeepMind Technologies Limited. The action was on behalf of Mr Prismall and a class of people said to number approximately 1.6 million.

Mr Prismall alleged that data, comprising patient-identifiable medical records held by the Royal Free London NHS Foundation Trust, was transferred to and misused by Google and DeepMind for the purposes of developing a health app. Mr Prismall’s claim was for “loss of control” damages.

The Court of Appeal noted that there were two points that were fundamental to the claim:

1. There was a need to show that each member of the class had a realistic prospect of establishing the misuse of private information, in order to meet the “same interest” test under CPR 19.8. This required each member of the class to have a “reasonable expectation of privacy” in respect of the information they alleged had been misused.
2. Each member of the class had to have a realistic prospect of succeeding in their claim. This required assessing the prospects of success for the “lowest common denominator claimant” - a claimant within the class of 1.6 million people whose claim represents the “irreducible minimum scenario” for a claimant in the class.

Reasonable expectation of privacy

CPR 19.8 requires all of the members of a claimant class to have the “same interest” in the claim. At a high level, this means that all of the class members must share common issues and the same aims. The reason for this requirement, as emphasised by Lord Leggatt in Lloyd v Google [2021] UKSC 50, is to ensure that the class representative can “be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all members of the represented class”.

In Prismall, Mr Prismall was pursuing a claim for the tort of misuse of private information on behalf of all of the class members. For this to constitute a legitimate representative action, the Court had to be satisfied that all of the class members effectively shared that cause of action, without divergent issues or interests. This required him to demonstrate that all of the class members had a “reasonable expectation of privacy” in respect of all of the medical information that had been shared by Royal Free London.

Whether a claimant has a “reasonable expectation of privacy” in respect of the information they alleged has been misused is an objective test. There is a minimum threshold of seriousness which must be overcome before liability for the tort of misuse of private information accrues.

The Appellants argued that the “seriousness” threshold would always be met where the information that had allegedly been misused were the medical records that the claim was based on and which had been generated in the course of a doctor-patient relationship.  The Court of Appeal disagreed. It found that:

1. The “starting point” is that there will normally be a reasonable expectation of privacy for any patient identifiable information in medical notes but that this “starting point” will not always be the “end point” and “everything will depend on the particular circumstances of the individual case”.
2. The extent to which the information is in the public domain is also a factor to consider. In this case, Mr Prismall had himself contributed to media reports about his medical condition (when setting out his support for a campaign to increase uptake on the organ donor register), as had another class member. The Court of Appeal found that, where a patient has placed medical information in the public domain, “a claim for misuse of private information will not invariably succeed” because that patient may not have a reasonable expectation of privacy in respect of that information, although that “does not mean that the reasonable expectation of privacy in all of the patient identifiable information in the medical notes will necessarily be lost”.

The effect of this in Prismall was that the Court could not be satisfied that all members of the class had the “same interest” in the claim: there might be relevant individualised circumstances in relation to particular claimants – for example, the type of medical information that was shared, or that they have publicly shared their medical information - which would affect whether they had a reasonable expectation of privacy. This divergence between claimants could result in members of the class failing to meet the relevant threshold for the tort of misuse of private information, meaning there would be potentially different outcomes to individual members’ claims.

The Court of Appeal therefore concluded that in this case the same interest test was not met.

Bifurcation

Later in its judgment the Court of Appeal referred to Lord Leggatt’s explanation in Lloyd v Google that there could be “advantages” in adopting the bifurcated process whereby liability and quantum is split in representative action cases. This would allow “common issues of fact and law to be determined through a representative claim, leaving issues that require individual determination, whether relating to liability or damages to be dealt with at a subsequent stage”. After referring to this, the Court of Appeal simply noted that a bifurcated process had not been proposed for this claim. 

Conclusion

The Court of Appeal’s judgment in Prismall continues the English Courts’ journey in considering what claims can appropriately be brought as representative actions under CPR 19.8, and what claims cannot. This judgment further cements the difficulties claimants might face in bringing data privacy claims as representative actions following the Supreme Court decision in Lloyd v Google.