Once again, Google has been challenged in an opt-out data privacy representative action under CPR 19.8^[1] and once again, Google has emerged triumphant: On 19 May 2023, the High Court of Justice granted an application to strike out and for summary judgment in a representative action brought by Andrew Prismall as representative claimant versus Google UK Limited and Deepmind Technologies Limited as Defendants.^[2] The decisions underlines that even two years after the UK Supreme Court’s 2021 decision in Lloyd v Google^[3], a recipe on how to surmount the barriers erected by the Supreme Court still hasn’t been found.^[4]

Mr Prismall, supported by litigation funder LCM Funding UK Limited, brought the representative claim for damages in the tort of misuse of private information (“MOPI”) on behalf of a class of approx. 1.6 million people. The background of the claim is a cooperation between the Defendants and the Royal Free London NHS Foundation Trust (“Royal Free”), where the latter provided certain patient-identifiable medical records to the former for the purposes of the development of an app for clinicians. Mr Prismall alleged that the transfer of the data of the class and its use without specific patient consent was a wrongful interference with patient information.

As in Lloyd v Google, the “same interest” requirement under CPR 19.8 proved to be a challenging bottleneck for the representative claimant: the first stage of the test for liability for MOPI, which requires the claimant to objectively have a “reasonable expectation of privacy” in the relevant information had to be passed by every member of the class without resorting to individual circumstances. The representative claimant sought to address this issue by proceeding “on the basis of an irreducible minimum that is applicable to all class members”, i.e., the lowest common denominator of all class members.

But to no avail: Williams J first established an “irreducible minimum scenario” which was met by literally every member of the class. Based on this scenario, she then concluded “that each member of the Claimant Class does not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation.”

“Accordingly,” William J held, “the claim as currently advanced on a global irreducible minimum basis in order to try and meet the ‘same interest’ criterion for a representative action cannot succeed. It cannot be said that every member of the class across the board has a viable claim. Equally, departing from the lowest common denominator scenario and bringing into account individualised factors for the purposes of showing that a reasonable expectation of privacy exists in particular situations would mean that the ‘same interest’ test was not met. Either way the claim is bound to fail.”

In light of the inherent difficulties in bringing a representative action in MOPI, Williams J considered a further amendment of the claim not to be in the interests of justice and concluded that the claim should be struck out and summary judgment entered for the Defendants.

Time will tell whether this decision truly marks “the end” for data privacy representative actions, or whether future claimants will come up with creative ways to deal with the inherent difficulties laid bare first in Lloyd v Google and now in Prismall v Google. Alternative regimes, such as group litigation under CPR 19.21 or managed litigation, might be difficult to adapt to the needs of large-scale claims with low individual values, while collective proceedings in the Competition Appeal Tribunal are confined to the field of competition law. Meanwhile, recent decisions across the Channel by the European Court of Justice and Dutch Courts display the unabated appeal of data privacy claims

Johannes Nickl^[5]

[1] Formerly CPR 19.6, which has been renumbered as of 6 April 2023.

[2] Prismall v Google UK Ltd & Anor [2023] EWHC 1169 (KB).

[3] Lloyd v Google LLC [2021] UKSC 50.

[4] In this regard, it might be interesting to note that Mr Prismall had begun an earlier representative claim for damages for breach of data protection legislation against the defendants in 2021, which was discontinued after Lloyd v Google.

[5] Doctoral Candidate at Heidelberg University, Germany.

Foto Credit: Google