The Court of Appeal of England and Wales is reviewing an appeal by Andrew Prismall, a representative claimant seeking to revive a class action case against Google and its subsidiary, DeepMind, over the alleged misuse of sensitive medical data. The claim, which pertains to an estimated 1.6 million individuals whose patient-identifiable records were allegedly transferred, stored, and misused, was initially struck out in May 2023 by Mrs. Justice Heather Williams DBE. The judge ruled that the CPR 19.8 representative action had no reasonable prospect of succeeding due to its lack of focus and the complexities of individual claims in the case.
The outcome of this appeal could restore the class action, which seeks compensation for patients whose private health information was mishandled by Google. The case follows the ruling in the 2021 Supreme Court case Lloyd v Google, which dealt with data privacy rights under the Data Protection Act 1998. Despite attempts to differentiate it by focusing on the tort of misuse of private information (MOPI) instead of the statutory framework, the Prismall case faces similar hurdles, particularly in balancing the requirement for a unified “same interest” across the claimant class with the need for an individualized assessment of damage.
One of the key issues in this case is the varied circumstances surrounding the 1.6 million affected claimants, whose medical data may have been misused differently. During earlier proceedings in March 2023, it was highlighted that there were significant discrepancies in the amount and type of medical data shared with Google, as well as differences in how much of that data was already publicly available or used by Google. Prismall conceded that individualized damages for each claimant might not be feasible and suggested a “lowest common denominator” approach to compensation. This method would apply a minimum damage value to all claimants regardless of the specific harm they suffered, but Mrs. Justice Williams dismissed this approach, arguing it would likely result in minimal or no liability for Google, which led her to strike out the claim.
At the Court of Appeal hearing on 22 October 2024, Mr. Prismall sought to downplay the differences between claimants, arguing that the central issue was whether all members of the class had a reasonable expectation of privacy concerning their medical records. Google countered that some data may already be public—through social media or other means—and that in such cases, no harm or loss could have been sustained, thereby undermining the class’s claim for damages based on a uniform compensation structure.
In his appeal, Mr. Prismall also criticized the decision to strike out the claim without allowing an amendment, calling it an excessive measure given the significant number of claimants potentially affected by Google’s actions. To address concerns about less significant claims within the class, Mr. Prismall proposed narrowing the scope to exclude individuals who only had minimal interactions with healthcare providers, such as a visit to Accident & Emergency. Although this amendment would likely reduce the size of the class, Google argued it did not adequately resolve the issue of data already in the public domain.
If the Court of Appeal rules in favour of Mr. Prismall and reinstates the class action, the case could become a landmark opportunity to test the viability of data privacy claims through representative actions in the UK, particularly following the Supreme Court’s decision in Lloyd v Google. Given the sensitive nature of the data involved, specifically medical records, the Court may be more inclined to allow the case to proceed in the public interest. However, as both the Lloyd and Prismall cases share similar challenges regarding the scope of the claimant class and the individualized nature of the alleged damages, the Court may hesitate to allow the claim to proceed if it mirrors issues already addressed by the Supreme Court.
