News focus: Big Tech's rare victory on data protection

The legally embattled Big Tech sector was celebrating a rare court win this week. In a forthright judgment following a two-day hearing in March, Mrs Justice Heather Williams DBE agreed to strike out a representative claim for damages against Google UK and its subsidiary DeepMind Technologies Limited for alleged misuses of private information. However, specialist lawyers were quick to point out that the ruling applies only to one, highly speculative, claim.

Andrew Prismall v Google UK was brought on behalf of 1.6 million people whose medical records were drawn upon to help DeepMind and the Royal Free hospital in London to develop an app called Streams to alert clinicians to patients suffering kidney damage. Streams was tested with historical data transferred to DeepMind in 2015; the hospital said that the use of real patient information was essential to prove the safety of the system.

However in 2017 the Information Commissioner’s Office reported that the processing of data by the Royal Free did not comply with the 1998 Data Protection Act. The hospital’s responses included commissioning an independent audit of Streams by magic circle firm Linklaters.  

The case brought by representative claimant Andrew Prismall was groundbreaking in that it sought damages for the alleged ‘loss of control’ over information. It was based on the tort of misuse of private information in order to circumvent the block set up by the Supreme Court’s 2021 ruling in Lloyd v Google, which found that a breach of the Data Protection Act was not actionable per se: claimants needed to establish individual damage or distress.

The claim was funded by LCM Funding UK Limited, which was added as an interested party for the purposes of costs. The defendants applied to strike out Prismall’s claim as having no real prospect of success.   

Ruling in their favour, the judge found that the claim failed the ‘same interest’ requirement set out in the Civil Procedure Rules. ‘There is a fundamental and inherent difficulty in identifying a viable claim for any class members if this claim is brought as a representative action on the basis of common circumstances,’ the judge concluded.

In her judgment, Williams concluded that each member of the claimant class ‘does not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records’. This was because very limited information was processed; ‘although health-related, it was anodyne in nature’. The alleged acts of interference, apart from those directly related to care, ‘were limited to the transfer of the data and to its secure storage for up to 12 months; and that this caused no impact other than the loss of control itself’.

Overall, the information used by DeepMind was not information over which the representative claimant, or wider class, had a realistic expectation of privacy.

Accordingly, the judge ruled the claim as advanced could not succeed, even on the basis of ‘lowest common denominator’ damages. She dismissed the submission that the claim should be permitted to proceed given areas of evidential uncertainty. ‘I do not accept that this provides a “compelling reason” in the circumstances,’ she said.  

Specialist lawyers said the ruling was expected. ‘It is not a surprise that an attempt to pursue a representative action, under what is now the CPR r.19.8(1) procedure, would likely fail where the circumstances of the class members are so varied,’ said Kingsley Hayes, head of data and privacy litigation at claims specialist Keller Postman UK. ‘The requirements of the tort of misuse of private information are well established and the facts and features of those requirements clearly did not exist in this case.’

Following on from the Supreme Court’s ruling in Lloyd – which concerned Google’s use of browser information from 4 million iPhone users – the bar to data protection claims against tech giants now appears formidable. However, Google will not be able to cut its legal spending in the near future.

Among a formidable list of cases in the offing is a representative action over commissions charged by the Google Play Store. Unlike data protection cases, collective proceedings in competition claims are specifically provided for by legislation.