High Court rejects CPR 19.8 class action, demonstrating challenges of mass data claims

On 19 May the English High Court rejected an ‘opt-out’ class action brought on behalf of approximately 1.6 million people in Andrew Prismall v (1) Google UK Limited and (2) DeepMind Technologies Limited [2023] EWHC 1169 (KB).

Background

Mr Prismall brought this ‘opt-out’ claim pursuant to the ‘representative action’ mechanism set out in CPR 19.8(1) (termed CPR 19.6 prior to 6 April 2023).  The claim was brought in the tort of misuse of private information (‘MOPI’) and sought damages on a class-wide basis.  The Representative Claimant alleged that the Defendants had obtained, stored and used identifiable medical records of the class for the purposes of developing a medical app without class members’ actual or implied consent.  The Defendants applied – successfully – to strike out the representative claim.

CPR 19.8 representative claims 

CPR 19.8(1) is a potentially powerful class action mechanism whereby a representative can bring (or defend) a claim on behalf of a class of persons who have not actively elected to join the litigation.  The essential elements of rule 19.8(1) are as follows:

“Where more than one person has the same interest in a claim –

(a) the claim may be begun; or

(b) the court may order that the claim be continued,

by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.”

Where the same interest test is met, the court will then exercise its discretion on whether to permit the representative action to proceed. 

The shadow of Lloyd v Google

The same interest test has historically been interpreted strictly, but in Lloyd v Google LLC [2021] UKSC 50 the Supreme Court relaxed it, such that it would usually be met provided that there is no conflict of interests between class members.  Furthermore, the fact that a defendant may have defences to claims from some class members does not preclude the same interest test being met.

Lloyd v Google also confirmed that what is now CPR 19.8(1) can facilitate class actions seeking damages on a class-wide basis, but what limits the scope of using the mechanism for this purpose is that calculating those damages would typically necessitate “an individualised assessment which raises no common issues and [which] cannot fairly or effectively be carried out without the participation in the proceedings of the individuals concerned”.  See here for our earlier article on the Supreme Court’s judgment in Lloyd v Google.

The claim in Prismall v Google

The present claim was brought in the tort of MOPI, as opposed to Lloyd v Google, which alleged breach of section 13 of the Data Protection Act 1998 (‘DPA’).  As noted at paragraph 66 of the judgment, liability for MOPI has a two-stage test.  “Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If this is shown [and such expectation has been breached], then stage two is whether that expectation is outweighed by a countervailing interest of the defendant.”

The Defendants argued that the circumstances of the class members were so varied, that the Representative Claimant has no real prospect of showing that all class members had a claim in MOPI and that, accordingly, the same interest test was not met.  The Representative Claimant’s counsel accepted that if some members of the represented class “are not able to establish the ingredients of a viable claim, including that they have a realistic prospect of establishing a reasonable expectation of privacy, then the ‘same interest’ requirement is not met” (paragraph 101).  In other words, if it was not possible for the Representative Claimant to show that all members of the class had a viable claim, then the same interest test was not met and the claim would fail. 

Recognising that class members had different circumstances and that they were not individually adducing evidence, the Representative Claimant pursued the claim on the basis of an ‘irreducible minimum’ of circumstances applicable to each member of the class.  He contended that the representative claim should proceed if it could be shown that the lowest common denominator among the class members met the requirements of a MOPI claim.

Applying the ‘irreducible minimum’ approach to MOPI

The Representative Claimant argued that all information in the class members’ medical records conferred a reasonable expectation of privacy.  The court rejected this argument, noting that there were a range of individual circumstances across the class which were relevant to whether there was a reasonable expectation of privacy, including whether a class member had made material public.

The court identified the ‘irreducible minimum’ that applied to each of the variables within the class composition in order to avoid an individualised assessment.  Paragraph 166 listed the ‘irreducible minimum’ criteria, which included the following elements for some class members:

• only names and addresses were recorded and transferred to the Defendants, with no or very limited and generalised actual medical information involved;
• there was no sensitivity or stigma attached to the relevant medical condition; and
• the information about the hospital visit was already in the public domain.

The court concluded that the ‘irreducible minimum’ did not give a realistic prospect of establishing a reasonable expectation of privacy or of “crossing the de minimis threshold in relation to such expectation” (paragraph 168).  Accordingly, the claim was found unsuitable for CPR 19.8 and was struck out.

Court’s reasoning on quantum

Because the claim failed on the same interest test and reasonable expectation of privacy, the court did not need to decide on quantum.  Nevertheless, the court observed that based on substantially the same lowest common denominator assessment as in the hypothetical scenario set out above, the irreducible minimal harm suffered by each of the class members was trivial, and any attempt to demonstrate that it was more than trivial would have required individualised assessment, which was not possible in a representative action. 

Conclusion

A significant difference between Prismall v Google and Lloyd v Google is that in the latter, the ‘lowest common denominator’ / ‘irreducible minimum’ approach only arose on the issue of awarding class-wide damages.  In that case, the Supreme Court held – even if it was possible to claim under section 13 DPA for loss of control damages, the lowest common denominator for the class fell short of the de minimis threshold.

In Prismall v Google the ‘irreducible minimum’ approach was applied to the factual variations of the class to assess whether there was a class-wide reasonable expectation of privacy.  As noted above, this followed from the Representative Claimant’s concession that the same interest test would not be met unless it could be shown that all class members had a viable claim.  In Lloyd v Google the Supreme Court interpreted the same interest test as being an assessment of whether there were conflicts between class members (paragraphs 72 – 74).  As identified at paragraph 99 of Prismall v Google, the Supreme Court held that “a defence that applies to only some members of the class will not preclude the “same interest” test from being met, provided there is no conflict of interest.”  In Commission Recovery Limited and Marks & Clerk LLP and Long Acre Renewals [2023] EWHC 398 (Comm), the High Court recently permitted a representative action to proceed notwithstanding that the defendant may have had defences to certain sub-categories of the class members.  See our comment on that judgment here.

Showing that class members have a viable claim is essentially a question of applying the class definition to the elements of the cause of action, where circumstances applicable to each class member are reduced to the irreducible minimum to avoid the need for individualised evidence.  This will typically be difficult for MOPI claims, but we expect to see further creative claims which will continue to test the boundaries of the CPR 19.8 representative action regime.