England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
MRS JUSTICE HEATHER WILLIAMS DBE
[2023] EWHC 1169 (KB)

		Royal Courts of Justice Strand, London, WC2A 2LL
		11/12/2024

This judgment was handed down remotely at 13.30 hrs on 11.12.2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

Dame Victoria Sharp, Lady Justice Nicola Davies and Lord Justice Dingemans:

Introduction and issues

1. This is the judgment of the court. The appellant Andrew Prismall is a representative claimant. Mr Prismall brought a representative action, pursuant to what is now Civil Procedure Rule (CPR) 19.8, for the tort of misuse of private information against the respondents Google UK Limited (Google) and DeepMind Technologies Limited (DeepMind). The action was on behalf of Mr Prismall and a class of persons said to number approximately 1.6 million.
2. The claim is for damages in respect of both the one-off transfer by the Royal Free London NHS Foundation Trust (the Royal Free Trust) of data in October 2015, and the continuing transfer of data thereafter until 29 September 2017 pursuant to a live data feed. The data which was transferred took the form of patient-identifiable medical records held by the Royal Free Trust of patients, including Mr Prismall, who had attended hospitals in the Royal Free Trust or had blood tests processed by laboratories operated by the Royal Free Trust between 29 September 2010 and 29 September 2015. Google and DeepMind used the data for the purposes of developing an app called "Streams" which was intended to be used to identify and treat patients suffering from Acute Kidney Injury. Google and DeepMind also had, however, a contractual entitlement to use the data for purposes wider than direct patient care and to develop and prove capabilities to enhance future commercial prospects.
3. The representative claim by Mr Prismall was struck out by Mrs Justice Heather Williams (the judge) and summary judgment was entered for Google and DeepMind, for the reasons contained in a judgment dated 19 May 2023. That judgment followed a two day hearing before the judge on 21 and 22 March 2023.
4. This appeal raises the principal issue whether the judge was wrong to find that each member of the class of approximately 1.6 million people did "not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their medical records or of crossing the de minimis threshold in relation to such an expectation" such that there was no realistic prospect of establishing misuse of private information of each member of the class, or a realistic prospect of establishing an entitlement to damages for loss of control.
5. There are two points that are fundamental to an understanding of the outcome of the case before the judge and of this appeal. First, that the need to show that each member of the class has a realistic prospect of establishing misuse of private information arises because CPR 19.8(1) requires the person bringing the claim, and those on whose behalf the claim is brought, to have "the same interest". And secondly, that it was and remains common ground between the parties that, adopting the approach taken by the Supreme Court in Lloyd v Google LLC [2021] UKSC 50; [2022] AC 1217 (Lloyd v Google) to representative actions, each member of the class of approximately 1.6 million persons whose patient records were transferred to Google and DeepMind has to have a realistic prospect of succeeding in their claim.
6. This agreed approach meant that both before the judge and this court, there has been a considerable investment of intellectual effort on both sides to ascertain the prospects of success for a claimant who was what the parties called "the lowest common denominator", see para 145 of Lloyd v Google. The lowest common denominator is a notional claimant in the class of approximately 1.6 million persons whose claim represents the "irreducible minimum scenario" for a claimant in the class of persons.
7. The judge identified the irreducible minimum scenario for the "lowest common denominator" claimant in para 166 of the judgment. The judge concluded that such a claimant's claim would fail, and she therefore struck out the claim and granted summary judgment to Google and DeepMind. The judge did not permit Mr Prismall to amend his claim in the light of the judgment. That refusal to allow Mr Prismall an opportunity to amend is also challenged in the appeal.
8. It is important to record that the form of representative action pursued on behalf of Mr Prismall, and the basis on which it was struck out, means that this judgment is not about whether there are any valid claims that could be brought by patients whose medical records were transferred by the Royal Free Trust to Google and DeepMind. Indeed the submissions before us proceeded on the basis that, subject to issues of limitation, it was common ground that such claims might be brought and might succeed.
9. It should also be recorded that when transferring the data to Google and DeepMind no use was made by the Royal Free Trust of the mechanism provided for by section 251 of the National Health Service Act 2006. That mechanism provides for non-consensual lawful sharing of confidential medical information in specific circumstances. In this case none of the class members were aware of the transfer of data at the time that it took place, and their consent was not sought to the transfer of data.

Relevant factual background

10. The relevant factual background was taken by the judge from the Particulars of Claim, and witness statements made on behalf of Mr Prismall, Google and DeepMind, which were sworn in relation to the application for summary judgment. This summary is taken from the judge's judgment.
11. Mr Prismall, and the other members of the class, attended the hospitals in the Royal Free Trust, being the Royal Free, Chase Farm and Barnet hospitals, or had X-rays in the hospitals or had their blood tests processed at laboratories operated by the Royal Free Trust. Mr Prismall had extensive treatment at the Royal Free Hospital. He did not consent to his private medical information being collected, transferred, stored or used.
12. The Royal Free Trust made an Information Sharing Agreement with Google on 29 September 2015. The data to be transferred took the form of Health Level Seven (HL7) feeds. HL7 is an international standard for exchanging patient-identifiable electronic healthcare records. An electronic HL7 message was generated by the Royal Free Trust each time "an event" took place during a patient's visit. The HL7 messages which were included were: ADT, indicating admission or discharge; ORM, indicating a test or X-ray had been ordered; ORR, being an acknowledgement of the order; ORU, giving the results of an observation or test. Some HL7's included free text notes written by a clinician or other hospital employee. There are examples of HL7's in the materials before us.
13. The patient-identifiable medical records were then transferred in October 2015. Thereafter a data feed continued until 29 September 2017, at which point all patient identifiable data was to be transferred back to the Royal Free Trust and destroyed.
14. DeepMind undertook the design and development of the Streams app in the period July to November 2015. During these phases, synthetic data (meaning data made up for the test) was used. The data which had been transferred was then "normalised", which meant put into a structure that could be viewed in the Streams app. During safety and effectiveness testing patient data was used. Google gave evidence through a witness statement that this involved the data of 200 to 300 patients. The judge accepted this figure in the judgment. Mr Pitt-Payne KC, on behalf of Mr Prismall, submitted that the data of 1.6 million patients was used, based on a reading of a letter dated 3 July 2017 from the Information Commissioner's Office (ICO). That letter had conveyed the ICO's conclusion that the processing by DeepMind of the personal data of approximately 1.6 million persons for the clinical safety testing of the Streams app did not fully comply with the Data Protection Act 1998 (DPA 1998). Mr White KC, on behalf of Google and DeepMind, submitted that the ICO's letter was written in general terms and there was nothing to set against the witness statement filed on behalf of Google. It is not necessary to resolve this issue in order to determine whether the representative claim brought by Mr Prismall has a realistic prospect of success. This is because the issue does not affect the judge's reasons for finding that the claim by the lowest common denominator claimant did not have a real prospect of success.
15. In October 2015, Google and DeepMind applied to the NHS Research Ethics Committee for approval for a project entitled "using machine learning to improve prediction of acute kidney injury and general patient deterioration". Approval was granted on 10 November 2015. This, according to the evidence from Google and DeepMind, related to a wider "Patient Rescue" project developed by DeepMind which was not pursued.
16. On 28 January 2016, DeepMind entered into a five year Memorandum of Understanding with the Royal Free Trust. This extended beyond the development and use of the Streams app and contemplated a "wide-ranging collaborative relationship for the purposes of advancing knowledge in the field of engineering and life and medical sciences through research and associated enterprise activities". This potential commercial benefit was emphasised by Mr Pitt-Payne on behalf of Mr Prismall.
17. On 1 July 2016, the Royal Free Trust wrote to the National Data Guardian (NDG). This was in terms which suggested broadening the research goals with DeepMind beyond the Streams app.
18. From 2016 to 2017, the ICO investigated the Royal Free Trust's compliance with the DPA 1998. On 3 July 2016, the ICO concluded that the processing by DeepMind of approximately 1.6 million patients' personal data for the purposes of the clinical safety testing of the Streams app did not fully comply with the DPA 1998, and that it was not processing for direct care. DeepMind published a press release after the ICO's determination accepting that they had got it wrong and setting out what they had learned. The ICO sought and obtained an undertaking from the Royal Free Trust in relation to its use of data. The Royal Free Trust commissioned a firm of solicitors to carry out an audit of Streams. This audit concluded (in May 2018) that the Royal Free Trust had not breached its duty of confidence to patients through the testing and operation of Streams because such use could be considered an aspect of direct care. However, the NDG (in correspondence with the ICO) did not accept that the use of confidential patient information in the testing of Streams could be considered to be an aspect of direct care.
19. On 30 August 2016, the Streams App was registered with the Medicines and Healthcare Products Regulatory Agency (MHRA).
20. From February 2017, the Streams app moved to live deployment at the Royal Free Trust. The Royal Free Trust ceased to use Streams for the detection of Acute Kidney Injury in about November 2019 and ceased to use the app completely by 31 January 2023.

The representative claim by Mr Prismall

21. Mr Prismall's claim does not concern the use of patient data on Streams in treating patients in the period from February 2017. The claim in the Particulars of Claim dated 23 July 2022, as was clarified at the hearing before the judge, relates to the wrongful use of private patient information by Google and DeepMind in: (1) obtaining patient-identifiable medical records with a contractual entitlement under the Information Sharing Agreement which was wider than direct patient care and the Streams project; (2) storing the medical records prior to Streams becoming operational; (3) using the medical records in the research and development of Streams; and (4) developing and providing their general capabilities by the use of the medical records for the purposes of future commercial prospects.
22. Damages were claimed for loss of control of the private information only. It was said that any claimant who wanted to claim for a higher level of damages would be free to leave the representative class and bring an individual claim.
23. The class identified by Mr Prismall was:

"...all individuals domiciled in England and Wales as at the date of issue of this Claim Form, or their UK-domiciled personal representatives or UK-domiciled administrators of their estates or the Public Trustee as appropriate, who:

1. Presented for treatment at any hospital, clinic or other medical service provider within the Royal Free London NHS Foundation Trust (and its predecessors) between 29 September 2010 and 29 September 2015 and in respect of whom at least one HL7 message was generated in which the PV1 datafield was populated; and/or

2. Were included in the Royal Free London NHS Foundation Trust's existing radiology electronic patient record system as at 29 September 2015; and/or

3. Were included in the data relating to blood tests or blood samples from GP clinics that was stored by the Royal Free London NHS Foundation Trust amongst its biochemistry data between 29 September 2010 and 29 September 2015;

and whose patient-identifiable medical records (whether partial or complete) were included in the approximately 1.6 million patient records that were collected and/or received and/or stored and/or held and/or used by the Defendants or either of them during the period from 29 September 2015 to the date of issue of this Claim Form...whether in the context of the development of the 'Streams' application regarding acute kidney injury or otherwise … 'Medical record' refers to a record including one or more of the following: (a) the fact that the patient had attended a healthcare provider and/or been seen by a particular clinician; (b) the nature of the patient's medical issue; (c) the diagnosis made by the clinician who saw the patient; (d) the nature of any tests that were carried out; and/or (e) the nature of any treatment provided by the clinician."

The class definition had been amended and expanded by agreement of the parties for the purposes of the reverse summary judgment application by adding in para 3 and including the words "patient-identifiable" before medical records in the final paragraph. The underlined parts in paragraph 1 and paragraph 3 are the amendments which Mr Pitt-Payne submits would have been made if the judge had permitted Mr Prismall to amend. Mr White pointed out that the proposed amendment did not deal with the main reason why the judge found that there was no real prospect of success for the lowest common denominator claimant, namely the publication by that claimant of the relevant information affecting the reasonable expectation of privacy in that information.

The judgment below

24. The judge set out the relevant events and relevant legal principles. Misuse of private information was addressed from para 66 of the judgment. The judge noted that the principles were not in dispute between the parties, before turning to deal with medical information, misuse of information and damages for loss of control. The judge did not accept the submission that loss of control damages inevitably involved an individual assessment, but said "the question remains whether the members of the Claimant class, as defined, have a viable, more than de minimis claim for loss of control damages". The judge addressed representative actions, the decision in Lloyd v Google and the "same interest" requirement.
25. The judge then addressed the claimant class and the reasonable expectation of privacy, considering information generated by the doctor – patient relationship, information already in the public domain, the purpose for which information was transferred and stored, and direct care and the uses made of the data; and she referred to the approach set out in the judgment of the Supreme Court in ZXC v Bloomberg LP [2022] UKSC 5; [2022] AC 1158 (ZXC). The judge addressed medical information as part of a private life and referred to the decision of the European Court of Human Rights (ECtHR) in Z v Finland (1998) 25 EHRR 371 (Z v Finland). The judge said that it was "also well-established that not every disclosure of medical information will give rise to a reasonable expectation of privacy and/or involve an unlawful interference." The judge referred to Campbell v MGN [2004] UKHL 22; [2004] 2 AC 457 (Campbell) and dicta in subsequent cases in A v B [2005] EWHC 1651 (QB); [2005] EMLR 36 (A v B) at para 33; NT1 and NT2 v Google LLC [2018] EWHC 799 (QB); [2019] QB 344 (NT1) at para 145; and ZC v Royal Free London NHS Foundation Trust [2019] EWHC 2040 (QB) (ZC v Royal Free) at para 170.
26. At para 133 the judge rejected what was called "the medical records submission" stating "I do not accept that all patient-related information that is derived from the doctor-patient context inevitably gives rise to a reasonable expectation of privacy (outside of direct care situations)". This was because there was a threshold of seriousness (which affords an appropriate means of ensuring that the protection provided by article 8 of the European Convention on Human Rights (ECHR) is placed in its proper context) and all the circumstances of the particular case should be taken into account on the reasonable expectation of privacy question. If anodyne or trivial information about a brief hospital visit was made public by a patient, the judge saw no reason why that information would attract a reasonable expectation of privacy by dint of it being recorded in a medical record.
27. The judge set out her conclusions from para 160 onwards, recording the concession made on behalf of Mr Prismall that the variables giving rise to stronger claims had to be left out of account and that the action was pursued on the basis of the lowest common denominator. The judge identified the irreducible minimum scenario in para 166 of the judgment, noting 11 factors, before concluding that "each member of the claimant class does not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation".
28. The judge concluded that there was no other compelling reason for the claim to proceed, and that Mr Prismall should not be given an opportunity to amend the pleading.

The grounds of appeal

29. The grounds of appeal on behalf of Mr Prismall were set out in grounds 1A to 1E and then grounds 2 and 3. They were as follows: "1A: The Court erred in rejecting the submission (which the judge labelled 'the medical records submission') that all patient-related information generated in the course of the relationship between patient and doctor/healthcare provider, regardless of the content of the information in question, gives rise to a reasonable expectation of privacy (save in relation to direct care). 1B: The Court erred in rejecting the submission that the placing of equivalent information in the public domain by a patient does not affect either a doctor/healthcare provider's obligations to keep private the information generated in the context of their relationship with patients, or the reasonable expectation of privacy attaching to that information. 1C: The Court erred by adopting an impermissibly wide definition of 'direct care' and/or in failing to address the full scope of the Representative Claimant's case as to the Defendants' use of the information that was transferred. 1D: Given that the Claimant Class was defined with reference to 'patient-identifiable medical records', the Court erred in holding that the Claimant Class included individuals in respect of whom the information transferred to the Defendants had no medical content. 1E: The Court erred in regarding 'upset or concern' as relevant to the identification of the irreducible minimum scenario in a claim for loss of control damages".
30. It was common ground that ground 2 was dependent on ground 1. Ground 2 provided that, as a result of the errors identified in grounds 1A to 1E "the Court likewise erred in concluding there was not a realistic prospect of establishing (a) an unlawful interference with the private information of each member of the Claimant Class (see judgment, paras 170 to 172), or (b) that each member of the Claimant Class was entitled to damages for loss of control (see judgment, paras 173 to 178)."
31. Ground 3 related to the judge's refusal to give Mr Prismall an opportunity to amend in the light of the judgment. It was: "The Court erred by failing to provide the Representative Claimant with an opportunity to amend his statements of case in advance of striking out the claim form and particulars of claim and entering summary judgment for the Defendants".
32. Mr Pitt-Payne submitted that the judge was wrong not to find a reasonable expectation of privacy in this action for every claimant. This was because the information which was misused was medical information about the claimants, which had been generated in the course of the doctor-patient relationship. Any such information generated in this way, would always give rise to a reasonable expectation of privacy. This contrasted with information about a person's health in general which might not give rise to such an expectation if the information was anodyne or already in the public domain. The judge was wrong to conclude that a patient placing that information in the public domain would affect the obligation of the doctor or healthcare provider to keep that information private.
33. Mr Pitt-Payne also criticised the judge's wide definition of direct care and submitted that the judge had failed to address Mr Prismall's case as to the use of the information that was transferred. He submitted that the judge had been wrong to hold that the claimant class included persons in respect of whom the information transferred had no medical content. The judge had also been wrong to regard "upset or concern" as relevant to the irreducible minimum scenario, in a case where loss of control damages were claimed. The judge should have afforded Mr Prismall an opportunity to amend the claim, and the underlined amendments set out in para 23 above would have been made.
34. Mr White, on behalf of Google and DeepMind, submitted that the tort of misuse of private information required the court to consider all of the circumstances of the case, which was why a representative action on behalf of a class of approximately 1.6 million persons should not be permitted. A relevant circumstance was the extent to which the information was private, and the judge had correctly identified that there would be claimants who gave publicity to their medical treatment. Mr White took the court to examples of Mr Prismall himself and another person who had been treated in hospitals of the Royal Free Trust, giving press interviews about their medical conditions, albeit this was done to inform the public about certain health risks and the ways in which they might be treated. The judge had been right on the approach to direct care, and the criteria set out in para 166 of the judgment.
35. Mr White submitted that the judge was right to refuse the amendment. The proposed amendment still did not deal with the judge's finding about the (hypothetical) patient's own publication of private information in the irreducible minimum scenario, meaning that for that individual a claim for misuse of private information could not succeed. Mr White pointed out that Mr Prismall had originally commenced a representative action for infringement of the DPA 1998 on behalf of the class of 1.6 million patients of the Royal Free Trust, which was discontinued after the decision of the Supreme Court in Lloyd v Google, so that any proposed amendment would be the third time (in effect) that Mr Prismall had attempted to formulate this claim.

Issues on appeal

36. There was no relevant dispute between the parties about the elements of the tort of misuse of private information. It was common ground that the tort of misuse of private information involves two stages. Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If this is shown, then stage two involves a balancing exercise to determine whether that expectation is outweighed by a countervailing interest of the defendant: see generally, Clerk & Lindsell on Torts, Twenty-Third Edition, at 26-40.
37. In order to avoid the possibility of confusion about the relevant tests to be applied, we have formulated the issues to be determined in this appeal as follows: (1) whether the lowest common denominator claimant has a real prospect of succeeding in a claim for misuse of private information, because all patient-related information generated in the course of a patient and healthcare provider relationship gives rise to a reasonable expectation of privacy (save for direct care: see para 67 below) and because a claim for misuse of private information will succeed even where a patient has placed that medical information in the public domain; (2) whether the judge adopted too wide a definition of direct care; (3) whether the judge was wrong to refer to a lowest common denominator claimant who had not given any medical information to the doctor; (4) whether the judge was wrong to consider upset or concern as being relevant to the identification of the lowest common denominator claimant; (5) whether the judge should have permitted Mr Prismall an opportunity to amend his statement of case.

The tort of misuse of private information

38. As already indicated there was no relevant dispute between the parties about the elements of the tort of misuse of private information. The development of the tort of misuse of private information was influenced by article 8 of the ECHR which was given domestic effect by the Human Rights Act 1998.
39. The two-stage test for the tort of misuse of private information appears from McKennitt v Ash [2006] EWCA Civ 1714; [2008] QB 73 at para 11 and ZXC at para 26. Whether a claimant has a reasonable expectation of privacy is an objective test. The expectation will be that of a reasonable person of ordinary sensibilities placed in the same position as the claimant and faced with the same publicity, see ZXC at para 49. The question is a broad one which takes into account all of the circumstances of the case.
40. A non-exhaustive list of relevant factors to determine whether stage one of the test was met was identified in Murray v Express Newspapers plc [2008] EWCA Civ 446; [2009] Ch 481 (Murray v Express) at para 36. These were: "(1) the attributes of the claimant; (2) the nature of the activity in which the claimant was engaged; (3) the place at which it was happening; (4) the nature and purpose of the intrusion; (5) the absence of consent and whether it was known or could be inferred; (6) the effect on the claimant; and (7) the circumstances in which and the purposes for which the information came into the hands of the publisher." These are sometimes referred to as Murray factors.
41. In ZXC the Supreme Court also recorded, at para 54, that "a relevant circumstance will be the extent to which the information is in the public domain. Information that was private may become so well known that it is no longer private. Whether that is so is a matter of fact and degree …."
42. There is a minimum threshold (i.e. a threshold of seriousness) which must be overcome before liability for the tort of misuse of private information accrues. Lord Neuberger MR said in Ambrosiadou v Coward [2011] EWCA Civ 409; [2011] EMLR 21 that: "Just because information relates to a person's family and private life, it will not automatically be protected by the courts: for instance the information may be of slight significance, generally expressed or anodyne in nature".
43. If the answer at the first stage is yes, and there is a relevant reasonable expectation of privacy, "the next question would be how the balance should be struck as between the individual's right to privacy on the one hand and the publisher's right to publish on the other. If the balance were struck in favour of the individual, publication would be an infringement of his or her article 8 rights, whereas if the balance were struck in favour of the publisher, there would be no such infringement by reason of a combination of articles 8(2) and 10 of the Convention ", see Murray v Express Newspapers at para 40. In many claims of misuse of private information the competing rights protected by articles 8 and 10 of the ECHR will be in play.
44. There are some categories of information where the starting point is that there will normally, but not invariably, be a reasonable expectation of privacy. So far as is relevant to the issues on this appeal these categories include the state of a person's physical or mental health or condition. Courts in England and Wales have considered it beyond dispute that personal information about individuals derived from medical records, reports or interviews, whatever the purpose for which they were prepared or conducted, is both confidential and private: see Law of Privacy and the Media, 2^nd edition; and generally ZXC at para 52, referring to the then current edition of Gatley on Libel and Slander. This reflects the approach of the ECtHR. In Z v Finland (1998) 25 EHRR 371 for example, at para 95 it was said that: "Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general." Nothing that we say in this judgment should be taken as casting any doubt on the importance of this principle.
45. There have been cases where the courts have contemplated that it may be lawful to publish certain "private" medical information, i.e. that this can be done without committing the tort of misuse of private information. As Mr Pitt-Payne pointed out however, many of those cases do not concern medical notes. In Campbell Baroness Hale said "... not every statement about a person's health will carry the badge of confidentiality or risk doing harm to that person's physical or moral integrity. The privacy interest in the fact that a public figure has a cold, or a broken leg is unlikely to be strong enough to justify restricting the press's freedom to report it. What harm could it possibly do?" It might be noted that the first sentence of that passage appears to be directed to stage one of the test for misuse of private information and the reasonable expectation of privacy, whereas the second sentence appears to be directed to stage two of the test, involving the balancing of relevant factors.
46. That passage has been referred to in subsequent authorities including in A v B at para 33 and NT1 at para 145. In ZC v Royal Free it was accepted at para 170 that "the mere fact of having hospital or other treatment (without anything more) may itself be private information … But everything depends on the circumstances" and it was doubted that the mere fact of a person's attendance at an Accident and Emergency Department would, without more, constitute private information.
47. Medical notes were considered in Underwood v Bounty UK Ltd [2022] EWHC 888 (QB); [2022] ECC 22. However, the passage cited (at paras 52 and 53 of that decision) where certain information obtained from notes at the end of a patient's bed was described as trivial, was obiter so it seems to us. We were not addressed in detail on the passage in any event, and we say no more about it.
48. There are relevant obligations on medical practitioners to maintain confidentiality. These regulatory obligations are relevant in our judgment to the objective assessment of the reasonable expectation of privacy. Both sides in this appeal addressed us on those obligations. Six general principles were identified in the Caldicott Committee's December 1997 "Report on the Review of Patient-Identifiable Information" (the Caldicott Committee). The six principles were summarised in that document as: (i) Justify the purpose; (ii) Don't use patient identifiable information unless it is absolutely necessary; (iii) Use the minimum necessary patient identifiable information; (iv) Access to patient identifiable information should be on a strict need to know basis; (v) Everyone should be aware of their responsibilities; (vi) Understand and comply with the law.
49. The NHS Code of Practice on Confidentiality in November 2003 provided that the Caldicott Committee's principles should be followed. The guidance from the General Medical Council (GMC) on Confidentiality in October 2009 referred to patients having "a right to expect that information about them will be held in confidence by their doctors". That right was subject to a patient's implied consent to sharing data within the healthcare team so that care could be provided. The guidance provided that as "a general rule, you should seek a patient's consent before disclosing identifiable information for purposes other than the provision of their care or local clinical audit...."
50. The March 2013 Information Governance Review (which was referred to as Caldicott 2) acknowledged that most people who used health and social care services accepted and expected that doctors, nurses and other professionals would need to share their personal confidential data in order to provide optimum care so that: "...There is in effect an unwritten agreement between the individual and the professionals who provide the care that allows this sharing to take place...the health and social care professional is able to rely on 'implied consent' when sharing personal confidential data in the interests of direct care, as long as the patient does not object, or has not already done so...".
51. The GMC issued further guidance in 2017 in "Confidentiality: good practice in handling patient information". Paragraph 9 identified confidentiality as an important ethical and legal duty but noted that it is not absolute. Paragraph 14 addressed the circumstances in which medical information may be disclosed on the basis of implied consent, including for the purposes of direct care.

Representative actions

52. Representative actions are now addressed in the Civil Procedure Rules (CPR) Part 19.8. That Part is headed "Representative parties with same interest" and provides (so far as is material):

"(1) Where more than one person has the same interest in a claim-

(a) the claim may be begun; or

(b) the court may order that the claim be continued,

by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.

...

(4) Unless the court otherwise directs any judgment or order given in a claim in which a party is acting as a representative under this rule-

(a) is binding on all persons represented in the claim;

but

(b) may only be enforced by or against a person who is not a party to the claim with the permission of the court."

53. Except in the Competition Appeal Tribunal for competition and consumer related claims, there is no purpose built procedural framework for class actions. Claimants can pursue: a standard multi-party claim (see Morris v Williams & Co Solicitors [2024] EWCA Civ 376; [2024] 3 WLR 693) or apply for a group litigation order or bring a representative action. Each form of action has different procedural requirements. In Lloyd v Google, the Supreme Court addressed the requirements for bringing a representative claim and Lord Leggatt considered the basis on which actions for collective redress could be pursued under the civil procedure of England and Wales.
54. In Lloyd v Google, compensation was sought under section 13 of the DPA 1998 for the defendant's breach of its statutory duties as a data controller in tracking the activity of an estimated four million users of Apple iPhones and selling the accumulated data. The claimant in that case contended that all members of the class (those resident in England and Wales who owned an Apple iPhone of a particular model at the relevant time and whose data was obtained without their consent) had suffered "damage" for the purposes of section 13 in their loss of control over their data protection rights.
55. It was common ground in that action that the representative actions procedure could not be used to claim compensation if it had to be individually assessed. The claimants argued however that general damages could be awarded on a uniform basis to each member of the represented class without the need to prove additional facts particular to any individual as loss of control damages could be awarded under section 13. The Court of Appeal had accepted that an individual suffered damage within the meaning of section 13 of the DPA 1998 upon losing control of their data so that the claim could proceed as a representative action for loss of control damages, but the Supreme Court allowed Google's appeal. This was on the basis that "damage" for a claim under section 13 of the DPA 1998 was limited to material damage, in the sense of financial loss, physical or psychological injury and distress. Accordingly, it was necessary to individually prove that such damage had been suffered by each of the members of the class. The claimant had sought to overcome this difficulty by confining the claim to a lowest common denominator level of damages, but Lord Leggatt held, at para 147, that "the fundamental problem is that, if no individual circumstances are taken into account, the facts alleged are insufficient to establish that any individual member of the represented class is entitled to damages". There was a threshold of seriousness to be crossed before a breach of the DPA 1998 gave rise to an entitlement to compensation under section 13.
56. Lord Leggatt identified the principles governing use of the representative procedure. He recorded, at para 67, that the development of digital technologies had added to the potential for mass harm for which legal redress may be sought and in such cases it was "necessary to reconcile, on the one hand, the inconvenience or complete impracticality of litigating multiple individual claims with, on the other hand, the inconvenience or complete impracticability of making every prospective claimant (or defendant) a party to a single claim." He observed that in such circumstances the only practical way to "come at justice" was to combine the claims in a single proceeding and allow one or more persons to represent all those who shared the same interest in the outcome. He considered that the absence of a detailed legislative framework was no reason to interpret the representation rule restrictively and that its simplicity was in some respects a strength.
57. There was only one condition that had to be satisfied under the then CPR 19.6 before a representative claim may be begun or allowed to continue, namely that the representative has the "same interest" in the claim as the persons represented. Lord Leggatt held, at para 71, that the phrase, "needs to be interpreted purposively in light of the overriding objective of the Civil Procedure Rules and the rationale for the representative procedure." The purpose of the "same interest" requirement was "to ensure that the representative can be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all the members of the represented class. That plainly is not possible where there is a conflict of interest between class members, in that an argument which would advance the cause of some would prejudice the position of others."
58. Having referred with approval to Professor Zuckerman's book on civil procedure, reference was made to The Irish Rowan [1991] 2 QB 206. In that case it was noted that some of the insurers might wish to resist the claim on a ground that was not available to others, but the fact was not regarded as showing that all the insurers did not have "the same interests" in the action. There was also discussion about overcoming procedural objections by bringing two or more representative claims, each with a separate representative claimant or defendant, and combining them in the same action.
59. However, the representative action in Lloyd v Google was not permitted to proceed. The court considered the lowest common denominator claimant. In that case, such a claimant had to have an iPhone of the appropriate model running a relevant version of the Apple Safari internet browser, which on a date during the relevant period, whilst present in England and Wales, they had used to access a website that was participating in Google's DoubleClick advertising services. This meant that the class would include those who had clicked on a relevant website on a single occasion and had received no targeted advertisements as a result. The Supreme Court held that those facts were insufficient to surmount the seriousness threshold which admittedly applied to the DPA 1998 claim, as it was impossible to characterise such damage as more than trivial. At para 153 it was said that "Without proof of some unlawful processing of an individual's personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages".
60. Both before the judge, and in this appeal, Mr Pitt-Payne accepted that if some members of the represented class were not able to establish the ingredients of a claim, then the "same interest" requirement was not met. This meant that it was common ground that recovery of individualised damages for any member of the 1.6 million class could not be pursued by means of a representative action. All that could be recovered is what was referred to as "the lowest common denominator damages" for each member of the class. If any member wanted additional compensation they would have to opt out of the class and bring their own claim.
61. Against that background, we turn to the issues identified at para 37 above.

Issue one: Whether the claimants had a realistic prospect of establishing the tort of misuse of private information because all patient-related information generated in the course of a patient and healthcare provider relationship gives rise to a reasonable expectation of privacy (save for direct care) and because a claim for misuse of private information will succeed even where a patient has placed that medical information in the public domain

62. In our judgment, in agreement with the judge, the answer to this question (or these questions) is in the negative. The starting point is that there will normally be a reasonable expectation of privacy for any patient identifiable information in medical notes: see para 44 above. The importance ascribed to such privacy rights in the tort of misuse of private information, aligns therefore with the approach taken in the regulatory context where doctors are under a duty to keep confidential, private information in medical records. These duties, which are of course relevant to any assessment of the reasonable expectation of privacy, exist for the reasons identified in Z v Finland which are worth repeating: "to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general."
63. The starting point identified above, however, will not always be the end point. This is because we are concerned with the tort of misuse of private information and not, for example, with whether there has been a breach of regulatory duties on the part of a medical practitioner. The tort involves a threshold of seriousness, and everything will depend on the particular circumstances of the individual case (see paras 39 to 42 above). Consequently, we reject Mr Pitt-Payne's "medical records submission" that the threshold will always be satisfied in respect of every HL7 message generated in respect of a patient. And, as the judge pointed out, patients can choose to make private information public. If they do so, and then bring proceedings where the reasonable expectation of privacy in respect of that information is in issue, the fact that the information is public, and the manner in which it has entered the public domain will inevitably form part of the relevant circumstances to be considered in determining whether the stage one threshold for the tort has been surmounted. As the authorities make clear, when determining that objective question, a threshold of seriousness applies, and everything will depend on the facts and circumstances of the individual case.
64. In the context of the public domain argument, Mr White referred to an article published by the Evening Standard containing an interview with a patient of the Royal Free Trust who was a new mother, about her treatment with the assistance of the Streams app. Mr White also referred to a news article published in the Portsmouth News newspaper in which Mr Prismall gave information about a liver transplant from which he had benefitted and set out his support for a campaign to get football fans to sign the organ donor register. We are bound to say that in circumstances of this case (including that Google had taken and used large quantities of patient medical data for its own commercial purposes without the patients' knowledge or consent) Google's reliance on the altruistic behaviour of those two patients in support of its strike out application is not an attractive one, and illustrates the difficulties to which Lord Leggatt referred in Lloyd v Google (see para 56 above) of coming at justice in a digital case involving numerous potential claimants.
65. Nevertheless, it follows from the points made at para 63 above, that a claim for misuse of private information will not invariably succeed where a patient has placed medical information (subsequently recorded in the course of a patient and healthcare provider relationship) in the public domain; and thus, the same interest requirement is not met. It is worth emphasising, however, that the publication of such private information by such a claimant does not mean that other patient identifiable information or the details of their medical conditions would not benefit from the reasonable expectation of privacy. We agree therefore with Mr Pitt-Payne that the fact that the patient has published, or agreed to the publication of, some material relating to their treatment does not mean that the reasonable expectation of privacy in all of the patient identifiable information in the medical notes will necessarily be lost.
66. As Lord Leggatt suggested at para 106 in Lloyd v Google when considering why no claim for misuse of private information had been pursued in that representative class, a view may have been taken that to establish a reasonable expectation of privacy, it would be necessary to adduce evidence of facts particular to each individual claimant. We consider that a representative class claim for misuse of private information is always going to be very difficult to bring. This is because relevant circumstances will affect whether there is a reasonable expectation of privacy for any particular claimant, which will itself affect whether all of the represented class have "the same interest".

Issue two: Direct care

67. Before considering this issue, and for the sake of clarity, we should say that it was common ground that "direct care" of a patient, fell outside the scope of this claim for misuse of private information. This was because it was, again, common ground that there is implied consent on the part of patients for their medical information/records to be used for their medical treatment. The issue of direct care and implied consent is dealt with in the regulatory context in paras 48 to 51 above.
68. There were four heads of misuse of private information relied on in the claim, namely obtaining the medical records with a contractual right to use them for purposes beyond the Streams app, storing the medical records, research and development of the Streams app (which was a novel clinical tool) and developing and proving the general capabilities of Google and DeepMind by using the medical records. The fact that Google and DeepMind intended to obtain a commercial benefit by developing capabilities by use of medical records was, as already noted, particularly emphasised on behalf of Mr Prismall.
69. The judge rejected the submission on behalf of Google and DeepMind that all of the use by Google and DeepMind was covered by direct care, and therefore, by the definition of the class, excluded from the claim. The judge found in para 144 of the judgment that "some, but by no means all" of the alleged wrongful use of the patient identifiable records comes within direct care.
70. In these circumstances it is not necessary to identify the exact limits of what is covered by "direct care" in order to determine this appeal. This is because some use of the information might be covered by direct care, and those who were covered by such use of the data for direct care, were not part of the represented class. We therefore do not deal with this issue because it is not necessary to do so to determine the appeal.

Issue three: Whether the judge was wrong to refer to a lowest common denominator claimant who had not given any medical information to the doctor

71. The judge's lowest common denominator claimant was premised on the basis that there was one attendance at a Royal Free Trust hospital, generating a HL7 message including the date and the establishment, which was an attendance not concerning "a medical condition involving any particular sensitivity or stigma": see paras 166(i) and (ii) of the judgment. In para 166(iii) the judge referred to "very generalised or no specific reference to the medical condition that had prompted the attendance".
72. Mr Pitt-Payne submits that the judge was wrong to refer to "no specific reference to the medical condition" for the lowest common denominator claimant because the class definition, as amended before the hearing before the judge, was to "patient-identifiable medical records." Mr Pitt-Payne referred to section 205(1) of the Data Protection Act 2018 which defined "data concerning health" as data which reveals "information about health status", and he identified five characteristics of a medical note. He accepted that this argument had not been advanced before the judge but said that this court should permit the argument to be advanced, as it arose out of the definition of the claimant class.
73. We do not consider that the definition of "data concerning health" in the 2018 Act assists. This is because the definition does not refer to medical notes.
74. We note that the wording of the claim form expressly refers to the claim being brought on behalf of all individuals … "whose medical records (whether partial or complete) were included in the approximately 1.6 million patient records …". The wording of the class, as amended prior to the hearing before the judge, still refers to "patient-identifiable medical records (whether partial or complete) …". In our judgment the judge's reference to "no specific reference to the medical condition …" was consistent with the definition of the class being "patient-identifiable" and "a medical record (whether partial or complete)." A partial medical record might contain no specific reference to the medical condition. For these reasons we do not consider this ground of appeal to be well-founded.
75. In any event a medical note complying with the five characteristics identified by Mr Pitt-Payne at para 58 of his Skeleton Argument might relate to a person who has shared all the relevant information on social media (going to Chase Farm hospital; with a suspected broken leg; where the doctor examined me; but the leg is only bruised so I was given a painkiller) so that there is a not, for the reasons given in relation to issue one above, a reasonable expectation of privacy.

Issue four: Whether the judge was wrong to consider upset or concern as being relevant for the identification of the lowest common denominator

76. At para 166(xi) the judge had identified for the irreducible minimum scenario for the lowest common denominator claimant that "no upset or concern was caused by the data transfer and storage; the only adverse effect was the sheer fact of the loss of control over this data in the way described".
77. The judge had found in para 87 of the judgment that loss of control damages did not inevitably involve an individualised assessment, recording that the question remained whether members of the claimant class had a viable, more than de minimis claim for loss of control damages.
78. The judge's irreducible minimum scenario was consistent with that proposed approach, in that the notional claimant had suffered no upset or concern, but the adverse effect was the loss of control. It is not apparent from a reading of the judgment that the judge regarded upset or concern as relevant, as contended for on behalf of Mr Prismall at para 60 of the appellant's skeleton argument, and if the judge had concluded that it was relevant she would have found that the representative class failed on that basis alone, because it would require individualised assessment of damages.
79. We note that in Lloyd v Google Lord Leggatt had referred to a bifurcated process, whereby liability and quantum was split, and noted that in cases where damages required individual assessment, there could be advantages in adopting such a process. It would allow common issues of fact and law to be determined through a representative claim, leaving issues that require individual determination, whether relating to liability or damages to be dealt with at a subsequent stage. In this case a bifurcated process had not been proposed for this claim, as recorded by the judge at para 116 of the judgment.

Issue five: The judge was entitled to refuse to permit Mr Prismall an opportunity to amend his statement of case

80. The last issue addresses the issue of amendment in the light of the judge's judgment. The judge refused to permit Mr Prismall to amend the claim in the light of the judgment. At the time that the issue was being considered by the judge below, the judgment had not been delivered and no amendments had been formulated. This is because the argument took place during the course of the hearing before the judge. The judge dealt with the matter as a point of principle. The judge recorded that it was a case management decision, taken in accordance with the overriding objective; and she had regard to the fact that for a claim for misuse of private information with an irreducible minimum scenario, it would be very difficult to say that any given member of the class would have a viable claim. Amending the class to exclude those who had published private information would be very difficult.
81. Mr Pitt-Payne has now formulated some amendments. The proposed amendments are set out in the underlined passages in para 23 above. These make it clear that to be part of the class in para 1 there must have been one HL7 message in which the PV1 datafield was populated. The PV1 datafield is the patient visit segment of the medical notes and is populated in the event that the patient has been treated. The definition of a medical record has been amended to include attending a healthcare provider; the nature of the medical issue; the diagnosis made by the clinician; the tests carried out and/or the treatment provided.
82. The difficulty with this amendment, as was pointed out on behalf of Google and DeepMind, is that it did not deal with the main reason why the judge found that there was no real prospect of success for the lowest common denominator claimant, namely the publication by that patient of the relevant information on social media. This means that the PV1 datafield could be populated in the HL7 message and the medical record could include attending a healthcare provider, the nature of the medical issue, the diagnosis made by the clinician and the tests carried out and treatment provided, but still there would be no reasonable expectation of privacy. For example the lowest common denominator claimant who published information saying that "I went to Chase Farm hospital (the patient had attended a healthcare provider); with a suspected broken leg (the nature of the medical issue); where the doctor examined the leg but it is only bruised (the diagnosis and test); so I was given a painkiller (the treatment carried out)" would not have a reasonable expectation of privacy in that information contained in a medical record, for all the reasons given in relation to issue one above. It was this type of exercise which prompted the comment about the exercise of intellectual effort on both sides to ascertain the prospects of success for such a claimant made in para 6 above.
83. We do not consider that the judge was wrong to refuse to permit Mr Prismall an opportunity to amend the class in the Particulars of Claim. This was a case management decision made by the judge for good reasons. Mr Prismall had started a representative action in respect of the transfer of the medical records by the Royal Free Trust to Google and DeepMind relying on a cause of action under the DPA 1998, which had been discontinued after the judgment in Lloyd v Google. The claim had been started with a class identified in the claim form and Particulars of Claim. The class had been amended by agreement before the commencement of the hearing of the reverse summary judgment and strike out applications. Those amendments had not been able to show that the lowest common denominator had a real prospect of succeeding in a claim for misuse of private information for all the reasons give above. The difficulties of bringing a representative action for misuse of private information as contemplated by Lord Leggatt in para 106 of Lloyd v Google, have not been surmounted in this claim.
84. It appeared to be common ground that the judge's reasons did not apply to those claimants who were in paras 2 and 3 of the class definition, being those who had attended radiology departments, and those who had had blood tests. This had been pointed out in para 4 of the appellant's skeleton argument on appeal. The judge had recorded the submission, made by Mr Pitt-Payne, that there may be a narrower group of persons who might be able to go to court, which would be better than striking out the whole claim. It was in these circumstances that Mr Pitt-Payne was asked during the hearing whether, if his appeal failed in respect of para 1 of the class, he would want the action to continue with Mr Prismall and those covered by paras 2 and 3 of the class definition. Mr Pitt-Payne did not seek such an order. Mr White suggested that the appellants were taking this approach because such a small class would not make the representative claim economic to pursue.
85. Whether that is so or not, we are not able to say. The position is, however that Mr Prismall did not make an application for an amendment to permit the classes in paras 2 and 3 alone to continue the representative claim. We therefore do not make any orders in respect of the classes in paras 2 and 3 alone.

Conclusion

86. For the detailed reasons set out above we dismiss the appeal against the order granting reverse summary judgment and striking out the claim.