Andrew Prismall v Google UK Limited & Anor

Acting as the Representative Claimant, Andrew Prismall relies upon what is now CPR 19.8(1) to bring a representative claim for damages in the tort of misuse of private information (“MOPI”) on behalf of a class said to number approximately 1.6 million people. The Defendants are Google UK Limited and DeepMind Technologies Limited. DeepMind is part of the Google group of companies and no distinction is drawn between the Defendants’ respective roles at this stage of the litigation.

The claim arises from the transfer of certain patient-identifiable medical records held by the Royal Free London NHS Foundation Trust and its predecessors (collectively, the “Royal Free”) to the Second Defendant. A one-off transfer of historical data took place in October 2015 and a live data feed was established at around the same time in respect of subsequent medical records. DeepMind was involved in the development and operation of an app known as Streams; a clinical system designed to assist clinicians at the Royal Free to identify and treat patients potentially suffering from acute kidney injury (“AKI”). The app was registered with The Medicines and Healthcare Products Regulatory Agency (“MHRA”) in August 2016 and became operational in February 2017.

As confirmed during the hearing, the claim does not concern the use of patient data on Streams in treating patients in the period from February 2017. Mr Pitt-Payne KC clarified that the claim related to the Defendants’ wrongful interference with patient information in the following respects:

The claim is set out in particulars of claim dated 23 July 2022. No defence has been filed at this stage. The claim is for loss of control damages only.

By application notice dated 24 October 2022, the Defendants applied to strike out the claim under CPR 3.4(2)(a) on the basis that the claim form and particulars of claim disclose no reasonable grounds for bringing the claim; and/or for summary judgment pursuant to CPR 24.2 on the basis that the representative claim has no real prospect of succeeding and there is no other compelling reason why the case should be disposed of at a trial. The application is resisted by the Representative Claimant.

CPR 19.8(1) provides that where more than one person has “the same interest” in a claim it may be begun by one or more of the persons “who have the same interest as representatives of any other persons who have that interest”. The class represented by Mr Prismall (“the Claimant Class”) is currently identified as follows:

“...all individuals domiciled in England and Wales as at the date of issue of this Claim Form, or their UK-domiciled personal representatives or UK-domiciled administrators of their estates or the Public Trustee as appropriate, who:

1.

Presented for treatment at any hospital, clinic or other medical service provider within the Royal Free London NHS Foundation Trust (and its predecessors) between 29 September 2010 and 29 September 2015; and/or

2.

Were included in the Royal Free London NHS Foundation Trust’s existing radiology electronic patient record system as at 29 September 2015; and/or

3.

Were included in the data relating to blood tests on blood samples from GP clinics that was stored by the Royal Free London NHS Foundation Trust amongst its biochemistry data between 29 September 2010 and 29 September 2015; and

whose patient-identifiable medical records (whether partial or complete) were included in the approximately 1.6 million patient records that were collected and/or received and/or stored and/or held and/or used by the Defendants or either of them during the period from 29 September 2015 to the date of issue of this Claim Form...whether in the context of the development of the ‘Streams’ application regarding acute kidney injury or otherwise...”

The issues between the parties narrowed during the course of their oral submissions. In pre-hearing written submissions the Defendants emphasised the wide variety of circumstances of those in the Claimant Class, contending that the compensatory principle required an individualised assessment of their entitlement to damages, which took into account their differing individual circumstances and that this was fundamentally inconsistent with pursuit of the claims via a representative action. However, during the hearing, Mr Pitt-Payne KC accepted that recovery of individualised damages for any member of the Claimant Class could not be pursued via the CPR 19.8(1) representative action and that the current claim was confined to seeking what have been referred to as “lowest common denominator damages” for each member of the class, that is to say compensation calculated by reference to the irreducible minimum harm suffered by all members of the class. He indicated that any class member who wished to seek additional compensation would have to opt out of the class and bring their own claim.

In summary (and taking account of the Representative Claimant’s revised position), the grounds of the Defendants’ application, as advanced by Mr White, KC were as follows:

In response, Mr Pitt-Payne KC’s position on behalf of the Representative Claimant by the time of his oral submissions was as follows:

Mr White KC opposed the latter course, pointing out that the Representative Claimant had not produced a proposed amendment and it was not for the Court to speculate as to its possible content. He also said that the circumstances involved too many variables for the difficulties he identified to be overcome by the removal of a specific category of individuals from the Claimant Class.

The Defendants’ application was supported by witness statements from David Barker, a partner in Pinsent Masons LLP, dated 21 October 2022 (“Barker 1”); and from Dr Cían Hughes, a medical doctor who is currently Informatics Lead at Google Ireland Limited and who was previously employed by the First Defendant and played a central role in the development of Streams, dated 21 October 2022 (“Hughes 1”) and 13 February 2023 (“Hughes 2”). The Representative Claimant relies upon the witness statement of Benjamin Lasserson, a partner in Mishcon de Reya LLP, dated 10 January 2023 (“Lasserson 1”).

LCM Funding UK Limited is acting as litigation funder for the Representative Claimant in relation to these proceedings and by order dated 29 November 2022 has been added as an Interested Party for the purposes of costs only.

At this stage I am not directly concerned with the mechanics of how the representative claim would be pursued if the Defendants’ applications are unsuccessful. Mr Pitt-Payne KC proposed a case management hearing after the close of pleadings which would consider, amongst other matters, directions for advertising the claim and other steps to bring it to the attention of those within the Claimant Class (who are largely unknown at this stage).

The structure of the judgment is as follows:

The claim was commenced as a representative action under what was then CPR 19.6 by a claim form issued on 28 April 2022. As I have already indicated, the claim is for damages for MOPI. The original definition of the Claimant Class was set out in the claim form. It has since been revised to take account of information contained in the evidence served by the Defendants in support of the strike out and summary judgment applications. The current formulation, which I have set out at para 6 above, appears in a letter from the Representative Claimant’s solicitors dated 23 February 2023. The Claimant Class excludes specified categories of persons, including officers, directors and employees of the Defendants, members of the parties’ legal teams and experts instructed by the parties.

The current formulation of the Claimant Class refers to individuals who presented for treatment at the Royal Free in the period 29 September 2010 to 29 September 2015 or whose blood tests data were held by the Royal Free in the same period. The Defendants’ evidence tends to indicate that the applicable period should be 29 September 2011 to 29 September 2015, that is to say one of four years, rather than five years (para 33 below). However, Mr Pitt-Payne KC accepted that nothing turns on this for present purposes and I accept that this could be addressed by further amendment of the class definition.

The particulars of claim state that the Representative Claimant was domiciled and resident in England and Wales, received extensive treatment at the Royal Free and did not consent to his medical records being collected and/or received and/or stored and/or held and/or used by the Defendants at any relevant time. The pleading alleges that his medical records were included within the 2015 transfer of the medical records of approximately 1.6 million patients to the Defendants by the Royal Free. This is referred to in the particulars of claim as “the Data Transfer” and I will use the same terminology. It is said that: “Consequently the Representative Claimant has the same interest in the Claim as each other member of the Claimant Class”.

The pleading goes on to allege that patient-identifiable data collected for the provision of health and social care services, is collected “with the expectation that it will be kept private and confidential” and that this obligation survives the death of the patient in question. The particulars of claim then state:

“13.

At all relevant times, the Representative Claimant and the Claimant Class had a reasonable expectation of privacy in respect of the information in issue (i.e. identifiable and confidential medical information). In particular, that unless express consent had first been obtained from a patient, identifiable and confidential medical information of that patient would only be shared for the purposes of the direct care of that patient.

14.

Direct care of a patient is limited to activities that directly contribute to the diagnosis, care and treatment of the patient.”

Reference is then made to the terms of the Information Sharing Agreement (“ISA”) entered into by the First Defendant and the Royal Free on 29 September 2015 (paras 26 - 31 below). It is said that:

“18

...the Data Transfer was effected without the knowledge or consent of any of the Claimant Class. Further, the purpose of the Data Transfer as at the date that it occurred was not to provide direct care. Rather the Data Transfer was intended at least to facilitate the development of the Streams application, in anticipation of the Streams application thereafter being used, inter alia, to alert medical staff to patients at risk of deterioration and death through kidney failure.”

It is further pleaded that as the Streams app was registered with the MHRA on or around 30 August 2016, it is to be inferred that Streams was not available for the provision of direct care to patients prior to that time and/or that the medical records included in the Data Transfer could not have been reasonably expected by members of the Claimant Class to be collected, received, stored, held and/or used by the Defendants for direct care prior to such registration.

The pleaded claim is focused upon the Data Transfer constituting an actionable commission of the tort of MOPI (para 17 of the particulars of claim). It is alleged that there was a reasonable expectation of privacy in the information transferred; that it was deliberately obtained by the Defendants and deliberately used by the Defendants, at least in developing Streams; that those identified in the records were not informed that their data had been shared with or used by the Defendants; and the Defendants’ actions were not justified by any relevant considerations so as to outweigh the reasonable expectation of privacy. For the avoidance of doubt, in so far as the pleading does not clearly identify the alleged interferences that Mr Pitt-Payne KC relied upon at the hearing (para 3 above), I accept that this could be addressed by amendment of the pleading.

In terms of loss and damage, para 21 of the particulars of claim seeks damages for loss of control of the class members’ private information. It is alleged that:

“the loss of control over their private information is common across the entire Claimant Class such that the Representative Claimant and each other member of the Claimant Class accordingly have the same interest for the purposes of loss of control damages”.

The Representative Claimant began an earlier representative claim for damages for breach of statutory duty, namely data protection legislation, relying upon the equivalent class of Claimants and the same events. The claim form was issued on 28 September 2021. However, this claim was discontinued on 31 January 2022 following the Supreme Court’s decision in Lloyd.

As a result of the witness statements and exhibits filed by the Defendants in support of their applications, there is now significantly more information available in terms of the sequence of events than there was at the time when the particulars of claim were prepared. Much of this material is undisputed. At the hearing the Representative Claimant and the Defendants emphasised various aspects of these events. I will summarise the salient chronology. In doing so I will identify the relatively limited instances where a factual dispute has been flagged. For the avoidance of doubt, save to the extent that I indicate during the course of this judgment, I have not sought to resolve such disputes at this stage.

Dr Hughes explains in Hughes 1 that he was previously an Honorary Research Associate at University College London (“UCL”), where he worked on developing a system designed to detect AKI on a timelier basis. When this project was discontinued in 2015, the Royal Free and UCL approached the Second Defendant with a view to DeepMind producing a new system with a similar purpose.

On or about 29 September 2015 the ISA was made between the First Defendant and the Royal Free. Clause 5 identified the “Purpose/s for sharing information” as follows:

“Patient Rescue is a Proof of Concept Technology Platform that enables Analytics as a Service for NHS Hospital Trusts. It has been developed by DeepMind, a group within Google UK Ltd.

Analyses are performed on both live and batch (intermittent) data streams. Outputs include tools to enhance adherence to, and implementation of, NHS / NICE guidelines. This will consist of: (i) Patient Safety Alerts for Acute Kidney Injury; and (ii) Real time clinical analytics, detection, diagnosis and decision support to support treatment and avert clinical deterioration across a range of diagnoses and organ systems.”

The Defendants’ position is that although a wider project was in contemplation at this time, the Patient Safety Alerts for AKI (which became Streams) was the only aspect that was pursued and patient data from the Royal Free was only processed in the context of Streams. The Representative Claimant is not in a position to specifically gainsay this, but Mr Pitt-Payne KC emphasised the lack of detail provided in terms of when a decision was made not to pursue the Patient Rescue project and the circumstances of this.

Clause 5 of the ISA identified the nature of the information that was to be shared. Firstly, this comprised HL7 feeds. HL7 is a reference to Health Level Seven international standards for exchanging patient-identifiable electronic healthcare records. The content is explained in Hughes 1. An electronic HL7 message was generated by the Royal Free each time an event took place during an individual’s visit to and treatment at one of their hospitals. The first message would relate to the person’s admittance into hospital and subsequent messages would relate, for example, to tests and treatment that they underwent. A further HL7 message would relate to their discharge. Each HL7 could contain demographic information such as the patient’s name, date of birth, address, contact details, sex and ethnic origin, although it might well not contain all of this material. Each message would indicate the subject matter of the event by reference to a code. Many HL7 messages were not included within the agreement (or within Streams). The categories of messages included were:

Clause 5 also encompassed Hospital Episodes Statistics data which conveyed information regarding previous patient diagnoses and procedures via codes produced by clinical coders following review of clinicians’ hard copy notes. The data solely consisted of a unique numeric identifier for each patient and the relevant codes.

In relation to the data that it covered, the terms of clause 5 referred to the last five years of archival data. The Royal Free was to remain the Data Controller and the data was to be processed in accordance with the Royal Free’s instructions. Streaming of data was to be via an encrypted channel. Clause 5 also permitted transferred data to be anonymised by the First Defendant for research under formal research ethics; and provided that data to be processed for purposes other than direct care for the patient was to be pseudonymised.

The project end date was given as 29 September 2017, at which point all patient-identifiable data held by the Patient Rescue project was to be transferred back to the Royal Free and any residual data destroyed.

The ISA did not include Renal System Reporting data and this was not part of the October 2015 Data Transfer. It later became part of the patient data available on Streams. It concerned lists of patients who were undergoing kidney dialysis. The Royal Free provided updated lists containing this information in order to avoid generating potentially false AKI alerts in relation to patients who were already undergoing dialysis.

Prior to October 2015, the Royal Free had been using a secure data feed operated by Carelink to send data to UCL in connection with the earlier project. Hughes 1 explains that the Royal Free considered that it would be more efficient to instruct Carelink to switch the data feed directly from UCL to DeepMind, rather than for the existing feed to be decommissioned and a new feed set up. Accordingly, the data feed was duly switched to DeepMind in October 2015. At the same time the Royal Free effected a one-off transfer of up to four years of historical patient data. Whilst the original intention had been to transfer five years of data, it became apparent that much of the older data held by the Royal Free was not of sufficient quality and/or in the right format to enable it to be used. The Representative Claimant does not accept that this is an adequate explanation for the Data Transfer having taken place so long before the Streams app came into operation.

Dr Hughes emphasises that the nature and quality of the transferred historical data varied significantly. For present purposes, the Royal Free consisted of three hospitals: the Royal Free Hospital in Hampstead, Barnet Hospital and Chase Farm Hospital in Enfield. The latter two hospitals became part of the Royal Free in 2014. The amount of historical patient data in a usable form varied between the hospitals. For example, Dr Hughes says that up to four years of historical biochemistry data concerning blood test results and non-biochemistry data such as radiology reports was transferred from the Royal Free Hospital in Hampstead, but only one year of laboratory data and almost no historical non-laboratory data was transferred from Chase Farm Hospital.

Hughes 2 clarifies that the biochemistry data stored by the Royal Free included blood tests where the sample had been obtained at a local GP clinic and sent to the Royal Free for testing. The number of patients that this involves is not known at this stage.

Hughes 1 indicates that the transfers were carried out using an encrypted VPN running over the NHS’s secure network. DeepMind rented secure cages in a third party run UK-based high security data centre for the purposes of storing the servers that were used and access to the servers was limited to a small number of DeepMind personnel. The data was held separately from other data processed by the Defendants. The figure of 1.6 million patients which I mentioned earlier in relation to the Data Transfer appears in correspondence with the Royal Free from the Information Commissioner’s Office (“ICO”); the Defendants have not disputed this figure, albeit both parties emphasise that the total figure cannot be calculated precisely at this stage.

It is common ground that the individuals whose data was transferred were not asked to consent to the transfer, were not informed of the transfer and were not given any opportunity to opt out of it.

Dr Hughes indicates that it was not intended that DeepMind would begin using the data for Streams immediately, but rather when Streams was ready for clinical testing and live use. He says that at the time when the data feed was redirected to the Second Defendant, it was not envisaged that it would take very long to get Streams into live operation, but in the event it took longer than expected.

Hughes 1 explains that the Second Defendant undertook the design and development of the Streams app in the period July – November 2015. The design phase for Streams consisted of identifying the required features and functions and then planning the technical infrastructure that would underpin the app. The development phase involved writing code and procuring hardware. During these phases, synthetic data, rather than actual patient data was used.

On 27 October 2015 the Defendants applied to the NHS Research Ethics Committee for approval for a project entitled “using machine learning to improve prediction of acute kidney injury and general patient deterioration”. The Defendants described the proposed study as follows:

“...In the UK 1 in 5 emergency admissions into hospital are associated with AKI, with up to 100,000 deaths each year in hospital associated with acute kidney injury. Up to 30% could be prevented with the right care. For this reason the Dept of Health have said that an automated system (‘national algorithm’) must be put in place to alert doctors to cases of AKI.

By combining real-time and historic electronic data that hospitals store about their patients (such as laboratory information), DeepMind have created a system which generates such alerts at the Royal Free London NHS Trust. However, it appears that the national algorithm can miss cases of AKI, can misclassify their severity, and can label some as having AKI when they don’t. The problem is not with the tool which DeepMind have made, but with the algorithm itself.

We think we can overcome these problems, and create a system which works better.”

The Committee granted approval on 10 November 2015. The Defendants’ position is that this approval related to the wider Patient Rescue project which, in the event, was not pursued. They also emphasise the indication on their application form that any patient data would be anonymised or pseudonymised prior to use.

Hughes 1 describes the initial post design and development stages of Streams as comprising the following:

The patient data that was the subject of the transfer was “normalised” into a relational structure and format that could be viewed in the Streams app. Dr Hughes indicates that this was an automated process that was carried out by DeepMind without any human access to the messages pre- or post-normalisation. The data was stored within the Streams database ready to be used in connection with the AKI detection and alerting process.

Hughes 1 states that it was only once correct functioning and integration of Streams had been established that clinicians at the Royal Free carried out on-site clinical safety and effectiveness testing. This was done in various windows during the period December 2015 – December 2016. The purpose of this testing was to ensure that there were no particular issues with the Royal Free’s systems which had not been identified and resolved during the earlier phases of testing. A “side-by-side” comparison was undertaken between a clinician identifying AKI through routine clinical practice and the outcome generated by the pre-release version of Streams. By its nature, this phase of testing did involve the use of real patients’ data. Dr Hughes says that it only concerned patients who were being treated by the renal team during the relevant periods and he estimates that the data of roughly 200 – 300 patients would have been involved. He says that this was the only processing of identifiable patient data that occurred during the testing of Streams.

Hughes 2 emphasises that the clinical safety and effectiveness testing was not concerned with refining the design or functionality of the Streams app; those were steps that had already been undertaken using synthetic data. Hughes 2 also says that all of the patient data that had been transferred either as part of the one-off transfer of historical data, or by the re-directed continuing data feed, would have been present in Streams during the clinical safety and effectiveness testing, but that only the 200 – 300 patients referred to in Hughes 1 would have had their data accessed via Streams during this phase.

Hughes 1 explains that following identification of on-site data integration issues, further synthetic test cases that replicated these issues were created to enable DeepMind personnel to address these matters. Streams then went through the three testing phases again and it was then signed off by the Clinical Safety Officer and the IT team at the Royal Free as ready for deployment.

On 28 January 2016 the Second Defendant entered into a five-year Memorandum of Understanding with the Royal Free (the “MOU”). The Representative Claimant emphasises that this envisaged a much broader collaboration than simply the Streams app. Clause 3.1 noted that the Second Defendant was interested in leveraging its technology by engaging in translational research and applying it with the aim of delivering positive clinical outcomes and costs benefits for the Royal Free and other NHS Trusts. Clause 3.4 recorded that:

“The Parties would like to form a strategic partnership exploring the intersection of technology and healthcare ... a wide-ranging collaborative relationship for the purposes of advancing knowledge in the fields of engineering and life and medical sciences through research and associated enterprise activities.”

Clause 5.1 listed “future potential areas of collaboration the parties may be keen to explore”. Clause 7.3 stated that:

“DeepMind wishes to position the Trust as an ‘Anchor Partner’ ... Generally, this means that [the Royal Free] will be a key development site for future projects...”

The Representative Claimant notes that the terms in which the Royal Free wrote to the National Data Guardian (“NDG”) on 1 July 2016 appear to indicate that at this time there remained a plan to broaden the research goals with DeepMind beyond the Streams app. As I have indicated earlier, the Defendants’ position is that the patient data was not used in any project other than Streams.

On or about 30 August 2016 the Streams app was registered with the MHRA, as I noted earlier. From February 2017 the Streams app moved to live deployment at the Royal Free.

The Streams app was installed on dedicated Apple iPhones which could only be used by certain clinicians at the Royal Free. It had two related purposes. The first purpose was to provide real time alerts in cases where a patient was at risk of developing, or had developed, AKI. Streams did this by analysing blood or urine tests and measuring a patient’s creatinine level. This was done by use of the NHS Decision Tree to detect changes in the person’s creatinine levels over time. Dr Hughes explains that the NHS Decision Tree does not use any form of artificial intelligence. If the Decision Tree determined that an AKI alert was necessary, then an alert was generated and sent to the Streams app. The second purpose was to give the clinicians easy access to the details of the patient’s stored medical records, which would then be used to diagnose and treat the patient. Prior to the implementation of Streams, clinicians needed to go through a multi-staged process of manually accessing and collating information from several of the Royal Free’s systems before analysing this material to see if the patient was at risk of AKI. Streams sped up the process of diagnosing AKI and helped to detect cases that might otherwise have gone unnoticed.

Hughes 1 indicates that a limited number of DeepMind personnel were authorised to carry out maintenance on Streams. This arose when a Royal Free clinician submitted a bug report, for example indicating that a blood test result had been accidentally labelled with the wrong patient details and thus needed to be manually removed from Streams. In these circumstances the designated DeepMind individual would investigate and remedy the report, which could involve viewing the data in question. Dr Hughes says that in his recollection bug reports were submitted infrequently, probably less than once a month on average, so that only a tiny proportion of patients’ data was viewed in these circumstances. In addition, updates to the Streams app were deployed on instruction from the Royal Free from time to time. This would involve an authorised DeepMind individual conducting a side-by-side comparison of the old and new version, viewing a small sample of patient data of approximately 10 – 15 patients for each update.

Dr Hughes indicates that in 2016-17 the Royal Free asked DeepMind to delete all patient data that pre-dated approximately November 2014. In November 2019, in accordance with further instructions from the Royal Free, there was a further deletion of a substantial amount of patient data on Streams. After this only data relating to the period from 1 January 2018 was retained.

From approximately November 2019 the Royal Free ceased to use Streams for the detection of AKI and by 31 January 2023 the Royal Free had ceased to use the app altogether.

Dr Hughes emphasises the positive outcomes that were achieved via the use of Streams. He says that statistical data produced by the app indicates that it provided an estimated 52,000 AKI alerts.

In 2016 - 2017 the ICO investigated the Royal Free’s compliance with the Data Protection Act 1998 (“DPA 1998”) in its responsibilities as data controller in relation to the Defendants’ processing of patients’ personal data for the purposes of testing the Streams app. A letter dated 3 July 2017 conveyed the ICO’s conclusion that the processing by DeepMind of approximately 1.6 million patients’ personal data for the purposes of the clinical safety testing of the Streams app did not fully comply with the DPA 1998. The ICO noted the absence of patient consent to this processing and concluded that there had been non-compliance with Principles One, Three, Six and Seven of the Data Protection Principles. The letter said that the investigation had determined that the purpose of allowing DeepMind to process information on 1.6 million patients from November 2015 was to carry out clinical safety testing as part of the development of the Streams app. In deciding that Principle One had been breached, the ICO indicated that it did not accept that the processing in question was “direct care” as the Royal Free did not have the patients’ implied consent for the processing and thus did not have a basis for satisfying the common law duty of confidence.

The Defendants’ position is that the ICO misunderstood the nature of the clinical safety and effectiveness testing and the extent to which it involved the use of identifiable patient data; they say that the accurate position is as described by Dr Hughes (paras 43 - 44 above). In short, that although Streams had the normalised patient data relating to approximately 1.6 million people during this phase of the testing, the data of only about 200 – 300 patients was accessed and used in the “side by side” tests. Mr Pitt-Payne KC submitted that the Court should not proceed on the basis that the ICO was incorrect in its understanding of the use of patient data in the testing. She had conducted an investigation before arriving at her conclusion and the full details of this were not available at this stage.

Following the ICO’s determination, the Second Defendant published a press release entitled “The Information Commissioner, the Royal Free, and what we’ve learned”. It included the following:

“... In our determination to achieve quick impact when this work started in 2015, we underestimated the complexity of the NHS and of the rules around patient data ... We were almost exclusively focused on building tools that nurses and doctors wanted, and thought of our work as technology for clinicians rather than something that needed to be accountable to and shaped by patients, the public and the NHS as a whole. We got that wrong, and we need to do better.”

The ICO sought and obtained an undertaking from the Royal Free. This led to the Royal Free commissioning Linklaters to carry out an audit of Streams and of the remedial steps taken by the Royal Free. Linklaters produced a report dated 17 May 2018 which concluded that the Royal Free had not breached its duty of confidence to patients through the testing and operation of Streams. The NDG wrote to the ICO on 21 August 2018 expressing disagreement with Linklaters’ conclusion that the use of confidential patient information in the testing of Streams could be considered to be an aspect of direct care.

CPR 3.4(2) provides:

“(2)

The court may strike out a statement of case if it appears to the court-

(a)

that the statement of case discloses no reasonable grounds for bringing or defending the claim;

....”

When the Court strikes out a statement of case it may make any consequential order it considers appropriate: CPR 3.4(3).

CPR 24.2 provides that the Court may give summary judgment against a claimant on the whole of a claim or on a particular issue if the “claimant has no real prospect of succeeding on the claim or issue” and there is “no other compelling reason” why the case should be disposed of at trial.

When applications are made to strike out particulars of claim pursuant to CPR 3.4(2)(a) as disclosing “no reasonable grounds” for bringing the claim and, in the alternative for summary judgment in a defendant’s favour, there is no difference between the tests to be applied by the Court under the two rules: Begum v Maran (UK) Limited [2021] EWCA Civ 326 (“Begum”) per Coulson LJ at paras 20 - 21. In para 22(a) he described the applicable test as follows:

“The court must consider whether the claimant has a ‘realistic’ as opposed to a ‘fanciful’ prospect of success: Swain v Hillman [2001] 1 All ER 91. A realistic claim is one that carries some degree of conviction: ED & F Man Liquid Products Ltd v Patel [2003] EWCA Civ 472. But that should not be carried too far: in essence, the court is determining whether or not the claim is ‘bound to fail’: Altimo Holdings v Kyrgyz Mobil Tel Ltd [2012] 1 WLR 1804 at [80] and [82].”

The onus lies on the Defendants to establish that this test is made out.

The extent to which it is appropriate for the Court to consider the evidential position when applying the test was summarised in Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch) as follows:

“iii)

In reaching its conclusion the court must not conduct a ‘mini-trial’: Swain v Hillman;

iv)

This does not mean that the court must take at face value and without analysis everything that a claimant says in his statements before the court. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents: ED & F Man Liquid Products Ltd v Patel at [10];

v)

However, in reaching its conclusion the court must take into account not only the evidence actually placed before it but also the evidence that can reasonably be expected to be available at trial: Royal Brompton Hospital NHS Trust v Hammond (No 5) [2001] EWCA Civ 550;

vi)

Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without the fuller investigation into the facts at trial than is possible or permissible on summary judgment. Thus the court should hesitate about making a final decision…where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to the trial judge and so affect the outcome of the case: Doncaster Pharmaceuticals Group Ltd v Bolton Pharmaceutical Co 100 Ltd [2007] FSR 63;

vii)

…if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it…If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction: ICI Chemicals & Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725.”

Where a statement of case is found to be defective, the Court should consider whether the defect might be cured by amendment and, if it might be, the Court should give the party concerned an opportunity to amend: White Book 2023, para 3.4.2 citing Soo Kim v Youg [2011] EWHC 1781 (QB); see also Duchess of Sussex v Associated Newspapers Ltd [2020] EWHC 1058 (Ch), [2020] EMLR 21 at para 33(2). When the Court strikes out particulars of claim, it will often be appropriate to make an order dismissing the claim or giving judgment upon it, but the Court may instead give further directions, as discussed at para 3.4.22 of the White Book.

Save where I indicate to the contrary, the principles are not in dispute. It is common ground that liability for MOPI is determined by the application of a two-stage test. Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If this is shown, then stage two is whether that expectation is outweighed by a countervailing interest of the defendant: McKennitt v Ash [2006] EWCA Civ 1714, [2008] QB 73 at para 11; ZXC v Bloomberg LP [2022] UKSC 5, [2022] AC 1158 (“Bloomberg”) at para 26.

Whether a claimant has a reasonable expectation of privacy is an objective test. The expectation is that of a reasonable person of ordinary sensibilities placed in the same position as the claimant and faced with the same publicity: Bloomberg at para 49. Lord Hamblen and Lord Stephens JJSC noted that the question is a broad one which takes into account all of the circumstances of the case: Bloomberg at para 50. They referred to the non-exhaustive list of factors identified in Murray v Express Newspapers plc [2008] EWCA Civ 446, [2009] Ch 481 at para 36 (“the Murray factors”), as follows:

“(1)

the attributes of the claimant; (2) the nature of the activity in which the claimant was engaged; (3) the place at which it was happening; (4) the nature and purpose of the intrusion; (5) the absence of consent and whether it was known or could be inferred; (6) the effect on the claimant; and (7) the circumstances in which and the purposes for which the information came into the hands of the publisher.”

Lord Hamblen and Lord Stephens observed that, whilst the circumstances of each case must be considered, “there are certain types of information which will normally, but not invariably, be regarded as giving rise to a reasonable expectation of privacy” (para 52). One of the examples they gave was: “the state of a person’s physical or mental health or condition”. They also noted that a relevant circumstance was the extent to which the information was already in the public domain: “Information that was private may become so well known that it is no longer private. Whether that is so is a matter of fact and degree” (para 54).

It is well established that there is a de minimis threshold which must be overcome before liability for MOPI can arise. Lord Neuberger MR explained at para 30 in Ambrosiadou v Coward [2011] EWCA Civ 409, [2011] EMLR 21 that: “Just because information relates to a person’s family and private life, it will not automatically be protected by the courts: for instance the information may be of slight significance, generally expressed or anodyne in nature”. See also Bloomberg at para 55.

Stage two involves carrying out a balancing exercise. In many instances the competing rights protected by Articles 8 and 10 of the European Convention on Human Rights (“ECHR”) will be in play. In In re S (A Child) (Identification: Restrictions on Publication) [2005] 1 AC 593 Lord Steyn said that the balancing exercise involved, “an intense focus on the comparative importance of the specific rights being claimed in the individual case”, the “justifications for interfering with or restricting each right” and the proportionality of the respective interference or restriction (para 17).

The European Court of Human Rights (“ECtHR”) has emphasised the importance of the Article 8 ECHR right to respect for private life in the context of medical information. In Z v Finland (1998) 25 EHRR 371 the ECtHR said that in determining whether the interference was “necessary in a democratic society”:

“95.

... the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life ... Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.

Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community.”

However, it is also well-established that not every disclosure of medical information will give rise to a reasonable expectation of privacy and/or involve an unlawful interference. In Campbell v MGN Ltd [2004] UKHL 22, [2004] 2 AC 457 (“Campbell”) Baroness Hale observed:

“157.

... Not every statement about a person’s health will carry the badge of confidentiality or risk doing harm to that person’s physical or moral integrity. The privacy interest in the fact that a public figure has a cold or a broken leg is unlikely to be strong enough to justify restricting the press’s freedom to report it. What harm could it possibly do?”

This passage has been cited in numerous subsequent authorities including by Eady J in A v B [2005] EWHC 1651 (QB), [2005] EMLR 36 at para 33; and by Warby J (as he then was) in NT1 and NT2 v Google LLC [2018] EWHC 799 (QB), [2019] QB 344 at para 145. In ZC v Royal Free London NHS Foundation Trust [2019] EWHC 2040 (QB) (“ZC”) Julian Knowles J said:

“170.

The context is all important. I accept that the mere fact of having hospital or other treatment (without anything more) may itself be private information, for example, if someone has attended a clinic from which the nature of their illness can be readily inferred. But everything depends on the circumstances. I entertain doubts that the mere fact of a person’s attendance at an A&E department would, without more, constitute private information.”

He did not need to decide this point, as Julian Knowles J was in any event satisfied on the very particular facts of ZC that there was no reasonable expectation of privacy in relation to the Claimant’s use of several false names when seeking treatment or in the mere fact of her attendance at hospital given she had chosen to make this public in launching a private prosecution against one of the doctors (paras 169 - 170).

Information obtained in a medical context may attract the operation of the de minimis principle. In Underwood v Bounty UK Ltd [2022] EWHC 888 (QB), [2022] ECC 22 (“Underwood”) Nicklin J dismissed a MOPI claim brought against the Second Defendant, an NHS Trust, on the basis that there had been no “misuse” by the Trust of the Claimants’ private information. (The First Defendant was in administration and did not participate in the proceedings.) The First Claimant had given birth to her son, the Second Claimant, at one of the Trust’s hospitals. Pursuant to a contractual arrangement between the Trust and Bounty, the First Defendant was given access to expectant mothers and to the parents of new-borns on the Trust’s premises. Whilst she was on the ward shortly after giving birth, the First Claimant was approached by a Bounty representative who was pitching its photography services. The representative looked at paperwork that was in a holder at the end of the bed and thereby obtained some limited information (paras 37 and 38). The Judge held that the sheer fact that the Trust had permitted the Bounty representative to have access to the Claimants was insufficient to amount to “misuse” in circumstances where the information was obtained without the Trust’s involvement, consent or knowledge (para 52). However, Nicklin J also went on to observe:

“53.

... even if the Claimants had established that the Second Defendant was liable under the MPI tort for Bounty acquiring information about them, the information so obtained was trivial. Discounting information that the First Claimant had already provided ... this amounted only to the name, gender and date of birth of the Second Claimant. To be actionable for misuse of personal information, the information misuse must reach a level of seriousness before the tort is engaged. Had the claim not failed for other reasons, it would have failed on this ground.”

Similarly, the nature of the medical information in question will impact upon the level of appropriate compensation, if the tort is established. In setting out the principles that he had applied in Gulati v MGN Ltd [2015] EWHC 1482 (Ch), [2016] FSR 12 (“Gulati”) Mann J said at para 229:

“(i)

... certain types of information are likely to be more significant than others. Thus medical information is more likely to be high in the ranks of information expected to be private, so its interception and disclosure is likely to attract a higher, rather than a lower, figure. That information can relate to matters of mental health as well as physical health ... However, even that kind of information has a range – not all medical-related disclosures will be treated equally seriously. It depends on the nature of the information.”

In dismissing the subsequent appeal, the Court of Appeal approved para 229 of Mann J’s judgment (save with one qualification that is not relevant for present purposes): [2015] EWCA Civ 1291, [2017] QB 149 at para 74.

However, Mr Pitt-Payne KC submitted that there was a distinction of principle between information about a person’s health in general and information that was generated in the course of the doctor – patient relationship. He said that in relation to the latter situation the nature of the relationship was such that, save for direct care purposes, there was always a reasonable expectation of privacy that the information would not be used without the person’s consent or the opportunity to opt out and that a de minimis threshold either did not apply or would always be crossed. He said that this included not only diagnosis and treatment records, but information concerning a person’s attendance at an A & E Department of a hospital and/or their discharge from hospital. Mr White KC did not agree that such a distinction existed. I return to this question from para 124 below as it has an important bearing on the question of whether every member of the Claimant Class has a viable MOPI claim.

Both parties accept that a reasonable expectation of privacy would not arise in relation to medical information that is used for the direct care of patients. I address the significance of this concept in respect of the present action from para 142 below. The most recent edition of the guidance issued by the General Medical Council (“GMC”), “Confidentiality: good practice in handling patient information” (2017) describes the concept of direct care as follows:

“... ‘direct care’ refers to activities that directly contribute to the diagnosis, care and treatment of an individual. The direct care team is made up of those health and social care, professionals who provide direct care to the patient and others, such as administrative staff, who directly support that care.”

For these purposes “misuse” may include unintentional use, but a “use” does require a positive action: Warren v DSG Retail Ltd [2021] EWHC 2168 (QB), [2022] 1 All ER 1191, Saini J at para 27; see also Underwood at para 75 above.

Intentionally obtaining information can amount to “misuse” for these purposes: Imerman v Tchenguiz [2010] EWCA Civ 908, [2011] Fam 1116 at para 68 (in the context of breach of confidence). Storing information can also be a form of misuse: Amann v Switzerland (2000) 30 EHRR 843 at para 69, where the ECtHR found that the Public Prosecutor’s creation and storing of a card containing data relating to the Applicant’s private life amounted to an interference with the right to respect for his private life (para 70).

The potential for recovering damages for loss of control in a successful MOPI action is well established. The Court of Appeal in Gulati endorsed Mann J’s awards of damages, which included an element reflecting the Claimants’ loss of control of the information in question. Lady Justice Arden (as she then was) said:

“45

... In my judgment, the judge was correct to conclude that the power of the court to grant general damages was not limited to distress and could be exercised to compensate the claimants also for misuse of their private information. The essential principle is that, by misusing their private information, MGN deprived the claimants of their right to control the use of private information...The claimants are entitled to be compensated for that loss of control of information as well as for any distress, though the amount of compensation may be affected if the information would on the facts have become public knowledge anyway...The scale of the disclosure is a matter which goes to the assessment of the remedy, not to its availability.”

Furthermore, in Lloyd, Lord Leggatt JSC (who gave the leading judgment), observed that the decision in Gulati, “shows that damages may be awarded for the misuse of private information itself on the basis that, apart from any material damage or distress that it may cause, it prevents the claimant from exercising his or her right to control the use of the information” (para 141).

Whilst accepting that loss of control damages may be recovered in respect of a successful claim for MOPI, Mr White KC submitted that such damages would not be capable of evaluation on a uniform per capita basis as the loss of control award itself involves a component of individualised assessment and an element of distress. He drew attention to Mann J’s reference in para 229 of Gulati to not having applied tariffs or general bands. However, in saying this Mann J was addressing the process of quantifying the general damages awards that he had made for each claimant; he was not simply focusing upon loss of control damages, nor considering whether a lowest common denominator approach was capable of being applied to loss of control damages.

Mr White KC also relied upon Warby J’s discussion of loss of control damages for MOPI in Reid v Price [2020] EWHC 594 (QB), where the Judge said:

“51

... in misuse of private information and data protection claims, damages may be awarded for loss of autonomy or loss of control; the nature of the information disclosed and the degree of loss of control should bear on this aspect of the court’s assessment of damages – the more intimate the information and the more extensive the disclosure, the greater the award.”

In a similar vein, at first instance in Lloyd, Warby J said:

“74.

...I do not believe that the authorities show that a person whose information has been acquired or used without consent invariably suffers compensatable harm, either by virtue of the wrong itself, or the interference with autonomy that it involves...”

He went on to give examples of where an individual would not suffer from “loss of control” in the same way as someone who objects to use being made of their information.

The Supreme Court in Lloyd did not refer specifically to the observation I have quoted in the previous paragraph. However, in any event Lord Leggatt’s consideration of whether loss of control amounted to “damage” for the purposes of section 13 DPA 1998 was predicated on the basis that if that was the case, it could have enabled the Claimant to overcome the necessity for individualised assessment in respect of each member of the class (see for example, paras 86 - 88 and 106 - 108). If the Supreme Court had considered that loss of control damages were only capable of individualised assessment, this would have afforded a complete and much shorter answer to a major limb of the Claimant’s case.

Accordingly, I do not accept Mr White KC’s submission that loss of control damages inevitably involves an individualised assessment. However, the question remains whether the members of the Claimant Class, as defined, have a viable, more than de minimis claim for loss of control damages.

Representative actions were addressed in CPR 19.6. The Civil Procedure (Amendment) Rules 2023 (SI 2023/105) have renumbered the rule as CPR 19.8. It provides (as relevant) as follows:

“(1)

Where more than one person has the same interest in a claim-

(a)

the claim may be begun; or

(b)

the court may order that the claim be continued,

by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.

...

(4)

Unless the court otherwise directs any judgment or order given in a claim in which a party is acting as a representative under this rule-

(a)

is binding on all persons represented in the claim; but

(b)

may only be enforced by or against a person who is not a party to the claim with the permission of the court.”

In light of the parties’ competing submissions, it is necessary to consider Lloyd in some detail.

The case concerned a representative action on behalf of an estimated four million plus people. Compensation was sought under section 13 DPA 1998 for the Defendant’s breach of its statutory duties as a data controller, in particular in tracking the activity of users of Apple iPhones and selling the accumulated data. The Claimant contended that all members of the class (those resident in England and Wales who owned an Apple iPhone of a particular model at the relevant time and whose data was obtained without their consent) had suffered “damage” for the purposes of section 13 in their loss of control over their data protection rights. The Claimant accepted that what was then the CPR 19.6 procedure could not be used to claim compensation if it had to be individually assessed (paras 5 and 8). However, it was argued that general damages could be awarded on a uniform per capita basis to each member of the represented class without the need to prove additional facts particular to any individual (para 88), as loss of control damages could be awarded under section 13 (para 108).

The issues in Lloyd arose in the context of an application to serve the Defendant outside the jurisdiction. This requires the Claimant to show that the claim has a real prospect of success. The Court of Appeal allowed the appeal from the dismissal of the application, on the basis that an individual suffered “damage” within the meaning of section 13 DPA 1998 upon losing control of their data, even if they suffered no pecuniary loss and no distress, so that the claim could proceed as a representative action for loss of control damages.

The Supreme Court disagreed. In summary, the Court concluded that the claim was not a viable representative action because:

As I have already noted (para 8 above), Mr White KC submitted that the circumstances of the present case are analogous to Lloyd in that the Supreme Court’s second conclusion applies with equal force to this MOPI claim and the Claimant Class.

Lord Leggatt reviewed the basis upon which collective redress could be obtained in English law. The only legislative regime introduced by Parliament permitting a class action to be brought by a single person claiming redress on behalf of a class of people affected in a similar way, was in competition law under section 47B of the Competition Act 1998 (“CA 1998”), which makes provision for “collective proceedings” in the Competition Appeal Tribunal (paras 4 and 30). Group actions could be brought via a group litigation order made under CPR 19.11, but this had the drawback of being an “opt in” procedure. This was a potentially effective way of litigating claims of sufficiently high value, but it was uneconomic for claims which were individually only worth a few hundred pounds each and tended to involve a relatively small proportion of those eligible to join (paras 25 - 28). Lord Leggatt contrasted this position with collective proceedings under the CA 1998, which could be brought on either an “opt out” or an “opt in” basis and enabled liability to be established and damages recovered without the need to prove that members of the class have individually suffered loss (paras 30 - 32).

Lord Leggatt noted that the representative procedure had existed for several hundred years. He reviewed the earlier case law between paras 34 - 58. Having done so he identified the “Principles governing use of the representative procedure”. He began with some general observations. The development of digital technologies had added to the potential for mass harm for which legal redress may be sought and in such cases it was, “necessary to reconcile, on the one hand, the inconvenience or complete impracticality of litigating multiple individual claims with, on the other hand, the inconvenience or complete impracticability of making every prospective claimant (or defendant) a party to a single claim”. He observed that in such circumstances the only practical way to “come at justice” was to combine the claims in a single proceeding and allow one or more persons to represent all those who shared the same interest in the outcome (para 67). He considered that the absence of a detailed legislative framework was no reason to interpret the representation rule restrictively and that its very simplicity was in some respects a strength (para 68).

As Lord Leggatt noted, there is only one condition that must be satisfied under CPR 19.6 before a representative claim may be begun or allowed to continue, namely that the representative has the “same interest” in the claim as the persons represented (para 69). A correct understanding of this phrase is therefore critical. Lord Leggatt considered that the phrase, “needs to be interpreted purposively in light of the overriding objective of the Civil Procedure Rules and the rationale for the representative procedure” (para 71). The purpose of the “same interest” requirement was “to ensure that the representative can be relied on to conduct the litigation in a way which will effectively promote and protect the interests of all the members of the represented class. That plainly is not possible where there is a conflict of interest between class members, in that an argument which would advance the cause of some would prejudice the position of others” (para 71).

Mr White KC and Mr Pitt-Payne KC were not agreed as to whether members of a class could have the “same interest” in circumstances where the Defendant to the action has a potential defence to the claims of some members of the class and not to others, for example, where a limitation defence may arise in relation to some only of the class. Mr White KC submitted that in such circumstances it could not be said that all the members had the “same interest” and, accordingly, the prescribed criterion was not met.

Some of the earlier authorities support Mr White KC’s submission, for example Jalla v Shell [2021] EWCA Civ 1389, [2022] 2 All ER 1056 at para 51(j). However, the contrary view was expressed by Lord Leggatt in Lloyd. He said:

“72

As Professor Adrian Zuckerman has observed in his valuable book on civil procedure, however, a distinction needs to be drawn between cases where there are conflicting interests between class members and cases where there are merely divergent interests, in that an issue arises or may well arise in relation to the claims of (or against) some class members but not others. So long as advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person: see Zuckerman on Civil Procedure: Principles of Practice, 4^th ed (2021), para 13.49. As Professor Zuckerman also points out, concerns which may once have existed about whether the representative party could be relied on to pursue vigorously lines of argument not directly applicable to their individual case are misplaced in the modern context, where the reality is that proceedings brought to seek collective redress are not normally conducted and controlled by the nominated representative, but rather are typically driven and funded by lawyers or commercial litigation funders with the representative party merely acting as a figurehead. In these circumstances, there is no reason why a representative party cannot properly represent the interests of members of the class, provided there is no true conflict between them.

73.

This purposive and pragmatic interpretation of the requirement is exemplified by The Irish Rowan [1991] 2 QB 206, where Staughton LJ, at pp 227-228, noted that some of the insurers might wish to resist the claim on a ground that was not available to others. He rightly did not regard that circumstance as showing that all the insurers did not have “the same interests” in the action, or that it was not within the rule, and had “no qualms about a proceeding which allows that ground to be argued on their behalf by others”.

74.

Even if it were considered inconsistent with the “same interest” requirement, or otherwise inappropriate, for a single person to represent two groups of people in relation to whom different issues arise although there is no conflict of interest between them, any procedural objection could be overcome by bringing two (or more) representative claims, each with a separate representative claimant or defendant, and combining them in the same action.”

Whilst the first few lines of para 74 may indicate that Lord Leggatt did not express a final conclusion on this point (as he did not need to in order to determine the case before the Court), the very clear thrust of the passage that I have cited is that the existence of a defence that applies to only some members of the class will not preclude the “same interest” test from being met, provided there is no conflict of interest. Accordingly, I agree with Mr Pitt-Payne KC’s submission to that effect (para 9(i) above). Mr White KC said that the Court’s second conclusion was inconsistent with this proposition. I do not agree. There is a distinction between a situation where it is apparent that a potential defence is available in relation to a subset of the members of the class and one where it is simply not possible to ascertain from the way the case is put whether any given member of the class has a viable claim or not, which was the basis of the second conclusion, as I have summarised at para 92 above.

To underscore this I will explain the Court’s reasoning on the second conclusion in a little more detail. The Court’s line of reasoning in this regard is also important because of the analogy that Mr White KC seeks to draw with Lloyd (para 8 above). Lord Leggatt said that it was necessary to identify what unlawful processing by Google of personal data was alleged to have occurred in the case of each member of the class (para 148). He proceeded to note (at paras 148 - 149 and 151) that the only fact which the Claimant proposed to prove to show that Google acted unlawfully in each individual case was the person’s membership of the class (it being acknowledged that any additional facts would vary between the individuals). To fall within the class definition it had to be shown that the individual concerned had an iPhone of the appropriate model running a relevant version of the Apple Safari internet browser, which on a date during the relevant period, whilst present in England and Wales, they had used to access a website that was participating in Google’s DoubleClick advertising services (para 150). Accordingly, the class would include those who had clicked on a relevant website on a single occasion and had received no targeted advertisements as a result (para 151). These facts alone were insufficient to surmount the seriousness threshold which admittedly applied to the DPA 1998 claim, as it was impossible to characterise such damage as more than trivial: “Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages” (para 153).

It is unnecessary to dwell on the position in relation to potential defences, as Mr Pitt-Payne KC accepts that if some members of the represented class will not be able to establish the ingredients of a viable claim, including that they have a realistic prospect of establishing a reasonable expectation of privacy, then the “same interest” requirement is not met (para 9(i) above).

Nonetheless, I note for completeness, that the view I have expressed in relation to circumstances where some of the class have a potential defence appears to be consistent with the approach taken by Robin Knowles J in Commission Recovery Limited v Marks & Clerk LLP [2023] EWHC 398 (Comm) (“Marks”). The case involved a claim relating to undisclosed commissions received by the Defendants for renewal applications for patents, trademarks and registered designs. The First Defendant was a firm of patent and trademark attorneys. The Claimant acted as a representative under CPR 19.6 for current and former clients of the First Defendant with commission-related claims. The application to strike out the claim was unsuccessful. The Defendants said that whilst the claims gave rise to common issues, they were not sufficiently similar to each other for a number of reasons identified at paras 53 - 55. Rejecting this argument, Robin Knowles J observed that what mattered, “in particular is whether the points involve class members affected by an issue prejudicing the position of others” (para 56). He held that there was no conflict of interest in the sense that success or recovery by one client would prejudice the interests of another (para 59). Further, the fact that there may be a limitation defence in respect of some of the class did not give rise to a conflict (para 61). The Judge acknowledged that it would be necessary to place reliance on the representative party and its lawyers to pursue vigorously lines of argument that were not directly applicable to the Claimant’s individual case (para 63). Nonetheless the “same interest” requirement was met; and the matters raised by the Defendants would inform the exercise of the Court’s discretion (para 64).

Where the “same interest” requirement is satisfied, the Court has a discretion whether to allow the claim to proceed as a representative action and in exercising this discretion it must seek to give effect to the overriding objective of dealing with cases justly and at proportionate cost: Lloyd at para 75.

Robin Knowles J observed in Marks that, subject to jurisdiction, if some can be assisted to access the Court to establish the claim in question then, “that is better than none” (paras 69 and 81).

Lord Leggatt confirmed that there is ordinarily no need for a member of the represented class to take any positive step, or even to be aware of the existence of the action in order to be bound by the result (para 77). However, it was open to the judge managing the case to impose a requirement that members of the class be notified of the proceedings and to establish a procedure for opting out of representation or limiting the represented class to those who had positively opted into the litigation (para 77).

Whilst only identifying the topic briefly, as it was not raised by Google at that stage of the litigation, Lord Leggatt acknowledged the practical difficulties of distributing damages recovered in a representative action to the members of the class. He noted that in the case before him “questions of considerable difficulty” would arise in this regard if the Claimant was awarded damages in a representative capacity, including whether there would be any legal basis for paying part of the damages to the litigation funders without the consent of each individual entitled to them (para 83).

Lord Leggatt also clarified that whilst it was desirable for the represented class of persons to be clearly defined, the adequacy of the definition of the class was a matter which went to the Court’s discretion in deciding whether it is just and convenient to allow the claim to be continued on a representative basis, rather than being a precondition for the application of the rule (para 78). Nonetheless, as established in Emerald Supplies Ltd v British Airways plc [2010] EWCA Civ 1284, [2011] Ch 345, membership of the class should not depend on the outcome of the litigation (para 78).

Lloyd confirms that a representative action is not precluded by the sheer fact that the claimed relief includes damages (or some other monetary relief), (paras 50, 58 and 80). Lord Leggatt identified the difficulty presented by the compensatory principle as follows:

“80.

... The potential for claiming damages in a representative action is, however, limited by the nature of the remedy of damages at common law. What limits the scope for claiming damages in representative proceedings is the compensatory principle on which damages for a civil wrong are awarded with the object of putting the claimant – as an individual – in the same position, as best money can do it, as if the wrong had not occurred. In the ordinary course, this necessitates an individualised assessment which raises no common issue and cannot fairly or effectively be carried out without the participation in the proceedings of the individuals concerned. A representative action is therefore not a suitable vehicle for such an exercise.”

However, he recognised that, “there is no reason why damages or other monetary remedies cannot be claimed in a representative action if the entitlement can be calculated on a basis that is common to all members of the class” (para 82). Lord Leggatt identified as examples of this, where every member of the class had been wrongly charged a fixed fee, and where all members of the class had acquired the same product with the same defect which reduced its value by the same amount. (A further example of where the entitlement could be calculated on a basis common to all class members was the claims for secret commissions in Marks (para 71)). Lord Leggatt noted that the difficulty would be avoided where damages were claimed on a global “top down” basis. However, damages in Lloyd were claimed on the “bottom up” approach of assessing a sum which each member of the class was individually entitled to recover (paras 82 and 86). It is accepted that “bottom up” damages are also claimed in the present case.

Lord Leggatt emphasised that the class members in Lloyd were not uniformly affected by the conduct complained of. Some were heavy internet users, who would have experienced multiple DPA breaches, with considerable amounts of their browser generated information taken and used. Others engaged in very little relevant internet activity. The ordinary application of the compensatory principle would thus result in differing awards of compensation, depending upon the individuals’ circumstances (paras 87 and 88). Lord Leggatt indicated that the Claimant sought to overcome this difficulty by limiting the claim to uniform per capita damages for loss of control for each member of the class, which did not require particular facts to be proved in relation to any individual member (para 88). This was described as a claim for the “irreducible minimum harm” suffered by every member of the class and as a “lowest common denominator” basis. As I have already indicated, an analogous approach is taken by the Representative Claimant in the present case.

Lord Leggatt considered it unnecessary to determine Google’s “in principle” objection to this approach; that Mr Lloyd, as the self-appointed representative of the class, had no authority from any individual class member to waive or abandon what might be the major part of their damages claim by disavowing reliance upon any circumstances affecting that individual (paras 146 - 147). He indicated he would proceed on the assumed basis that, as a matter of discretion, the Court could - if satisfied that those represented would not be prejudiced and with suitable arrangements in place enabling them to opt out of the proceedings if they so chose - allow a representative claim to be pursued for part only of the potential compensation that could be claimed by an individual (para 147). Mr White KC does not concede the “in principle” point in the present case, but he is content for the Court to proceed on the basis of a similar assumption (para 8 above).

I have explained the Supreme Court’s second conclusion at paras 92 and 100 - 102 above. It is convenient to indicate at this stage that I reject Mr Pitt-Payne KC’s submission that the problems posed by the compensatory principle and the need to avoid individualised assessments are simply matters that go to the exercise of the Court’s discretion.

It is clear from the terms of Lord Leggatt’s analysis at paras 80 - 82 that if individualised assessment of damages is required for class members’ claims this precludes a representative action seeking damages on behalf of that class.

Furthermore, the Court’s second conclusion was not one arrived at by the exercise of a discretion. As I have explained earlier, the Court found that Mr Lloyd could not avoid the need for an individualised assessment of damages by use of a lowest common denominator approach, as the facts which he sought to prove for each class member were insufficient to establish a viable claim under section 13 DPA 1998 for any member of the class. Lord Leggatt summarised the situation in this way at para 147:

“...The fundamental problem is that, if no individual circumstances are taken into account, the facts alleged are insufficient to establish that any individual member of the represented class is entitled to damages. That is so even if it is unnecessary to prove that the alleged breaches caused any material damage or distress to the individual.” (Emphasis added).

For the avoidance of doubt, I accept that some issues that could arise in relation to the damages claimed on behalf of a represented class would involve the exercise of the Court’s discretion, but, as I have explained, this was not the basis upon which the action failed in Lloyd.

Lord Leggatt noted that in cases where damages required individual assessment, there could be advantages in adopting a bifurcated process, whereby common issues of fact and law were determined through a representative claim, leaving issues that require individual determination, whether relating to liability or damages to be dealt with at a subsequent stage (para 81). Lord Leggatt considered that there could have been no objection to Mr Lloyd bringing a representative action to establish whether Google was in breach of the DPA 1998 and, if so, seeking a declaration that any member of the represented class who had suffered damage by reason of the breach was entitled to be paid compensation (para 84). However, a bifurcated process was not proposed in Lloyd, as it would have been uneconomic in the circumstances (para 85). This is also the position for the present claim.

I have already indicated that Mr Pitt-Payne KC accepts that for members of the class to have the “same interest” they must all have a realistic prospect of establishing a reasonable expectation of privacy in their relevant data and an unlawful interference with it (para 9 above).

Determining whether or not there was a reasonable expectation of privacy in relation to information concerning an individual usually involves an assessment of their particular circumstances, including the effect upon them of the matters complained of (para 67 above).

Lord Leggatt observed that the absence of a MOPI claim in Lloyd may have been because the view was taken that to establish a reasonable expectation of privacy “it would be necessary to adduce evidence of facts particular to each individual claimant” and “the need to obtain evidence in relation to individual members of the represented class would be incompatible with the representative claim” (para 106).

Mr White KC emphasised the amount of variable circumstances that could arise between class members in the present case. However, the Representative Claimant seeks to avoid this difficulty by accepting that in establishing the cause of action, such variables must be left out of account and that the claim must proceed on the basis of an irreducible minimum that is applicable to all class members. By proceeding in this way, the Representative Claimant says that the “same interest” criterion is met. It follows from this that Mr Pitt-Payne KC accepted that the question of whether there is a realistic prospect of establishing a reasonable expectation of privacy in relation to all of its members, must be considered by reference to the basic circumstances that would apply to each member of the Claimant Class.

I emphasise that the Court’s task is to determine whether every member of the Claimant Class has a realistic prospect of showing that they had a reasonable expectation of privacy in respect of their transferred records; the fact that the Representative Claimant can identify some examples of where highly personalised and substantial medical information was transferred does not directly assist him.

However, Mr Pitt-Payne KC submitted that even with variables left out of account, the Claimant Class as a whole had a weighty reasonable expectation of privacy in respect of their medical records that were transferred to the Second Defendant. In terms of the factors identified in Murray he emphasised that: in each instance the record arose in a context where the person had presented at a hospital or GP’s surgery for medical treatment; the data was being transferred to a private company for reasons that were not within the concept of direct care; no expressed or implied consent was given to this; the effect was that person in question lost control over a part of their medical records; and the purposes of doing so were not confined to the detection of AKI via the Streams app, but were as identified in the ISA and subsequently the MOU (paras 26 and 46 - 47 above).

Before coming to my overall conclusions I will address a number of specific points that arose from the parties’ submissions.

I have already explained that Mr Pitt-Payne KC submitted that a distinction of principle existed between information about a person’s health in general and information that was generated in the course of the doctor – patient relationship (para 77 above). He said that whilst there might be situations in which the former did not give rise to a reasonable expectation of privacy, for example where the information was anodyne or already in the public domain, information in the latter category always gave rise to a reasonable expectation of privacy (save in relation to direct care) because of the fundamental importance of confidentiality to the doctor – patient relationship. I will refer to this as Mr Pitt-Payne KC’s “medical records submission”.

Mr Pitt-Payne KC relied upon the passage in para 95 of the ECtHR’s judgment in Z v Finland (para 71 above) as highlighting the importance of preserving confidence in the medical profession and the health services. He said that the authorities I have summarised at paras 72 - 75 above were not inconsistent with the distinction that he advanced as they were either concerned with health information that did not arise from the doctor – patient relationship (for example, Campbell) or the judicial observations were obiter dicta in circumstances that were distinct from the present case (ZC and Underwood). He also referred me to a number of materials that he said underscored the importance attached to the confidentiality of medical records and the protection that is afforded to them. I summarise those materials in the next few paragraphs.

Mr Pitt-Payne KC referred to the six general principles identified at para 4.3.2 of The Caldicott Committee’s December 1997 “Report on the Review of Patient-Identifiable Information”. He said that he relied upon the general context rather than the specifics of a particular principle; namely the importance attached to the restricted dissemination of patient-identifiable information. The NHS Code of Practice on Confidentiality (November 2003) provided that the Caldicott Principles should be followed (page 20). The six principles were summarised in that document as: (i) Justify the purpose; (ii) Don’t use patient identifiable information unless it is absolutely necessary; (iii) Use the minimum necessary patient identifiable information; (iv) Access to patient identifiable information should be on a strict need to know basis; (v) Everyone should be aware of their responsibilities; (vi) Understand and comply with the law.

The GMC’s guidance on Confidentiality (October 2009) referred to patients having, “a right to expect that information about them will be held in confidence by their doctors” (page 4). In terms of the circumstances where patients may give implied consent to disclosure, the guidance said:

“25.

Most patients understand and accept that information must be shared within the healthcare team in order to provide their care. You should make sure information is readily available to patients explaining that, unless they object, personal information about them will be shared within the healthcare team, including administrative and other staff who support the provision of their care.”

The guidance also advised that, as “a general rule, you should seek a patient’s consent before disclosing identifiable information for purposes other than the provision of their care or local clinical audit...”.

The March 2013 Information Governance Review (also known as “the Caldicott Review” and “Caldicott 2”) acknowledged that most people who used health and social care services accepted and expected that doctors, nurses and other professionals would need to share their personal confidential data in order to provide optimum care (para 3.2), so that:

“...There is in effect an unwritten agreement between the individual and the professionals who provide the care that allows this sharing to take place...the health and social care professional is able to rely on ‘implied consent’ when sharing personal confidential data in the interests of direct care, as long as the patient does not object, or has not already done so...”

The Review Panel proposed a revised definition of implied consent as follows:

“Implied consent is applicable only within the context of direct care of individuals. It refers to instances where the consent of the individual patient can be implied without having to make any positive action, such as giving their verbal agreement for a specific aspect of sharing information to proceed...”

The September 2013 Government Response broadly accepted the recommendations of the Caldicott Review, including these aspects.

I have already referred to the concept of direct care as explained in the GMC’s “Confidentiality: good practice in handling patient information” (2017) (para 78 above). Paragraph 9 identified confidentiality as an important ethical and legal duty, but noted that it is not absolute. Paragraph 14 addressed the circumstances in which medical information may be disclosed on the basis of implied consent, including for the purposes of direct care, which is considered in further detail at para 28.

Mr Pitt-Payne KC also referred to the safeguards that apply to health records under the Investigatory Powers Act 2016 (section 206); to the definition of “sensitive personal data” in section 2 DPA 1998 as including a person’s “physical or mental health or condition”; and to the particular protections for data concerning health in the UK General Data Protection Regulation (Article 4(15)).

I have carefully considered these materials. However, I reject Mr Pitt-Payne KC’s medical records submission; I do not accept that all patient-related information that is derived from the doctor – patient context inevitably gives rise to a reasonable expectation of privacy (outside of direct care situations). Where information of this nature is involved, I agree that it will be a highly relevant factor to take into account in applying the approach I have identified at para 67 above. But it does not follow that a reasonable expectation of privacy will always exist, irrespective of the circumstances and the content. I arrive at this conclusion for the following reasons:

Accordingly, the Representative Claimant is unable to overcome the need for individualised assessment by relying upon a proposition that a reasonable expectation of privacy will exist, or arguably exist, over all of the information contained in the class members’ transferred medical records (other than when used for direct care purposes) irrespective of the content and the circumstances.

Mr White KC submitted that some class members’ medical records will contain information that was already in the public domain and that this was a further variable that would impact on the existence or otherwise of a reasonable expectation of privacy. I have just referred to the example of a person choosing to place information about their medical condition and/or hospital visit on social media. In addition, the Defendants’ evidence includes examples of grateful patients publicising in the media the treatment that they were able to receive following the detection of AKI.

The fact that the information is already in the public domain may impact on whether there is a reasonable expectation of privacy; it is well established that this is a relevant circumstance to take into account (para 67 - 68 above).

Mr Pitt-Payne KC advanced two submissions in response to this point. His primary response was his medical records submission; he contended that a reasonable expectation of privacy will always exist in relation to medical records even if the information in question is already in the public domain. I have already rejected that submission. His alternative submission was that given the importance attached to the confidentiality of medical records, the fact that the contents, or some of them, were already in the public domain was a factor that, at most, could only carry such limited weight in terms of whether a reasonable expectation of privacy existed, that it could not take any claim in the Claimant Class below the viability threshold (“the fallback submission”).

I do not accept the fallback submission. Once it is (rightly) accepted that the extent to which the content is already in the public domain is a factor relevant to the question of whether a reasonable expectation of privacy exists (as Mr Pitt-Payne KC does for the purposes of his fallback submission), then either the variables inherent in the nature, degree and content of that publicity means that individualised assessment of each claim is required (so that a representative action is not possible), or if the claims are to be advanced on a global, irreducible minimum basis, then that irreducible minimum has to reflect a situation in which the patient identifiable information was already in the public domain in its entirety. This feature then has to be considered along with all the other relevant irreducible minimum circumstances to see if there is a realistic prospect of a reasonable expectation of privacy being established in those circumstances (para 166 below).

As identified in the Murray factors (para 67 above), the purposes for which the information came into the hands of the alleged wrongdoer is a relevant factor to take into account when considering whether there was a reasonable expectation of privacy. As I have foreshadowed, Mr Pitt-Payne KC relied upon the broader collaboration between the Royal Free and DeepMind envisaged in the September 2015 ISA and in the January 2016 MOU, going beyond the Streams app and aimed at positioning the Second Defendant as a leader in the evolving areas referred to and at enhancing the Defendants’ commercial prospects with NHS Trusts and other health-related organisations (paras 26 - 27 and 46 - 48 above). Mr White KC, on the other hand, submitted that the wider purposes were irrelevant as they did not come to fruition and no patient identifiable data was used in relation to those wider plans. As a secondary point, Mr White KC said it was not intended that patient-identifiable data would have been used at the development stage of these wider projects in any event (for example, in the “Real time clinical analytics, detection, diagnosis and decision support” referred to in clause 5 of the ISA), as opposed to in a clinical context once such tools had been developed. Mr Pitt-Payne KC, on the other hand, did not accept that this was clear from the documentation that was currently available.

In my view it is relevant to take account of the alleged wrongdoer’s purpose/s at the point when the MOPI is said to have occurred, since this is the event that is said to found the cause of action and a Defendant’s purpose at this juncture will likely be the reason for, or at least part of the reason for, the interference complained of. A later change of purpose may be relevant to any alleged subsequent interference and/or to the degree of the intrusion and thus to compensation. Accordingly, where the complaint concerns the transfer and the initial storage of the patient data, it is relevant to take into account the Defendants’ purposes for the data as they were at that stage, in deciding if there was a reasonable expectation of privacy. Equally, where the alleged interference relates to, for example, the way in which patient data was subsequently used in testing the Streams app, then it is the Defendants’ purpose/s for the data at that later juncture which it is relevant to consider in determining whether a reasonable expectation of privacy existed in respect of this. Thus, where an intended use of data did not in fact materialise post-transfer, then this would bear on the overall extent of the interference and the loss of control.

It is convenient to indicate at this stage that I do not consider that the Representative Claimant’s fourth alleged wrongful interference with patient identifiable data (para 3(iv) above) is capable of amounting to a free-standing instance of misuse of information. The usages of patient data that the Representative Claimant relies upon are those identified at paras 3(i) - (iii) above. I have just accepted that the Defendants’ purpose at each of those stages is relevant to whether a reasonable expectation of privacy then existed in the information. However, although there is some lack of clarity over the date when the Defendants’ plans changed (as Mr Pitt-Payne KC pointed out) the Representative Claimant does not identify any additional instance of wrongful use of the patient data and does not raise anything to gainsay or undermine the Defendants’ evidence that it was not used in any other way (paras 27 and 48 above).

The concept of direct care is relevant to the present inquiry because Mr White KC submitted that the Defendants’ use of the data came within this, so that the individuals in question gave their implied consent and no reasonable expectation of privacy could have arisen. Mr Pitt-Payne KC, on the other hand, contended that the concept of direct care only extended to the use of the Streams app from February 2017 once it was operational and that the usage of patient-identifiable information prior to this point entailed a series of discrete stages each of which went beyond direct care. (See also my summary of the Representative Claimant’s pleaded case regarding direct care at paras 18 - 20 above.)

Counsel have indicated that there is little caselaw on the parameters of direct care in the context of the tort of MOPI. I bear this in mind and I am also conscious that the question for me at this stage is whether the claim is bound to fail, not whether the Representative Claimant’s assertion that the usage complained of was outside the concept of direct care will succeed at a trial.

Whether a particular activity is capable of being regarded as direct care is relevant both to whether a reasonable expectation of privacy can be established and to whether a wrongful interference with the information can be shown. In short and for the reasons that I go on to identify, I consider that it is clear at this stage that some, but by no means all, of the Defendants’ alleged wrongful usage of the patient identifiable records comes within patient direct care.

Mr White KC submitted that certain consequences flowed from Mr Pitt-Payne KC’s concession that the use of patient data on the Streams app from February 2017 was within the concept of direct care. He pointed out that Mr Pitt-Payne KC had described the pre-February 2017 steps taken in relation to the data as “initial preparatory steps to the deployment of those treatments” via Streams; and he submitted that as the Streams app could not have been operational without this data, its transfer to the Second Defendant and the normalisation process was an integral step in the provision of direct care via the app, and that this was so whether the transfer occurred in October 2015 or at a time much closer to when the app became operational in February 2017.

There is force in this point. I conclude that a transfer of the data and its normalisation at a time when it was needed for the app to become operational would fall within the parameters of direct care for the reason that Mr White KC identified; the app could not provide (what was admittedly) direct care without these steps occurring. However, that is not what occurred in this case. I consider that the questions of whether there was a reasonable expectation of privacy, including whether the steps taken were part of direct care, should be judged by reference to the events that actually took place in 2015 - 2016. Furthermore, I consider that there is a realistic prospect of showing that a transfer of the patient records some 16 months or so before the app became operational for what at the time may have included the broader purposes identified in the ISA, was not for the purposes of patient direct care.

Additionally, and for similar reasons, there is a realistic prospect of showing that some of the period for which the data was then stored was not for the purposes of direct care. I note that the stage at which the transfer took place appears to have been largely a matter of convenience for the Royal Free and the Defendants (para 33 above). Whilst the delay may have been longer than was originally anticipated, the app development was still in progress at the time of the transfer (paras 38 - 39 above) and on the Defendants’ own case the patient data was not yet required for the app. There is a lack of clear evidence at this stage as to how long was actually required for each of the development and testing phases, the timing of those phases and the nature and causes of the delays that Dr Hughes briefly refers to. Furthermore, the evidence indicates that access to patient data was required for a period prior to the launch of the app for the side by side clinical safety and effectiveness training (paras 43 - 44 above). In light of this uncertainty, for present purposes, I will proceed on the basis of an assumption relatively favourable to the Representative Claimant, that the period of storage that arguably fell outside the scope of direct care is in the order of up to 12 months.

However, as I have already observed, the data would in any event have had to be transferred at some juncture prior to the operational phase of Streams and pre-loaded onto the app (the normalisation process) in order for it to function. As I consider that these integral steps would have come within the concept of direct care, this is clearly relevant to the level of intrusion and loss of control and thus to the measure of damages (para 175 below).

For completeness I address a further point that was raised in oral argument. Mr Pitt-Payne KC said that there were some individuals to whom the concept of direct care could not apply because they had already died prior to October 2015. However, this would be a small fraction of the 1.6 million plus people involved and plainly it is not a circumstance that is common to all or which assists in showing that every member of the class has a viable claim.

I turn to Mr Pitt-Payne KC’s third area of alleged misuse, described as “using the medical records in the research and development of the Streams app”. However, the Representative Claimant does not dispute or identify material that gainsays Dr Hughes’ account that all stages of testing prior to the on-site clinical safety and effectiveness testing used fictitious data, rather than real patient records (paras 41 - 43 above). The focus of this alleged interference is therefore limited to the clinical safety and effectiveness testing.

Mr White KC emphasised that the clinical safety and effectiveness testing did not relate to the development, deployment or integration of the app, all of which had already been undertaken using synthetic data, but simply to ensuring that the already developed app was usable in the environment of the Royal Free (paras 43 - 44 above). Furthermore, the patient identifiable medical records that were accessed during this phase of testing were those of a relatively small cohort of patients who attended the Royal Free’s renal team at the time for treatment and whose records were accessed via the pre-launch Streams, alongside their clinicians accessing the same records containing the same information via the Royal Free’s existing means for doing so (paras 43 - 44 above).

I accept the force of these submissions and thus conclude that the use of this limited cohort of data for the purpose I have referred to was clearly an aspect of direct care (and thus the subject of these patients’ implied consent).

In arriving at this conclusion I have had regard to the content of the NDG’s correspondence on the concept of direct care, in particular her letter of 21 August 2018 to the ICO, which Mr Pitt-Payne KC urged upon me. However, the NDG’s view appears to be based on a blanket proposition that as the Streams app “was going through testing and therefore could not be relied upon for patient care” prior to February 2017, the use of patient records could not be described as direct care. I consider that the position is more nuanced, not least in this very limited and particular situation described by Dr Hughes, which is not specifically referenced by the NDG.

The exact number of patients whose records were accessed via Streams as part of this phase of testing is not known (para 43 above). However, the conclusion I have expressed in paras 151 - 152 above would apply to the patients in question, whether it was 200 – 300 as Dr Hughes estimates, or a different figure.

In any event, the cohort of patients who were treated by the renal team during the period of this side by side testing is clearly a very small number relative to the entire Claimant Class. During oral argument, Mr Pitt-Payne KC fairly accepted that a claim with reasonable prospects of success in relation to this small number would not assist with the viability of the current representative action. Accordingly, his main contention in relation to the testing aspect of his case was based on the ICO’s documentation (para 55 above), which he said indicated that the safety and effectiveness testing involved the much larger cohort of all those whose data was transferred to DeepMind; or at least this was an arguable proposition that should be resolved at trial rather than dismissed at this stage.

I have carefully considered the ICO’s 3 July 2017 letter. The factual circumstances relied upon in relation to the conclusions then set out regarding the Royal Free’s breaches of data protection principles, appear to be those recorded in section “2.0 Summary of events”. This summary refers to the 2015 data transfer saying: “Our investigation has determined that the purpose of allowing DeepMind to process such information was to carry out clinical safety testing as part of the development of” the Streams app. The text continues that at the stage of the data transfer “it is understood that the data was processed for clinical safety testing and that the Streams application was not in active deployment”. Section 3.2 of the letter indicates that it was the Royal Free who, “has explained that the records processed by DeepMind were required for clinical safety testing”.

Accordingly, the ICO’s letter does not identify the various stages of the testing or the way in which real patient data was or was not used at each stage of that process. Thus there is nothing specific in this text which gainsays the account given by Dr Hughes as to what was done at each of those stages and the use of synthetic data. Nor does the ICO’s letter describe how patient identifiable data was used in the clinical safety and effectiveness testing, so that there is nothing in the letter that directly contradicts Dr Hughes’ explanation of the nature and extent of the use of patients’ medical records at this juncture (paras 43 - 44 above). It appears that the ICO proceeded on the basis that the full cohort of patient identifiable data relating to around 1.6 million people had been normalised by this point and thus was stored and available via the Streams app. However, for present purposes, that is a different point to the question of the extent to which such data was used and accessed during this testing phase. As the ICO’s conclusion provides no realistic basis for undermining Dr Hughes’ account in that regard, I conclude that I should proceed on the basis that the use of patient identifiable data in the clinical safety and effectiveness training was confined as he has described.

In turn it follows that the scenario relied upon in the Representative Claimant’s global, non-individualised approach must be one where the person’s data had been normalised and was accessible via Streams during this phase, but was not in fact accessed or used during the clinical safety and effectiveness training.

I have already considered the extent to which storage of patient data prior to the app becoming operational would come within the parameters of direct care (paras 146 - 148 above).

I have already explained that Mr Pitt-Payne KC accepted that in deciding whether there is a realistic prospect of establishing a reasonable expectation of privacy across the members of the Claimant Class, the variables that would give rise to a stronger claim for some individuals must be left out of account, as the action is pursued purely on the basis of the lowest common denominator factors that apply to all in the class. Additionally, because the question for me is whether every member of the class has a viable claim, circumstances that point against the existence of such an expectation or reduce the potency of the positive factors should be taken into account.

It also follows that the sheer fact that large numbers of people were involved in the events complained of does not strengthen the Representative Claimant’s position.

The definition of the Claimant Class is at para 6 above. The class member must have presented for treatment at any Royal Free hospital, clinic or other medical service within the material period prior to 29 September 2015; or have had their data included in the specified radiology electronic record system or in the biochemistry data in respect of blood tests on samples obtained at GP’s clinics. For present purposes I will focus on those who attended a hospital or other medical service, as this appears to be the largest cohort. The class will include those who only attended on one occasion during the relevant time, which Hughes 1 indicates was “not at all unusual”. Accordingly, proceeding by way of the lowest common denominator means that matters must be approached on that basis.

I have already summarised the nature of the data that was transferred (paras 28 - 29 and 34 - 35 above). The amount of data transferred would depend upon the hospital from which it came (para 34 above) and also upon the nature and extent of the person’s attendance. Hughes 1 emphasises the broad spectrum of variables in relation to the latter. This has not been challenged by the Representative Claimant. This spectrum will include those who attended a Royal Free hospital but ultimately did not see a clinician. Dr Hughes says that individuals “often” attended the Emergency Department and registered their attendance at the hospital’s reception, but then decided, perhaps after waiting some time, to leave without having been seen by a clinician. He explains that in these circumstances an HL7 message would be generated to record the person’s arrival at the hospital and that this would include some demographic information, but even the extent of this would vary depending (for example) on the patient’s degree of co-operation and/or their ability to speak English or otherwise communicate effectively. Accordingly, not every HL7 message would include the person’s address and sometimes incorrect names were given. An HL7 message might also be generated recording that the patient had been discharged as they had left the hospital. In addition, an admission message would record that the person had been admitted to the hospital and it could, but did not always, include a free text comment from the receptionist as to the nature of their complaint; a message could be in very general terms (for example, “unwell”) or could simply record that the individual was unwilling to divulge information to the receptionist. Mr Pitt-Payne KC’s rejoinder that a reasonable expectation of privacy would arise, or arguably arise, even in these instances was based on his medical records submission which I have rejected (paras 133 - 134 above).

Hughes 1 also indicates that even where an individual did see a clinician during their time at the hospital, this would not necessarily give rise to any further HL7 messages that were within the scope of the Defendants’ arrangements for data sharing that I have described at para 28 above. This would be the case, for example, if no relevant tests were ordered or no observations were recorded. Dr Hughes gave the example of a person attending with an infected tooth who is seen by a triage nurse and advised to visit a dentist.

By contrast, as Hughes 1 accepts, there will have been patients about whom “relatively large quantities of information were sent to Streams”, for example someone with a chronic renal condition who frequently attended the Royal Free. Their information would be likely to include detailed medical and, potentially, other personal information. However, at risk of labouring the point, this does not assist the Representative Claimant given that I must confine my assessment to the circumstances and information that would apply to all members of the class. For the same reason, the Representative Claimant is not assisted by the fact that the Linklaters report found that there was an average of over 100 HL7 messages for each patient.

Accordingly, in determining whether every member of the class has a realistic prospect of establishing a reasonable expectation of privacy in relation to the alleged misuse of their patient-related information by reference only to non-individualised circumstances, I conclude that I should proceed on the basis of the following irreducible minimum scenario:

For the avoidance of doubt, I have not taken into account a further feature emphasised by Mr White KC, namely that some of the Claimant Class subsequently benefitted from an AKI alert triggered by Streams after it was operational (para 54 above) in terms of the medical care that this led to. I consider there is force in Mr Pitt-Payne KC’s point that if a cause of action exists at the time of the alleged interference, it does not cease to be a cause of action as a result of later events of this nature, albeit they might impact upon an individualised assessment of damages.

Taking into account all aspects of the circumstances that I have identified, I conclude that each member of the Claimant Class does not have a realistic prospect of establishing a reasonable expectation of privacy in respect of their relevant medical records or of crossing the de minimis threshold in relation to such an expectation. I arrive at this conclusion given, in particular that on the applicable scenario I have identified: very limited information was transferred and stored; although health-related, it was anodyne in nature; this information was held securely and not accessed by anyone during the storage period; the information was already in the public domain; the alleged acts of interference outside of patient direct care were limited to the transfer of the data and to its secure storage for up to 12 months; and that this caused no impact other than the loss of control itself.

Accordingly, the claim as currently advanced on a global irreducible minimum basis in order to try and meet the “same interest” criterion for a representative action cannot succeed. It cannot be said that every member of the class across the board has a viable claim. Equally, departing from the lowest common denominator scenario and bringing into account individualised factors for the purposes of showing that a reasonable expectation of privacy exists in particular situations would mean that the “same interest” test was not met. Either way the claim is bound to fail.

It is unnecessary to address this point in any detail given the conclusion that I have expressed in relation to the prospects of every member of the Claimant Class establishing a reasonable expectation of privacy. I will summarise my conclusion briefly.

I have identified the alleged acts of misuse that are relied upon (paras 3 and 141 above). The Defendants do not dispute that the transfer and storage of data is capable of amounting to a misuse of private information (paras 79 - 80 above). They submit that there is no real prospect of the Court being satisfied in relation to every member of the Claimant Class, that the acts in question were unjustified so as to outweigh the alleged expectation of privacy in the information.

The scenario and factors that fall to be considered when assessing whether the interference was justified are those I have identified when addressing the prospects of all in the Claimant Class showing a reasonable expectation of privacy, including the extent to which the alleged interferences did or did not come within direct care. It is unnecessary to repeat that analysis. The only additional factor that arguably would be relevant at this stage of the analysis, is that the Defendants would be able to place a more general reliance on the objective of the Streams app and the beneficial outcomes that it achieved. Accordingly, I arrive at the same conclusion in relation to the prospects of the Representative Claimant being able to show on the irreducible minimum scenario that every member of the class experienced a wrongful interference with their data.

Strictly speaking the question of whether loss of control damages can be sought for all those in the Claimant Class on a lowest common denominator basis does not arise for consideration, as I have already concluded that not every member of this class has a realistic prospect of establishing a MOPI claim on the non-individualised basis that is relied upon. However, it will likely assist the parties if I also address the position in relation to the remedy sought of loss of control damages. As the Supreme Court did in Lloyd, I will assume, without deciding, that it is in principle possible to bring a damages claim on this basis (para 111 above).

Mr Pitt-Payne KC submitted that if the action cleared the hurdle of showing that every member of the Claimant Class had a more than de minimis MOPI claim with a reasonable prospect of success, it would also follow that every member of the class had a viable claim for more than nominal loss of control damages. That may be so, but the converse is also true. Again, the Court is considering matters by reference to the lowest common denominator and assessing whether every member of the class has a realistic prospect of attaining an award of non-trivial damages for a claim advanced on the lowest common denominator basis. As I have explained earlier, individualised factors that would point to a substantial award of compensation in particular circumstances must be left out of account.

Accordingly, the irreducible minimum of circumstances that I identified and discussed when I considered the prospects for establishing a reasonable expectation of privacy are also relevant to the question of loss of control damages (para 166 above). The only difference of potential significance that I can see is that in considering the extent of the loss of control (and thus the appropriate award to make), it would be appropriate to take into account the fact that a transfer of the data and its storage for the process of normalisation was in any event required before the app became operational (para 148 above). Accordingly, the transfer itself would not be reflected in the damages figure and the only compensatable loss of control element would be for the months during which the data was stored securely by the Second Defendant before it was needed for use with the app. Taking this with the features I have already identified and considered at paras 166 and 168 above, I do not consider that there is a realistic prospect of the Representative Claimant achieving more than nominal damages for loss of control in relation to each member of the class.

It therefore follows that the representative action in its current form is unsustainable for reasons analogous to the second conclusion in Lloyd (paras 92, 100 and 114 above). Approaching matters on a lowest common denominator basis and leaving individualised factors out of account, it cannot be said of any member of the Claimant Class that they have a viable claim for an entitlement to more than trivial damages.

I have already explained why I reject Mr Pitt-Payne KC’s submission that the difficulties presented by pursuing the damages claim on a non-individualised basis is simply a factor to consider in the exercise of the Court’s discretion (paras 112 - 113 above). The need for individual assessment of the damages recoverable by those in the represented class in order to establish an entitlement to more than nominal compensation, precludes loss of control damages being pursued by a representative action.

Whilst stressing that I would have reached the conclusion that I have just expressed in any event, I note Mr White KC’s observation that Mr Pitt-Payne KC has chosen not to indicate, even with rough parameters, what would be an appropriate figure for loss of control damages, calculated on a lowest common denominator basis, to which each member of the Claimant Class would be entitled. Mr White KC suggests that this is because it is apparent that a realistic figure would be for no more than a de minimis sum.

The Representative Claimant submits that even if it appears at this stage that the claim has no realistic prospect of success, I should permit it to proceed, given the current areas of evidential uncertainty. I do not accept that this provides a “compelling reason” in the circumstances. I have taken into account the areas that the Representative Claimant relies upon and the extent to which there is reason to believe (as opposed to merely speculate) that the position may be relevantly improved by the time of a trial, which is to say in a way that overcomes the difficulties for the Representative Claimant that I have identified.

I will address specifically the aspects identified in this regard at para 95 of Mr Pitt-Payne KC’s skeleton argument:

As I have noted at para 65 above, it does not follow automatically from my conclusion that the claim as currently formulated has no realistic prospect of success, that the pleadings should be struck out and summary judgment entered for the Defendants. The Representative Claimant asks that I permit him an opportunity to consider the Court’s judgment and to submit an amended version of the current claim.

The Defendants object to such a course. Firstly, Mr White KC points out that there is no amended pleading before the Court and that permission to amend should only be granted where a draft pleading has been provided, which the other party and the Court has the opportunity to consider. I agree with this as a general rule, all the more so in a relatively complex claim such as the present one. However, the Representative Claimant is not asking me to grant a blank slate permission to amend at this juncture, he is asking for an opportunity to provide an amended version of the claim before I decide whether to strike out his pleadings and give summary judgment.

This is essentially a case management decision in relation to which I have had regard to the overriding objective and all of the circumstances of the claim set out in this judgment (which I do not repeat).

There are a number of factors that the Representative Claimant prays in aid in particular: that the claim was formulated at a time when the available information was much more limited than it now is following the Defendants’ service of evidence in support of their applications; striking out a claim is a draconian step and there may be specific difficulties, in particular in terms of limitation, in bringing a new claim; at least those in the class who had more substantial medical records transferred would have viable claims and (as was recognised for example in Marks), if that narrower group of individuals can be assisted to access the Court then that is better than simply striking out the claim of the whole class; it ought to be possible to identify a viable claim on behalf of a narrower class; and Lord Leggatt in Lloyd recognised the importance of flexibility.

I have carefully considered all of these points. However, I have concluded that, on balance, the interests of justice indicate that I should strike out the claim form and the particulars of claim and give summary judgment in favour of the Defendants at this stage. My reasons are as follows:

I am not concerned with whether some of those whose medical records were transferred to DeepMind in 2015 would have a viable claim in MOPI if their individual circumstances were taken into account. As I have explained, Mr Pitt-Payne KC accepts that pursuit of a representative action under CPR 19.8 on behalf of the large numbers of people whose data was transferred requires the Representative Claimant to leave their individualised aspects out of account and to pursue the claim on the basis of the lowest common denominator of circumstances that apply to the class members. He also accepts that, judged on the basis of those circumstances, it is necessary for there to be a realistic prospect of establishing the ingredients of the cause of action, in particular a reasonable expectation of privacy, across the members of the represented class and of recovery of non-trivial awards of damages for loss of control of the information.

For the reasons that I have explained above, I have concluded that the Defendants have shown that:

The parties will be given an opportunity to make written submissions on consequential matters. I am very grateful for the assistance I received from counsel in this matter and the high quality of their submissions.