Court rejects appeal in data privacy class action against Google

A court has rejected an appeal against a decision to throw out a data privacy class action against Google and its AI subsidiary, DeepMind.

Law firm Mishcon de Reya brought a class action lawsuit in 2022 against Google and DeepMind over allegations the two businesses misused UK patients’ medical records while working with London’s Royal Free Hospital.

The legal action stems from a 2015 deal Google made with the Royal Free Hospital. In this deal, Google exchanged patient data for discounted use of a smartphone app developed by DeepMind designed to prevent deaths from acute kidney injuries.

The deal saw the Royal Free Hospital hand over 1.6m historical medical records from patients who had passed through the London NHS Trust, which included information regarding drug overdoses, abortions, and diagnoses of HIV.

However, there were several inquiries into the legality of the data use.

The UK’s information watchdog, the Information Commissioner’s Office (ICO), said in 2017 that the Royal Free Hospital failed to comply with privacy laws as patients had not consented to their data being shared.

Despite that finding, the ICO refused to fine the hospital trust but instead told it to implement measures to improve transparency regarding the use of patient data.

The litigation was launched on the basis that the two businesses misused private information by obtaining and using medical records without patients’ consent. Former Royal Free patient Andrew Prismall is leading the case.

However, the case went to a hearing in March 2023 for after the tech giant applied for an application to strike out the case and sought a summary judgment on the basis that the claim had no prospect of succeeding.

The judge sided with Google in May 2023, ruling that the class members could not advance to trial, and granted the tech giant’s application to strike out and and allowed for a summary judgment.

The parties went back in court in October as the claimants sought to overturn that ruling.

However, on Wednesday, the Court of Appeal sided again with Google and DeepMind after it dismissed the claimant’s appeal against the order granting reverse summary judgment and striking out the claim.

Commenting on the decision, Kate Scott, partner at Clifford Chance explained: “The decision is consistent with the Supreme Court’s approach in Lloyd v Google: there remain significant procedural challenges to bringing data privacy class actions in the English High Court.”

“Many had speculated that claims involving more sensitive medical data might have better prospects as an opt-out class action – which now appears misplaced. Individual claims, on their individual facts, can still be pursued. But will individual damages be significant enough to make that worthwhile?”

“The Court of Appeal recognised the reasonable expectation of privacy for any patient identifiable records in medical notes, but indicated that it does not apply automatically to every medical note, and that each claimant’s position will be fact specific.”

“Those circumstances will affect whether there is a reasonable expectation of privacy for each claimant, meaning each member of the class cannot be said to have the same interest,” she added.

While Ross McKenzie, partner at Addleshaw Goddard added “usually, an individual data protection claim will only give rise to a small amount of damages. A claim on behalf of large group where the damages could be multiplied – in this case 1.6 million – seemed the only way to financially motivate court action against big tech providers where private information is alleged to be mis-used.”

“The requirement to show the same interest across millions of people now seems challenging to ever achieve in a social media era where people have divergent views on what they treat their private information,” she added.