The scope for representative actions in the context of data claims has been of interest to many potential litigants since the decision of the Supreme Court in Lloyd v Google in 2021. In May 2023, the High Court released further guidance on representative actions in its judgment in Andrew Prismall v Google UK Limited & Ors [2023] EWHC 1169 concerning a claim for misuse of private information (MOPI).
Class actions
The Civil Procedure Rules (CPR) prescribe two procedures for class actions:
- A representative (or ‘opt out’) action under CPR 19.8(1) (formerly CPR 19.6, both referred to as Representative Action(s)), which allows a claim to be brought by or against one or more persons as representatives of others who have ‘the same interest’.
- A group litigation order (or ‘opt in’ action) under CPR 19.21/22 (GLO) concerning claims ‘which give rise to common or related issues of fact or law’.
An affected class of individuals will benefit from a Representative Action unless they opt out of the claim. In a GLO, an affected individual will must ‘opt in’ to benefit from the claim. Generally, Representative Actions are more appealing to affected individuals because of the reduced risks of an adverse costs order (amongst other reasons).
Recap of Lloyd v Google [2021] UKSC 50
The decision of the Supreme Court in Lloyd v Google is well publicised (see here). Mr Lloyd alleged that Google had secretly tracked the online activity of millions of Apple iPhone users in breach of its duties as a data controller under the 1998 Data Protection Act. He issued a Representative Action against Google on behalf of circa. 4 million individuals affected by the issue. A compensatory figure of £750 was advanced in respect of each individual, resulting in a potential damages order of £3 billion.
Mr Lloyd accepted that the Representative Action procedure could not be used if the compensation recoverable by each member of the class would have to be individually assessed. However, he argued that individual assessment was not necessary because compensation could be awarded for ‘loss of control’ of personal data without needing to prove that the member had suffered any financial loss or mental distress as a result of the breach.
The Supreme Court disagreed:
- Claims requiring an individualised assessment of damages for each member of the class are not suitable for a Representative Action – the interests are not the same and there could be a conflict of interest between members. Here, an individualised assessment of damages would be required as the effect of Google’s actions was not uniform across the represented class.
- In cases where damages would require individual assessment, a Representative Action could be brought to determine liability with separate claims for compensation thereafter.
The decision was seen as a blow for those pursuing Representative Actions and many claims were discontinued.
Commission Recovery Ltd v Marks & Clerk LLP & Anor [2023] EWHC 398 (Comm)
Representative Actions were considered by the High Court earlier this year in the context of a claim regarding secret commissions. Notwithstanding that the members of the action had different claims and remedies, the claim was allowed to proceed on the following grounds:
- The ‘same interest’ test does not require claimants to have identical claims or interests. The key consideration is whether there would exist a conflict of interest between the class, or any prejudice to the class, should the claim proceed by way of a Representative Action.
- A claim for secret commission was a reasonable example of a claim in which damages could be assessed on a common basis.
Whilst this decision did not concern data claims, it suggested that the courts may be more willing to allow Representative Actions to proceed with the judge noting that there was a case for further development of this area of law.
The Andrew Prismall case
The case concerned the transfer of patient identifiable medical records to DeepMind (a Google group company). This transfer of personal data was carried out for the purposes of an app known as Streams, which was designed to assist clinicians to identify and treat patients potentially suffering from acute kidney injury. DeepMind was provided with updates to the medical records of the patients thereafter.
One of the affected patients, Mr Prismall (the claimant), sought to bring a Representative Action on behalf of approximately 1.6 million individuals alleging that the transfer and use of the data in Streams without specific patient consent was a MOPI. His Representative Action for breach of data protection legislation was discontinued following the decision in Lloyd v Google.
Google applied to strike out/for summary judgment of the Representative Claim. The key arguments were as follows:
- Google argued that members of the class would not have the ‘same interest’ as their circumstances were so varied, meaning Mr Prismall had no real prospect of establishing that the MOPI tort had been committed against all members of the class. Indeed, some members of the class did not have any viable claim. Whilst Mr Prismall accepted that there were varied circumstances (and defences to some of the claims), he stated that there was no conflict of interest between the members of the class.
- The compensation sought by Mr Prismall was calculated by reference to the minimum harm suffered by all members of the class. Google argued that it could not be said that all members of the claimant group had a viable claim for more than trivial damages. Mr Prismall’s position was that the entire class had a claim for non-trivial damages and the claim had been advanced on the ‘lowest common denominator’ only in acknowledgement of the fact that recovery of individualised damages could not be pursued as a Representative Action.
The court struck out the claim and entered summary judgment for Google for the following key reasons:
- As per Lloyd v Google, if an individualised assessment of damages is required in relation to members of a proposed class, a Representative Action for damages should not be pursued.
- The existence of a defence for some members of the class, but not others, did not preclude the ‘same interest’ test from being met providing there was no conflict of interest. It is not appropriate to raise arguments on behalf of some class members which may prejudice other class members.
- Damages for loss of control did not always require an individualised assessment of damages. However, reducing the claim to damages for loss of control would result in a trivial level of damages and the claim was struck out accordingly.
- Claims for MOPI are individualistic in nature. Stripping out individual factors and reducing the claim to the lowest common denominator meant that the claim did not cross the de minimis threshold.
The future of Representative Actions
- The Andrew Prismall judgment highlights the problems faced by potential claimants looking to pursue a Representative Action for data claims. As the judge commented: “The difficulties that the Representative Claimant faces are inherent in seeking to bring this claim as a representative action when necessary components of establishing both liability and the remedy sought (a reasonable expectation of privacy and loss of control damages) would usually be assessed on an individualised basis…”. Potential claimants will need to consider carefully the nature of the claim to be advanced and the rights of, and impact, on the affected class.
- The decision also indicates the court’s willingness to exercise their powers to strike out/give summary judgment in claims which do not meet the relevant de minimis thresholds before substantive costs are incurred by the parties. This will be encouraging to any defendant on the receiving end of ‘have a go’ data claims.
Should you wish to discuss this topic further, then please do not hesitate to contact Hill Dickinson’s Commercial Litigation team who advise regularly in this area.
For further information, please contact:
Kate Steele, Partner, Hill Dickinson
kate.steele@hilldickinson.com
