Google and DeepMind face claim for unauthorised NHS medical record use

A UK claimant, Mr Andrew Prismall, who is suing Google and its subsidiary DeepMind on behalf of 1.6 million NHS patients has laid out his legal argument in which he is seeking damages for the misuse of confidential medical records. The origin of the claim dates back to 2016, when it emerged that DeepMind had been transferred the NHS patients’ data as part of an app development project by the Royal Free NHS Trust in London, without the patients’ knowledge or consent.

By suing under the common law tort of misuse of private information, rather than using data protection legislation, Mr Prismall’s argument looks to circumvent the implications of the decision at the end of last year in Lloyd v Google (please see our analysis here), which effectively closed the floodgates on mass data breach claims, preventing data subjects from bringing mass claims for breach of data protection law without proof of actual loss. Significantly, the Lloyd v Google judgment did not deny that there were several avenues where the claimant, Richard Lloyd, could have succeeded, one of which was under a separate claim for misuse of private information.

As required under a claim in misuse of private information, Mr Prismall argument alleges that:

• he and the proposed claimant class had a “reasonable expectation of privacy”;
• Google and DeepMind deliberately obtained and used the information and they didn’t inform the claimants that their data had been shared;
• the transfer and use of the data wasn’t justified in a way that outweighed the reasonable expectation of privacy; and
• he and the proposed claimant class lost control of their data in a manner that is common across the entire claimant class (which means that each member of the class has the “same interest” and the claim could be considered as one if established).

It will be interesting to see whether Mr Prismall’s tort claim will become a viable alternative route for data subjects or whether it will lead to a further dampening of the data claims market, and even greater emphasis being placed on data subjects demonstrating material damage or distress on an individualised basis.