\n<\/p>\n
Google has prevailed against another UK class-action style privacy lawsuit after a London court dismissed a lawsuit filed last year<\/a> against the tech giant and its AI division, DeepMind, which had sought compensation for misuse of NHS patients\u2019 medical records.<\/p>\n The decision underscores the hurdles facing class-action style compensation claims for privacy breaches in the UK.<\/p>\n The complainant had sought to bring a representative claim on behalf of the approximately 1.6 million individuals whose medical records were \u2014 starting in 2015 \u2014 passed to DeepMind without their knowledge or consent \u2014 seeking damages for unlawful use of patients\u2019 confidential medical data. The Google-owned AI firm had been engaged by the Royal Free NHS Trust which passed it patient data<\/a> to co-develop an app for detecting acute kidney injury. The UK\u2019s data protection watchdog later found the Trust had lacked a lawful basis for the processing<\/a>.<\/p>\n In a\u00a0judgement<\/a> issued today by the Royal Courts of Justice in London, Justice Heather Williams dismissed the case on the grounds that it did not meet the bar for bringing a representative action, which requires the claim to be based on general circumstances that apply to the entire class rather than on individual circumstances, finding therefore that the claim would be bound to fail.<\/p>\n The complainants had attempted to scale this legal wall by seeking only \u201clowest common denominator damages\u201d for each member of the claimed class \u2014 meaning they were suing for compensation calculated by considering \u201cthe irreducible minimum harm\u201d suffered by all members.<\/p>\n However even this lowered bar did not pass muster, as the justice identified \u201cmany relevant variables\u201d between members of the class and judged there to be overwhelming challenges to any attempt to redrawn the class to try to establish a viable claim \u2014 concluding there is \u201ca fundamental and inherent difficulty in identifying a viable claim for any class members if this claim is brought as a representative action on the basis of common circumstances\u201d.<\/p>\n The law firm representing claimant, Andrew Prismall, was contacted for comment but at press it had not responded.<\/p>\n A Google DeepMind spokesperson sent this statement welcoming the ruling: \u201cWe are pleased that the Court has decided to put an end to these proceedings. As we have argued, this claim is unfounded and without merit.\u201d<\/p>\n This is not the first time a class-action style privacy damages claims against Google has run aground in the UK.\u00a0Back in 2021<\/a>, the Supreme Court definitively blocked another representative action which had been brought by a consumer rights campaigner in relation to a workaround Google had allegedly applied to override iPhone users\u2019 privacy settings in Apple\u2019s Safari browser between 2011 and 2012.<\/p>\n An earlier attempt<\/a> by Prismall to bring a representative claim against Google and DeepMind under UK data protection law was abandoned following Google\u2019s aforementioned Supreme Court win. He then went on to refile the claim, under the common law tort of misuse of private information, only for that case to be dismissed today.<\/p>\n Bringing a legal claim for damages as an individual remains prohibitively expensive. So the lack of a clear route for UK citizens to pursue class-action style litigation over privacy harms means there are very limited options for them to obtain redress for misuse of their data.<\/p>\n Back in 2017, the UK\u2019s data protection watchdog did not even issue a financial penalty for the NHS Trust it found had unlawfully passed patients\u2019 records to DeepMind. Nor was the tech giant ordered to delete patients\u2019 data. And while Google subsequently went on \u2014 in 2021 \u2014 to decommission the app<\/a>, DeepMind had been able to ink deals with a number of NHS Trusts to use a piece of software developed using unlawfully processed personal data. So complaining to the national privacy regulator in the hopes it will meaningfully sanction rule breakers is no sure-fire route to successful outcomes for Brits either.<\/p>\n It\u2019s an increasingly different picture in the European Union where a Collective Redress Directive was passed back in 2020 that\u2019s due to enter into force next month. This law is aimed at bolstering consumer rights by making it easier for the bloc\u2019s citizens to bring representative actions and sue collectively over breaches of their rights.<\/p>\n Add to that, another incoming change to EU product liability rules<\/a> is intended to make it easier for people to sue for damages caused by software and AI systems, including for breaches of fundamental rights like privacy.<\/p>\n A recent judgement by the Court of Justice of the EU also established that the bloc\u2019s data protection framework does not set a threshold for harm for a breach compensation claim<\/a>.<\/p>\n<\/p><\/div>\n