DeepMind NHS Data Scandal: UK Class Action Lawsuit Filed

Legal Action Launched Over Patient Data Handling by DeepMind and NHS Trust

A U.K.-based legal firm has initiated a class-action lawsuit concerning a significant patient health data incident. The case originates from 2015 and centers on DeepMind, a company owned by Google, and its collaboration with an NHS Trust.

Details of the Claim

Mishcon de Reya, the law firm representing the claimants, announced the filing of a “representative action” today. This action is being brought forward on behalf of Mr. Andrew Prismall, a U.K. citizen, and approximately 1.6 million other individuals whose confidential medical records were accessed by DeepMind/Google without their explicit knowledge or consent.

Requests for comment have been directed to both Google and the Royal Free NHS Trust.

The Streams App and its Discontinuation

Recent reports from TechCrunch indicated that Google has decided to discontinue the Streams app. This clinician support application was jointly developed by DeepMind and the Royal Free NHS Trust, beginning in 2015.

Initially deployed at the Royal Free and several other NHS Trusts, the Streams app led to sanctions against the Royal Free in 2017. The U.K.’s data protection authority, the ICO, determined that the Trust had violated data protection regulations by sharing sensitive patient information with the Google-owned company during the app’s development.

Concerns Regarding Data Access and Usage

Mishcon de Reya characterized the lawsuit as a crucial step in addressing public anxieties surrounding the extensive access to and utilization of private health data by technology companies.

The firm further emphasized that the case raises important questions about the responsibilities and legal standing of these technology companies within the context of data protection, both in this specific instance and potentially on a broader scale.

Broader Context of Health Data Contracts

During the peak of the COVID-19 pandemic last year, the U.K. government entered into several contracts with major tech companies, including Google and Palantir, for health data processing. These agreements also sparked debate and criticism due to a perceived lack of transparency.

Currently, the government is evaluating potential reductions in the level of data protection afforded to U.K. citizens. This consideration stems from a desire to move away from the stringent privacy standards established by the European Union, such as those outlined in the General Data Protection Regulation (GDPR).

Claimant’s Statement

Mr. Prismall explained his motivation for pursuing legal action: “Considering my consistently positive experiences with the NHS throughout my treatments, I was deeply troubled to learn that a technology giant had obtained my confidential medical records.”

He continued, “As a patient undergoing medical care, one would not anticipate their private medical information being held by one of the world’s largest technology corporations. I trust this case will contribute to a just resolution and provide closure for all patients whose confidential records were obtained without their awareness or permission.”

Legal Perspective

Ben Lasserson, a partner at Mishcon leading the case, stated: “This significant claim is poised to address fundamental questions concerning the handling of sensitive personal and special category data.”

He added, “It arises during a period of heightened public interest and legitimate concern regarding access to personal data and medical records, and how that access is managed.”

Current Status of the Lawsuit

A spokesperson for Mishcon de Reya confirmed that the claim has been filed with the U.K. High Court.

When questioned about the potential for financial damages or data deletion, the spokesperson indicated they were unable to provide further details at this preliminary stage.

NHS Trust Contracts and App Termination

Many NHS Trusts that had established five-year agreements with DeepMind for the Streams software – contracts that later transferred to Google’s health division following the 2018 acquisition of DeepMind Health – reported terminating their arrangements when questioned last month. This occurred as news emerged of Google’s decision to discontinue the U.K. app due to internal reorganization.

However, the Royal Free Trust asserted its intention to continue using Streams, despite Google’s announcement of support withdrawal. This decision raises concerns about maintaining the app’s security and identifying the Google divisions responsible for ongoing service level agreements following the company’s internal restructuring.

Google’s Response

Update: Google has declined to issue a comment at this time but confirmed awareness of the lawsuit.

The company stated that a formal claim form has not yet been served, but will be reviewed thoroughly once received.

Google also referenced a third-party audit conducted by Linklaters regarding the data processing arrangement between the Royal Free and DeepMind. This audit, conducted as part of the ICO settlement, reportedly found the Royal Free’s use of Streams to be lawful and compliant with data protection laws. However, it’s important to note that this audit focused on a replacement deal, not the original arrangement sanctioned by the ICO, and is therefore largely irrelevant to the current legal challenge.