Alphabet Inc, the parent company of Google and DeepMind, have acquired and processed over a million patient health records without consent in the UK and are now facing legal action. The law firm Mishcon de Reya announced that they are bringing a class-action claim against Google over the patient health data scandal.
Health records of around 1.6 million individuals were obtained by DeepMind in an effort to develop a patient monitoring app called Streams. DeepMind is a London AI lab that was acquired by Google in 2014 and it has previously signed a deal with the Royal Free London NHS Foundation Trust that gave DeepMind access to pseudonymised patient data. In 2017, the UK’s Information Commissioner Office ruled that this agreement failed to comply with data protection law. However, an audit of the data-sharing agreement that was conducted by magic circle law firm Linklaters found that the use of Streams was lawful and in line with data protection laws. This demonstrates the complexities of such data-sharing agreements that concern confidential health records.
It will be interesting to see the outcome of the legal class action brought against DeepMind as it will help achieve clarity for the legal position of obtaining confidential health records without patients’ consent. It is a way to address the very pressing concerns about large-scale access and use of individuals’ health data by tech companies.
It is not the first time that the NHS has been challenged for signing a controversial data agreement. Last year, the NHS has partnered with the US company, Palantir. One of the co-founders of the firm is Peter Thiel, a tech billionaire who was an early investor in DeepMind. Palantir has been widely criticised by privacy campaigners and the ‘No Palantir in Our NHS’ project was initiated. The NHS contract allows Palantir to manage the data which contains everybody’s health records for pandemic purposes. Even though the data passed to Palantir is pseudonymised, it is a reversible process which leaves scope for the re-identification of the data. Understandably, there are big concerns about the transfer of health records of millions of UK patients to tech companies that have a commercial interest in obtaining the data. The rulings of the class action lawsuit will help address these concerns, and solidify the future landscape of third party tech organisations obtaining patient data.
