UK law firm files class action lawsuit over 2015 patient health data scandal involving Google-owned AI company DeepMind, after quietly passing medical information on over one million patients by an NHS Trust as part of an app development project.
Reya’s Mishcon Law Firm announcement the lawsuit today, claiming that a “legal action” has been filed on behalf of a UK citizen called Mr Andrew Prismall and some 1.6 million others whose confidential medical records were obtained by DeepMind / Google without their knowledge or consent.
Google and the Royal Free NHS Trust have been contacted for comment on the lawsuit.
Last month, TechCrunch reported that Google was terminating the clinician support app, Streams, which was developed by DeepMind and the London-based Royal Free NHS Trust from 2015.
The Streams app has been rolled out for use by Royal Free clinicians and a handful of other NHS Trusts. However, the Royal Free was sanctioned in 2017 by the UK data protection watchdog, the ICO, for violating data protection rules when it transmitted sensitive medical information from patients to the company. owned by Google during the application development phase.
In a press release issued today, Mishcon de Reya described the lawsuit as an “important step in trying to address very real public concerns about large-scale access to private health data and its use by companies. technological “.
“It also raises questions regarding the precise status and responsibility of these tech companies in the data protection context, both in this specific case, and potentially more generally,” the firm added.
At the height of the COVID-19 crisis last year, the UK government signed a number of health data processing contracts with tech giants, including Google and Palantir – and those deals have also made the difference. subject of concern and criticism regarding a lack of transparency.
The government is also consulting on whether to lower the level of data protection afforded to UK citizens as it seeks to deviate from the European Union’s gold standard of privacy by design and by default, set out in legislation such as the General Data Protection Regulation (GDPR).
In a statement explaining why he is taking legal action, Prismall said: “Given the very positive NHS experience I have always had with my various treatments, I was very concerned to find that a giant of technology had ended up with my confidential doctor.
“As a patient receiving medical treatment, the last thing you expect is your private medical records to be in the hands of one of the biggest tech companies in the world. I hope this case will help achieve a fair outcome and closure for all patients whose confidential records were obtained in this case without their knowledge or consent. “
Ben Lasserson, Mishcon Partner, who is leading the case, added: “This important statement should help answer fundamental questions about the handling of sensitive personal data and special category data. This comes at a time of heightened public interest and understandable concern about who has access to people’s personal data and medical records and how that access is managed.
A spokeswoman for Mishcon de Reya confirmed to us that she had brought the complaint to the UK High Court.
When asked if the plaintiff is claiming financial damages and / or deletion of the data, she replied that she was unable to provide more information at this early stage.
Most of the NHS Trusts that signed five-year agreements with DeepMind to use the Streams software – contracts that were then transferred to Google’s health division, after the company took over DeepMind Health in 2018 – have told us said they had terminated their agreements when we asked them about their use of the app last month, as it appeared Google was terminating the UK app following the announcement of ‘an internal reorganization of its healthcare efforts.
However, the Royal Free Trust has claimed that it will continue to use Streams, despite Google announcing the withdrawal of support, raising questions about how the Trust will ensure that the security of the app is maintained at day and which divisions within Google would be responsible for handling related SLAs, going forward, after the tech giant’s internal reorganization of its health, wellness, and AI efforts. .
Update: Google declined to comment at this time, but a spokesperson confirmed it was aware of the lawsuit.
The company added that no claim form has been officially served, but said once it gets it, it will look into it in more detail.
The tech giant also told us about a third-party audit by Linklaters on the data processing agreement between Royal Free and DeepMind – under the ICO regulation – which it said found that Streams’ use by Royal Free was legal and data compliant. protective laws. However, this third-party audit did not examine the original data processing arrangement – which was the one sanctioned by the ICO – looking only at a replacement agreement, not the historic misstep, as we had. reported at the time, so it is essentially irrelevant to the legal question. raised by this lawsuit.