Google is facing a new class-action style lawsuit in the UK in relation to a health data scandal that broke back in 2016, when it emerged that its AI division, DeepMind, had been passed data on more than a million patients as part of an app development project by the Royal Free NHS Trust in London — without the patients’ knowledge or consent.
The Trust was later sanctioned by the UK’s data protection watchdog which found, in mid 2017, that it had breached uk data protection law when it signed the 2015 data-sharing deal with DeepMind. However the tech firm — which had been engaged by the Trust to help develop an app wrapper for an NHS algorithm to alert clinicians to the early signs of acute kidney injury (aka the Streams app) — avoided sanction since the Trust had been directly responsible for sending it the patients’ data.
So it’s interesting that this private litigation is targeting Google and DeepMind Technologies, several years later. (Albeit, if a claim seeking damages against one of the world’s most valuable companies prevails there is likely to be considerably more upside vs litigation aimed at a publicly funded healthcare Trust.)
Mishcon de Reya, the law firm that’s been engaged to represent the sole named claimant, a man called Andrew Prismall — who says he’s bringing the suit on behalf of approximately 1.6 million individuals whose records were passed to DeepMind — said the litigation will seek damages for unlawful use of patients’ confidential medical records. The claim is being brought in the High Court of Justice of England & Wales.
The law firm also confirmed that the Royal Free is not being sued.
“The claim is for Misuse of Private Information by Google and DeepMind. This is under common law,” a spokeswoman for Mishcon de Reya told us. “We can also confirm this is a damages claim.”
A similar claim, announced last September, was discontinued, according to the spokeswoman — who confirmed: “This is a new claim for the misuse of private information.”
In a statement on why he’s suing Google/DeepMind, Prismall said: “I hope that this case can achieve a fair outcome and closure for the many patients whose confidential records were — without the patients’ knowledge — obtained and used by these large tech companies.”
“This claim is particularly important as it should provide some much-needed clarity as to the proper parameters in which technology companies can be allowed to access and make use of private health information,” added Ben Lasserson, partner at Mishcon de Reya, in another supporting statement.
The firm notes that the litigation is being funded by a litigation finance agreement with Litigation Capital Management Ltd, a Sydney, Australia headquartered entity which it describes as an alternative asset manager specialising in dispute financing solutions internationally.
Google was contacted for comment on the new suit but at the time of writing the adtech giant had not responded.
There has been an uptake in class-action style litigations targeting tech giants over misuse of data in Europe, although a number have focused on trying to bring claims under data protection law.
One such case, a long-running consumer class action-style suit in the UK against Google related to a historic overriding of Safari users’ privacy settings, failed in the UK Supreme Court last year. However Prismall is (now) suing for damages under the common law tort of misuse of private information so the failure of that earlier UK case does not necessarily have strong relevance here.
It does appear to explain why the earlier suit was discontinued and a fresh one filed, though. “It’s correct that the previous claim was brought on the basis of a breach to the Data Protection Act and the new claim is being brought on a for misuse of private information,” Mishcon de Reya’s spokeswoman told us when we asked about this.
While the DeepMind NHS patient data scandal may seem like (very) old news, there was plenty of criticism of the regulatory response at the time — as the Trust itself did not face anything more than reputational damage.
It was not, for example, ordered to tell DeepMind to delete patient data — and DeepMind was able to carry on inking deals with other NHS Trusts to roll out the app despite it having been developed without a valid legal basis to use the patient data in the first place.
And while DeepMind had defended itself against privacy concerns attached to its adtech parent Google, claiming the latter would have no access to the sensitive medical data after the scandal broke, it subsequently handed off its health division to Google, in 2018, meaning the adtech giant directly took over the role of supplying and supporting the app for NHS Trusts and processing patients’ data… (Which may be why both Google and DeepMind Technologies are named in the suit.)
There was also the issue of the memorandum of understanding inked between DeepMind and the Royal Free which set out a five-year plan to build AI models using NHS patient data. Though DeepMind always claimed no patient data had been processed for AI.
In a further twist to the saga last summer, Google announced it would be shuttering the Streams app — which, at the time, was still being used by the Royal Free NHS Trust. The Trust claimed it would continue using the app despite Google announcing its intention to decommission it — raising questions over the security of patient data once support (e.g. security patching) got withdrawn by Google.
While the tech giant may have been hoping to put the whole saga behind it by quietly shuttering Streams it will now either have to defend itself in court, generating fresh publicity for the 2015 NHS data misuse scandal — or offer to settle in order to make the suit go away quietly. (And the litigation funders are, presumably, sniffing enough opportunity either way.)
The backlash against market-dominating tech giants continues to fuel other types of class-action style lawsuits. Earlier this year, for example, a major suit was launched against Facebook’s parent, Meta, seeking billions in damages for alleged abuse of UK competition law. But the jury is out on which — or whether — representative actions targeting tech giants’ data processing habits will prevail.