Google AI department sued for using the health data of 1.6 million NHS patients

A class-action lawsuit has been launched against DeepMind, the Google-owned AI research company, over its use of the personal records of 1.6 million patients from the UK's National Health Service (thanks, AI News). The health data was provided by the Royal Free London NHS Foundation Trust in 2015.

DeepMind is known for several achievements, not least kicking everyone's ass at Starcraft 2, but it was given the records in order to create a health app called Streams. This was supposed to be an AI-powered assistant to healthcare professionals and has been used by the UK NHS—but no more. This August it was announced that Streams is being decommissioned, and DeepMind's own 'health' section now returns a server error.

The handing-over of patient records to one of the world's biggest technology companies was exposed by New Scientist in 2017, in a report showing that DeepMind had access to far more data than had been publicly announced. The UK Information Commission launched an investigation that ruled the Royal Free hospital hadn't done enough to protect patients' privacy: following which, DeepMind apologised. "Our investigation found a number of shortcomings in the way patient records were shared for this trial," Information Commissioner Elizabeth Denham said at the time. "Patients would not have reasonably expected their information to have been used in this way."

The new suit has been launched by lead plaintiff Andrew Prismall, who was a patient at the Royal Free hospital, and includes approximately 1.6 million other affected patients on an 'opt-out' basis—that is, all parties will be included in the action unless they request otherwise.

"Given the very positive experience of the NHS that I have always had during my various treatments, I was greatly concerned to find that a tech giant had ended up with my confidential medical records," said Prismall in a statement.

"As a patient having any sort of medical treatment, the last thing you would expect is your private medical records to be in the hands of one of the world’s biggest technology companies. I hope that this case will help achieve a fair outcome and closure for all of the patients whose confidential records were obtained in this instance without their knowledge or consent."

Another wrinkle is that this comes at a time when the UK is looking to change its data protection regulations, following its exit from the European Union. The ruling Conservative party sees the EU's regulations as too strict and believes they stifle innovation in areas like this. "There’s an opportunity for us to set world-leading, gold standard data regulation which protects privacy, but does so in as light-touch a way as possible,” says culture secretary Oliver Dowden.

It is worth considering this in the wider context of the UK health service, which is something of political battleground when it comes to the topic of funding. The NHS operates on a principle of free healthcare at the point of use, and is funded by general taxation. Over recent decades it has made increasing use of privatised healthcare services in its provision, and the encroachment of the private sector into this public health system is a hot potato: for some it's an economic necessity and a question of choice, for others it's the slippery slope to an American-style healthcare system. If you want a current example of this, look at the campaign to stop big data firm Palantir partnering with the NHS.

So this has to be seen as part of that larger battle: a situation where the NHS was providing patient data to a private company, which was using it to build an app that it could then sell back to the NHS.

The case will explore crucial questions for our times, and is by no means as simple as DeepMind bad NHS good. DeepMind has undeniably made crucial scientific advances with things like AlphaFold, tools like it are part of the future of medicine, and they need to be trained on large data sets. At the same time individual privacy is a cornerstone of western society and, as Mr Prismall says, it is shocking to discover that a company the size of Google has had access to one's health data. Whatever the courts decide in this particular case, it's a topic we'll be discussing for decades to come.