In 2015 Royal Free NHS Trust in London signed a data-sharing agreement with Google. It shared data of 1.6m patients without their knowledge or consent. Google developed the Streams app to help identify the early signs of acute kidney injury. 

A year later the news broke and the ICO started investigating. In 2017 the ICO concluded that, while this arrangement could provide benefits, it wasn’t compliant with data protection laws. Google were in the clear as it was the Trust who had shared the data with them. But the Trust had to undertake to implement changes. In 2019 the ICO recognised that the Trust had completed all actions required. There were “no further outstanding concerns regarding the current processing of personal data within Streams”.

All good then? Well, not quite. In 2021 Andrew Prismall launched a “representative action” for compensation in the High Court on behalf of the 1.6m patients. The claim was against Google, not the Trust. Mr Prismall commented: “I was greatly concerned to find that a tech giant had ended up with my confidential medical records”. 

Health data is “special category” data under GDPR. This means it has higher standards for use and protection. There are concerns that the UK government is seeking to privatise the NHS – or outsource NHS data – by stealth. During the Covid pandemic in 2020, it entered into its own contracts with Google, Microsoft and others to share health data. Maybe this claim is not surprising therefore. 

Last year the Supreme Court blocked a similar representative claim against Google. Someone brought an action on behalf of 4m users over claims it secretly tracked iPhone users’ web browsing activity while telling them it was not. That claim failed because the claimant could not prove that the group he was representing “suffered any material damage or distress”. 

And now it seems Mr Prismall’s claim was also not successful. So he has started a new claim. A spokesperson for his lawyer said: “It’s correct that the previous claim was brought on the basis of a breach to (sic) the Data Protection Act and the new claim is being brought on a (sic) for misuse of private information…under common law”.

This is nicely vague. It’s the kind of thing you tell journalists and hope they don’t ask for more details. So we await developments. Will Google have to compensate 1.6m people? Or will this new case also fail? I suspect it will fail. Although not definitive in itself, the ICO didn’t take action against Google. In the meantime, Google has discontinued Streams anyway.

If you need advice, contact me f.jennings@teacherstern.com or +44 (0) 20 7611 2338.

This article first appeared on the Teacher Stern website.