A UK court throws out a case against Google concerning the transfer of 1.6M patients' data by an NHS trust to DeepMind in 2015 and its alleged misuse
Sam Tobin / Reuters :
Context & Ripple Effects
The dismissal closes a seven-year arc that began with a 2016 report finding Google had broader access to NHS patient records than publicly announced broader access than announced, followed by the National Data Guardian's 2017 finding that DeepMind received 1.6M patients' data on an inappropriate legal basis and the ICO's ruling that the original deal broke data protection law ICO ruling of non-compliance.
The court outcome does not erase that regulatory record — it rules only on the litigation route. The NHS's own response, pledging in 2018 to anonymize the blood-test data flowing to DeepMind anonymization pledge, had already become the operative fix.
First-order effects
- Google and DeepMind walk away from court liability over the 2015 transfer, though the ICO's 2017 finding that the deal failed to comply with data protection law stands untouched as the regulatory record.
- The claimant's litigation path against the NHS trust's data handover is closed, leaving regulators rather than judges as the venue where this transfer was ever found wanting.
Second-order effects
- NHS trusts weighing AI partnerships now price the risk as reputational and regulatory — an ICO finding and a National Data Guardian rebuke — rather than as courtroom exposure, which lowers the litigation deterrent that shaped the original backlash.
- Anonymization, the fix the NHS adopted for the DeepMind blood-test data in 2018, hardens into the default precondition for handing identifiable records to tech firms.
Third-order effects
- If the pattern holds, UK health-data disputes resolve through the regulator and governance conditions rather than private litigation, structuring future NHS–tech deals around upfront compliance and de-identification instead of after-the-fact court challenges.
The trend: UK health-data partnerships with tech firms are shifting from litigation-contested transfers to regulator-enforced, anonymization-first arrangements — with the courts increasingly declining to relitigate what the ICO already ruled on.