UK's National Data Guardian says Google's DeepMind received 1.6M NHS patients' data on an “inappropriate legal basis”
Google's artificial intelligence arm received the personally identifying medical records of 1.6 million patients on an “inappropriate legal basis” …
Context & Ripple Effects
This verdict lands a year after a report found Google had been given broader access to patient data than publicly announced in the Royal Free NHS trust deal that fed DeepMind's acute kidney injury work. The National Data Guardian's judgment sharpens that concern into a legal one: the transfer of 1.6 million identifiable records rested on an inappropriate basis, not just an opaque one.
It matters because it sets up the enforcement sequence that followed — the data protection watchdog's formal ruling of non-compliance weeks later, the NHS's move to anonymize the blood-test data stream, and ultimately a court declining to hold Google liable for the original transfer.
First-order effects
- Google DeepMind and the Royal Free trust are directly implicated: the flagship NHS partnership that anchored DeepMind's health ambitions is now formally judged to have lacked a proper legal foundation for processing identifiable records.
- The National Data Guardian's finding hands the UK's data protection regulator a documented basis to act against the same deal rather than treat it as a governance dispute.
Second-order effects
- The watchdog proceeds to rule that DeepMind's first NHS deal failed to comply with data protection law, converting the Guardian's ethical-legal critique into regulatory findings.
- The NHS responds by committing to anonymize the data flowing to DeepMind for the kidney-injury analysis, shifting the burden of compliance onto how future transfers are engineered rather than on patient consent campaigns.
Third-order effects
- UK health-AI deals get restructured around explicit legal bases and de-identification by default, with trusts — not just vendors — carrying the accountability for what leaves their systems.
- When a court later throws out the case over the same 1.6M-record transfer, the split becomes structural: litigation fails, but the permission boundary set by regulators and oversight bodies still governs how NHS data reaches AI firms.
The trend: Public-health data partnerships with AI companies are being pushed from broad trust-level access toward narrowly scoped, anonymized transfers policed by dedicated data guardians and regulators.