A proposed legal claim announced in October 2021 returned attention to one of Britain’s most important early controversies involving health data and artificial intelligence. The action concerned records belonging to about 1.6 million patients that the Royal Free London NHS Foundation Trust shared with Google’s DeepMind in 2015.
The data supported development of Streams, an application designed to help clinicians identify acute kidney injury. The clinical objective was valuable, but regulators later concluded that the hospital had not done enough to inform patients about how their information would be used. The episode became a lasting case study in why beneficial intentions do not remove privacy obligations.
A Large Dataset Supported a Clinical Alert Tool
Streams analysed test results and alerted medical staff to signs of acute kidney injury, a serious condition that can deteriorate quickly. To develop and operate the service, DeepMind received a broad set of identifiable patient records from the Royal Free, not only data from people already known to have the condition.
The hospital argued that the arrangement was part of direct patient care. Critics questioned whether patients could reasonably expect their records to be transferred to a technology company for development of a new digital system.
Scale made the distinction consequential. Health organisations routinely use information to coordinate treatment, but developing software across an entire hospital population can feel different from a clinician accessing the file of a person currently under their care.
The Regulator Found Shortcomings
In 2017, the UK Information Commissioner’s Office concluded that the Royal Free had failed to comply with data-protection law when it provided the data. The regulator identified problems with the legal basis, transparency and impact assessment surrounding the project.
The finding did not say that digital alerts were inherently inappropriate. It said innovation had to occur within the same accountability framework as other uses of sensitive health information. The hospital was required to improve its processes and provide evidence of compliance.
This distinction remains important. A technically effective system can still be deployed through an unacceptable data arrangement. Clinical benefit and lawful governance are separate tests, and a health service must satisfy both.
The Claim Focused on Patient Control
The representative action was brought on behalf of affected patients by Andrew Prismall, with legal support from Mishcon de Reya. It sought compensation for the alleged misuse of private information. The claim used an opt-out structure, meaning eligible patients would be included unless they chose not to participate.
Group actions can make privacy cases viable where the alleged harm to each individual is difficult or costly to pursue alone. They also raise complex questions about whether every member experienced the same loss of control and how damages should be measured without proof of financial loss.
Whatever the eventual legal outcome, the action showed that data governance failures could create consequences years after a pilot ended. Partnerships need defensible decisions from the beginning, not explanations assembled after public concern emerges.
Consent Was Not the Only Possible Basis
Public discussion often reduces health-data questions to consent, but healthcare systems may rely on other lawful grounds when information is necessary for care or public functions. Explicitly asking every patient is not always practical, and refusing permission cannot always determine how hospitals deliver essential services.
That does not eliminate the need for transparency and proportionality. Patients should be able to understand who receives their information, why the access is necessary, how long data is retained and what safeguards apply. Uses for research, product development and direct care should not be blurred together.
Strong governance also includes minimisation. Teams should receive only the fields and population required for the defined purpose, with independent review of whether identifiable data is genuinely necessary.
Trust Was a Clinical Asset
Health AI depends on representative data. If patients fear that information will move invisibly between institutions and companies, they may become less willing to share details or participate in research. A loss of trust can therefore weaken both care and innovation.
Technology suppliers carry responsibilities even when a hospital is the formal data controller. They can design systems for limited access, detailed auditing and deletion, and they can challenge arrangements that appear broader than the product requires.
The DeepMind and Royal Free controversy was not an argument against applying AI to urgent medical problems. It demonstrated that public benefit is strongest when governance is designed alongside the technology. Clear purpose, lawful authority, patient communication and restrained access are not administrative obstacles; they are part of building a clinical system worthy of the data it uses.
