Google’s DeepMind slapped with data breach lawsuit

Google’s artificial intelligence (AI) subsidiary, DeepMind Technologies, has been hit with a class action suit over an alleged data breach of data protection laws.

UK law firm Mischon de Reya has filed a lawsuit against DeepMind on behalf of lead plaintiff Andrew Prismall and 1.6 million others whose personal records were accessed by DeepMind in collaboration with the UK’s National Health Service (NHS).

In 2015, DeepMind and the NHS announced that they were collaborating on an app called Streams. The app was made for clinicians treating kidney disease, and the plan was for the app to alert clinicians of patients’ test results when they showed that they were at risk of developing acute kidney injury.

When the data-sharing agreement was made public, it exposed the true amount of data DeepMind had access to: such as discharge and transfer, admissions, accidents, emergencies, critical care, pathology, and radiology data. The AI firm would also have access to five years’ worth of patient medical records without the patient’s knowledge or consent.

In 2017, “an ICO investigation found several shortcomings in how the data was handled, including that patients were not adequately informed that their data would be used as part of the test,” and the Information Commissioner’s Office (ICO) sanctioned the NHS for not complying with the UK’s Data Protection Act.

Consequently, Mischon de Reya announced that it would file a claim with the UK High Court. Ben Lasserson, leading the case, said: “This important claim should help to answer fundamental questions about the handling of sensitive personal data and special category data…It comes at a time of heightened public interest and understandable concern over who has access to people’s personal data and medical records and how this access is managed.”