LONDON — Alphabet’s Google and sister firm DeepMind are facing legal action for the way in which they obtained and processed over a million patient health records without consent in the U.K. 

British law firm Mishcon de Reya told CNBC Friday it had filed a claim with the High Court on behalf of Andrew Prismall and roughly 1.6 million other individuals whose medical records were obtained by DeepMind as part of an effort to develop a patient monitoring app called Streams.

“As a patient having any sort of medical treatment, the last thing you would expect is your private medical records to be in the hands of one of the world’s biggest technology companies,” said Prismall, who was a patient at the hospital where the Streams app was developed, in a statement.

“I hope that this case will help achieve a fair outcome and closure for all of the patients whose confidential records were obtained in this instance without their knowledge or consent,” he added.

DeepMind declined to comment when contacted by CNBC, while Google did not immediately respond.

DeepMind, a London artificial intelligence lab that was acquired by Google in 2014, found itself in the spotlight in 2016 when the New Scientist reported that its collaboration with the U.K.’s National Health Service went beyond what was publicly announced.

DeepMind and the Royal Free London NHS Foundation Trust signed a deal in 2015 that gave DeepMind access to pseudonymized patient data.

The U.K.’s Information Commissioner’s Office (ICO) ruled in 2017 that the data-sharing agreement between DeepMind and the NHS failed to comply with data protection law.

“Our investigation found a number of shortcomings in the way patient records were shared for this trial,” Information Commissioner Elizabeth Denham said in a statement at the time. “Patients would not have reasonably expected their information to have been used in this way.”

However, a later audit of the data-sharing agreement by law firm Linklaters concluded Royal Free London’s use of Streams was lawful and complied with data protection laws.

Mishcon Partner Ben Lasserson said in a statement that the planned lawsuit “should help to answer fundamental questions about the handling of sensitive personal data.”

He added that “it comes at a time of heightened public interest and understandable concern over who has access to people’s personal data and medical records and how this access is managed.”

Elsewhere, the NHS has also been criticized for signing a data-sharing agreement last year with U.S. company Palantir. The data analytics firm was co-founded by tech billionaire Peter Thiel who was an early investor in DeepMind.

Privacy campaigners and human rights activists cited ethical and moral concerns when they launched a campaign in June to try to stop Palantir from working with the NHS. Since its inception, the publicly listed company has worked with spy agencies, border forces and militaries, with the finer details of contracts often kept private.

Clive Lewis, a Labour Party member of the U.K.’s parliament and one of the campaign’s backers, accused Palantir of having an “appalling track record.” Palantir has declined to respond to these comments.

The “No Palantir in Our NHS” campaign comes after Palantir partnered with the NHS on a Covid-19 “Data Store,” which was designed to help the government and health service use data to monitor the spread of the virus.