As a result government agencies have developed a set of legal requirements and contracts to be used when sharing such data. That still doesn't matter. If Royal

As a result government agencies have developed a set of legal requirements and contracts to be used when sharing such data. That still doesn't matter. If Royal Free shared personal health data with Deep Mind without the data subjects' explicit consent, and if the arrangement doesn't fall under other permitted conditions for processing sensitive personal data under the DPA, then someone is breaking the law. If there were not at least some legitimate grounds for concern about whether that is the case, it is unlikely that the ICO would have opened a formal investigation into the deal. Again, nothing written in any contract between the organisations involved supersedes our primary data protection legislation. As for standard processes for handling such situations developed by government agencies, another substantial part of the report was about how the various regulatory bodies do not seem to have been consulted in ways that would normally have been expected before starting a project of this nature. There is nothing routine, in the UK environment, about transferring complete, multi-year medical records for large numbers of identifiable individuals to external organisations not run by medical professionals for such open-ended purposes as those described in the agreement here. This is not a small thing.