<blockquote>The system PA uploaded your personal hospital records to is said to be Google BigQuery. It supports one-click database sharing with any other Google account, and is hosted on servers outside the UK (and possibly outside the EU, in breach of the EU Data Protection Directive). And what they uploaded was the entire shooting match—full personal medical records indexed by NHS patient number—with enough additional data (post code, address, date of birth, gender) to make de-anonymizing the records trivial.</blockquote>