Patient data were shared with Google on an “inappropriate legal basis,” says NHS data guardian