On Monday, the United Kingdom’s Information Commission (ICO) ruled that the Royal Free NHS Foundation Trust had broken laws established in the Data Protection Act when, without notifying them, it handed over medical records of 1.6 million patients to Google’s DeepMind.
The sensitive data sharing was part of a deal made between the two companies to develop medical solutions with the power of artificial intelligence. More concretely, the Royal Free data batch shared with DeepMind resulted in the development of Streams, an app to detect patients with acute kidney injury.
All three organizations involved in Monday’s ruling issued statements expressing their desire to collaborate and overcome digital privacy issues. DeepMind and Royal Free promised to follow the guidelines from now on.
Google should know the result is not everything, the means are important too
The Royal Free NHS Foundation Trust struck a partnership with Google’s DeepMind more than two years ago for a trial program. It involved gathering data from patients who had or were potentially prone to suffer acute kidney injury (AKI) and develop a smart solution that helped save lives.
The result was the Streams app, which is an alert, diagnosis, and detection system integrated with the hospitals’ infrastructure. It sends instant notifications to doctors if it notices any changes that could be indicators of AKI.
At the time, the partnership was frowned upon by several due to the nonchalant circumstances under which 1.6 million medical records were seamlessly shared with a private entity. The ICO opened an investigation in May 2016, and it now has “found several shortcomings on how the data was handled.”
In essence, the issue many pointed out ended up being the driving force of Monday’s ruling: neither of the parties involved notified patients properly about the sharing of their private data nor about the purposes it would fulfill.
The ICO asked the Trust and the entities subscribed to the NHS to establish legal frameworks for partnerships like the one with Google’s DeepMind; stating how they will handle data privacy in such cases; ensure transparency in their procedures, and audit the trials with the ICO Commissioner’s involvement.
DeepMind admits it overlooked patients’ privacy
DeepMind has welcomed the insights of the Commission about what are still experimental trials. The AI division of Google wants to engage in more and more of these partnerships with other medical institutions, so any guidance is support for their cause.
As for the “illegal” nature of their activities, the ICO is only giving DeepMind a slap on the wrist and considering the whole thing an unintentional offense. In fact, the organization acknowledged the fact that it was too focused on fast technology implementation to stop and consider sensitive details like user privacy.
Google’s AI team is British and has enjoyed the benefits of the NHS. The developers and associates of the company just want to give something in return to the healthcare infrastructure with apps like Streams and more smart solutions that save more and more lives every day.