Google DeepMind’s Access to 1.6m NHS Records Was ‘Inappropriate’

Google’s access to 1.6 million NHS patient records has been criticised as “legally inappropriate” by Dame Fiona Caldicott, the head of the UK’s Department of Health National Data Guardian. In a leaked letter, Caldicott said that patients should have been asked to explicitly consent to the data sharing. Google has previously refuted the claims.

The arrangement between the NHS and DeepMind, Google’s forward-thinking artificial intelligence company, has been under scrutiny for several months. In a report today, Sky News published comments made by Caldicott that will be submitted to the wider government investigation. In the letter, the UK’s most senior data protection advisor expresses concern at how and why DeepMind gained access to the data.

The investigation centres on the partnership between DeepMind and the Royal Free Hospital Trust in London. Under the terms of the agreement, DeepMind can collect data from patients to use while testing Streams, a new app for detecting acute kidney disease.

The app itself has been welcomed by nurses within the NHS. A representative of the Royal Free London told the BBC that Streams is saving nurses “hours every day.” It helps to alert clinical staff to changes in a patient’s condition within seconds, giving a better chance of successful treatment.

Streams’ access to NHS data hasn’t been so popular. Under UK law, patient data can only be shared with third parties for the purpose of “direct care.” As testing a new app doesn’t qualify for this, DeepMind seems to have fallen short of the rules.

Many of the 1.6 million records within the dataset are from patients who do not have kidney problems. Google never asked for consent to access the data. The company has previously stated that “implicit consent” was given.

Caldicott’s letter indicates the investigation is unlikely to side with Google’s viewpoint. She has already submitted evidence to the Information Commissioner’s Office (ICO), the body which will ultimately decide whether the agreement conforms to the regulations of the Data Protection Act.

In December, she told the Royal Free and DeepMind that implied consent was not an “appropriate legal basis” for the data sharing. Writing in the letter, she clarified her position on the matter, stating DeepMind should have acquired explicit consent from patients.

“My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose,” Caldicott wrote.

The investigation is not disputing the potential value of Streams to clinicians and patients. It’s focusing on establishing a common legal ground for hospitals and internet companies to ethically exchange data, creating clear procedures for future sharing initiatives. Commenting to The Independent, a Royal Free representative admitted there should be “more public engagement and discussion” about the use of technology and patient data inside the NHS.

There are currently no serious suggestions that Google is intentionally harvesting data for unethical purposes. Instead, the failings have been attributed to a lack of structure in the UK healthcare system that prevents data sharing relationships from being responsibly agreed. The debate and public criticism of the link between the Royal Free and DeepMind will serve as a wake-up call to the NHS and industry providers. More transparency will be required before future initiatives are negotiated.

For its part, DeepMind has repeatedly stated it is a British company which “operates independently” despite having been acquired by Google. Although the debate is more concerned with the ethics of the arrangement, the company has stressed that DeepMind data isn’t available to other Google businesses.

“At no point has any patient data been shared with other Google products or services, or used for commercial purposes,” a spokesperson said to Sky News.

“I think one thing that we do recognise that we could have done better is make sure that the public are really informed about how their data is used.”

In an attempt to show its commitment to responsible data access, DeepMind has already put in place new measures that address some of the criticisms of its arrangement with the Royal Free. The details of all its legal agreements have been published on the company’s website. Additionally, its access and use of the files it is given will now be reviewed by nine independent advisers that have been hired by DeepMind to increase its transparency and accountability.

[Featured Image by Google]