The UK’s information commissioner has ruled that a Google DeepMind trial that used NHS data ran afoul of the country’s privacy laws.
Google was provided with data on 1.6 million patients for the trial, which was intended to test mobile alert, diagnosis and detection system for acute kidney injury dubbed Streams, the Information Commissioner’s Office (ICO) said.
“There’s no doubt the huge potential that creative use of data could have on patient care and clinical improvements, but the price of innovation does not need to be the erosion of fundamental privacy rights,” Information Commissioner Elizabeth Denham said.
“Our investigation found a number of shortcomings in the way patient records were shared for this trial.”
Patients would not have reasonably expected their information to have been used in this way, and the Royal Free NHS Foundation Trust, which provided the data, “could and should have been far more transparent with patients as to what was happening,” Denham said.
The commissioner has directed the Royal Free to take a number of steps including establishing a proper legal basis under the Data Protection Act for the project, conducting a privacy impact assessment and commissioning an audit of the trial.
An initial agreement for the Google NHS trial was signed in September 2015. Clinical testing of Streams was conducted in 2015 and 2016 ahead of a release in February 2017.
The app is currently being used in the UK health system. It delivers instant alerts and treatment information when test results indicate that a patient is at risk of becoming seriously ill.
“The ICO concluded that we had not done enough to inform patients that their information was being processed by DeepMind during the testing phase of the app,” a statement issued by Royal Free said.
“The ICO said there was a lack of transparency about how we were using patient information to test the new app and therefore patients could not exercise their statutory right to object to the processing of their information.”
“We welcome the ICO’s thoughtful resolution of this case, which we hope will guarantee the ongoing safe and legal handling of patient data for Streams,” said a statement on the DeepMind blog. The UK-based DeepMind Technologies Limited was acquired by Google in 2014.