Under the terms of the deal, Google’s DeepMind artificial intelligence subsidiary was handed the data of around 1.6 million patients of the Royal Free NHS Foundation Trust. The data was used to develop, test and trial a new AI-backed detection and diagnosis system for acute kidney injuries.
In a statement today, UK Information Commissioner Elizabeth Denham confirmed that the Royal Free Hospital and DeepMind made “a number of shortcomings” in the sharing and storage of personal data. Reflecting that there’s “huge potential” for data sharing to aid the medical industry, Denham said the approach used in the case of the Royal Free wasn’t aligned with fundamental privacy rights.
“Our investigation found a number of shortcomings in the way patient records were shared for this trial,” said Denham. Patients would not have reasonably expected their information to have been used in this way, and the Trust could and should have been far more transparent with patients as to what was happening.”
The experiment led to the creation of an app that can automatically review test results to identify known issues. If one is found, a clinician is immediately alerted, allowing the patient to receive priority treatment. It has been reported that the app, called Streams, has saved nurses up to two hours each day, giving more patients a chance of being seen.
The ICO has allowed the development and use of Streams to proceed, a decision the Royal Free said it was “pleased” with. Google has also commented on the ICO’s findings, admitting it “underestimated the complexity” of the NHS and the rules around accessing personal medical records.
“We welcome the ICO’s thoughtful resolution of this case, which we hope will guarantee the ongoing safe and legal handling of patient data for Streams,” said Google. “There’s a fine line between finding exciting new ways to improve care, and moving ahead of patients’ expectations. We know that we fell short at this when our work in health began, and we’ll keep listening and learning about how to get better at this,” the company added.
Today’s ruling will set a precedent for how future collaborations between the NHS and third-party data processors are run. The aim isn’t to prevent firms like Google from developing life-saving apps such as Streams. Instead, it constitutes an acceptance from all the involved parties that personal privacy must still be ensured.
The Royal Free has not been fined by the ICO. The hospital has pledged to make changes to the way it handles personal data in lieu of a more severe penalty. It will be able to continue its work with DeepMind while avoiding further privacy scares. The ICO has also told the hospital to more clearly define the legal basis for its trials with DeepMind and publicly audit the Streams experiment to assess its impact on privacy.