DeepMind's work with the NHS has been in the spotlight again this week after a regulator referred to one of the company's key partnerships with the NHS as legally inappropriate.
ADVERTISEMENT
Why Google DeepMind's work with the NHS is being investigated by the regulators (GOOG)
The AI research lab is working with several NHS trusts but its first NHS deal with the Royal Free London NHS Trust is proving to be the most troublesome.
DeepMind cofounder Mustafa Suleyman.
ADVERTISEMENT
Recommended articles
The Google-owned research lab is working with several NHS trusts but its first NHS deal with Royal Free London NHS Foundation Trust is proving to be the most troublesome.
The deal with The Royal Free was quietly signed in September 2015 and it gave DeepMind permission to process 1.6 million NHS patient records from November 2015 to November 2016. The records belong to patients that have visited Royal Free Hospital.
DeepMind said it needed access to the medical records to help it test its kidney monitoring mobile app, which is called Streams and has the potential to save lives by sending out alerts to clinicians when their patient's condition suddenly deteriorates.
ADVERTISEMENT
But medical records contain some of our most private information, including things like whether a person has had an abortion or what a person's HIV status is, as well as our full names and addresses.
DeepMind and The Royal Free have insisted from the beginning that the patient data is safe and that they're taking all the necessary precautions with it. DeepMind has also said on multiple occasions that the patient records cannot be seen by parent company Google and that they will not be passed onto a third party.
From day one, DeepMind and The Royal Free have also insisted that the deal is legally sound on the basis that the Streams app is providing "direct care" to patients — something that automatically assumes "implied consent" on the patient's behalf.
But the deals legal basis doesnt stand up
A letter leaked to Sky News and published on Monday shows that the National Data Guardian (NDG), Dame Fiona Caldicott, wrote to The Royal Free in February 2017 to let them know that the legal basis for the data-sharing deal that they used to test Streams was "inappropriate".
ADVERTISEMENT
"Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application may have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer," she wrote. "My considered opinion therefore remains that it would not have been within this reasonable expectation of patients that their records would have been shared for this purpose."
Those words can't have gone down well with execs at DeepMind or The Royal Free.
So if "direct care" wasn't the legal basis for the data-transfer deal then what was? DeepMind and The Royal Free are yet to specify another legal basis for their deal, possibly because it doesn't satisfy any of them.
Julia Powles, a technology law professor at Cornell University, told Business Insider: "Any other basis required approval in advance — and DeepMind had no such approvals."
The NDG highlighted in her letter that there is a gap in the current legislation on the legal bases for transferring NHS data and it looks as though DeepMind agrees. In a memo sent to DeepMind Health's review board that was seen by Business Insider, DeepMind agreed, saying the NDG's findings "exposed a guidance gap about how hospitals should test new systems."
ADVERTISEMENT
There are a number of other legal bases that data transfer deals between the NHS and a private company can fall under when identifiable patient information is involved. They include:
- Consent
- Section 251
- Public interest
- the government wrote
Jenny Westaway, a spokesperson for the NDG, told Business Insider: "There are other legal bases that could be used to share data if the right conditions are met but I don't want to give the impression by naming other legal bases that these are valid.
"If they (DeepMind and The Royal Free) are now seeking to suggest that another legal basis would have been viable, I think it's up to them to say what that legal basis is and how they met it."
The NDG is a non-statutory body (the bill to make it statutory failed this month) so it has no real power to issue any form of punishment. However, the Information Commissioner's Office (ICO), the UK's main data watchdog, is carrying out its own investigation into whether the deal was legal under the Data Protection Act and a verdict is expected to be made public in the coming weeks.
ADVERTISEMENT
It's likely that DeepMind and The Royal Free will try and hold off providing any further statements on the legal basis for their deal until that verdict is made public.
If the ICO concludes that the deal wasn't legal, then DeepMind and the Royal Free can expect some form of punishment, which will likely be issued in the form of a fine.
FOLLOW BUSINESS INSIDER AFRICA
ADVERTISEMENT
Recommended articles
Investor confidence in Nigeria dropped drastically over the last decade
J&J cough syrup recall widens as Tanzania, Rwanda, Zimbabwe join efforts
The Nigerian Naira goes from the worst-performing currency in the world to the best
Nigeria LNG Limited (NLNG) faces arbitration hurdles as Shell tables claims against Venture Global LNG over unsuppplied cargoes
African cities with the best quality of life index in Q1 2024
African countries with the most honorees in the 2024 Forbes Africa’s 30 under 30 list
Nigeria’s inflation hits 33.20% in March 2024- NBS
7 out of 10 Ugandans are living above their means
