A medical trial involving Google's DeepMind may have violated the law when it was given access to people's health records, a top British privacy watchdog said.
The Information Commissioner's Office revealed on Monday, July 3, that the Royal Free NHS Trust broke UK privacy law when it handed over the health records of 1.6 million patients to DeepMind. The data was used in a breakthrough medical trial featuring Google's artificial intelligence division in 2015.
ICO chief Elizabeth Denham said that while patients could benefit from the creative use of data such as in the medical trial, the price of innovation should not be "the erosion of fundamental privacy rights."
Google DeepMind Medical Trial
The ICO said the DeepMind medical trial violated four basic principles of data protection. These include ensuring that the data will be processed fairly and lawfully, ensuring that the data that is processed is relevant and not excessive in quantity, and ensuring that there are adequate controls being implemented.
The group's investigation found that many patients were not even aware that their health records were being used as part of the medical test.
The ICO has now asked the Royal Free NHS Trust to conduct a third-party audit of the Google DeepMind medical trial and share the results with the Information Commissioner. The commissioner will then have the right to publish the findings of the audit as she sees appropriate.
The Trust has also been asked to make necessary changes to how it handles data for future medical trials.
In its statement, the Royal Free said it accepts the ICO's findings and has already made good progress in addressing the group's concerns. It has also signed an undertaking presented by the ICO, agreeing to the measures mentioned in the report. The Trust is not set to face any fines.
While the findings of the ICO report are related only to the Royal Free NHS Trust, Google DeepMind has also taken responsibility. The AI division admitted that it had underestimated the complexity of the UK's National Health Service and its guidelines for protecting patient data.
DeepMind said it had focused more on building tools for doctors and nurses. It thought of its work as something that would benefit clinicians instead of a technology that should be accountable to and shaped by patients, the public and the National Health Service.
Google's AI division added that it has made major improvements to its own transparency, oversight and engagement since the publishing of the ICO findings. The group hopes that these steps will help improve the NHS IT. It also reaffirmed its commitment to continuing its projects with the British public health agency.
