The U.K. Information Commissioner's Office — a nondepartmental public body that reports to the Parliament — ruled London-based Royal Free NHS Foundation Trust failed to comply with the U.K. Data Protection Act when it provided patient information to Google DeepMind.
Here are four things to know about the Royal Free NHS Foundation Trust and Google DeepMind incident.
1. In 2016, Google's artificial intelligence arm DeepMind launched a large-scale health project with Royal Free NHS Foundation Trust which allowed the organization to share more than 1 million patient records with DeepMind. The goal of the partnership was to build an app, called Streams, to help physicians manage acute kidney injury.
2. The deal has faced public scrutiny in recent months due to concerns about the organizations' lack of transparency with patients. The ICO, which upholds data privacy and information rights for individuals in the United Kingdom, conducted an investigation into the Streams app that found "several shortcomings" in how data was handled, according to a notice published July 3.
3. The ICO concluded Royal Free NHS Foundation Trust provided Google DeepMind with personal data for roughly 1.6 million patients as part of the trial to test an alert, diagnosis and detection system for acute kidney injury. However, hospital patients were not adequately informed that their data would be used as part of the test.
4. The ICO asked Royal Free NHS Foundation Trust to sign a letter detailing the conclusion of the office's investigation. It also asked the organization to commit to changes that would bring the project in line with the Data Protection Act, such as completing a privacy impact assessment and commissioning an audit of the trial.
"Patients would not have reasonably expected their information to have been used in this way, and the Trust could and should have been far more transparent with patients as to what was happening," Information Commissioner Elizabeth Denham said. "There's no doubt the huge potential that creative use of data could have on patient care and clinical improvements, but the price of innovation does not need to be the erosion of fundamental privacy rights."