That’s the harsh judgement of the most senior data protection adviser to the NHS, Dame Fiona Caldicott, the National Data Guardian at the Department of Health.
DeepMind was gifted the data to test Streams, a smartphone app that is claimed to be able to detect if patients are suffering from acute kidney injuries, then rapidly inform clinicians so that they may receive potentially life-saving treatment.
But the deal is now being investigated by the ICO, with Dame Waldicott’s participation, it is alleged.
The broadcaster says it’s got a letter sent to Professor Stephen Powis, the medical director of the Royal Free Hospital in London, which provided the patients’ records to Google DeepMind.
The story says that while there are strict legal protections ensuring the confidentiality of patients’ records, under common law “patients are ‘implied’ to have consented to their information being shared if it was shared for the purpose of ‘direct care'”.
You might also like
However, this basis was not valid in the arrangement between Royal Free and DeepMind, said Waldicott, who told the pair last December she “did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis”.
In her “considered opinion”, her letter states, the “purpose for the transfer of 1.6 million identifiable patient records to Google DeepMind was for the testing of the Streams application, and not for the provision of direct care to patients”.
“My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose,” she is quoted as saying (a PDF of the letter is on the Sky News site).
The ICO told Sky News that its investigation “is close to conclusion”.
The Department of Health had not responded to Sky News’ requests for a response as of publication, it says.