> The data-sharing agreement — which was signed in 2015 and has since been superseded by a new contract — allows DeepMind access to medical records from 1.6 million patients attending London hospitals run by the NHS Royal Free Trust. Although at the time Google presented the deal as primarily about finding patients at risk from a condition known as acute kidney injury or AKI, the actual terms of the agreement, revealed in April 2016 by a New Scientist investigation, were more broad.
> The report notes that DeepMind was given access not only to relevant blood tests and diagnostics, but historical medical records dating back five years, including information on HIV diagnoses, drug overdoses, and abortions. The report also says the wording of the 2015 deal did not constrain the company from using AI analytical techniques on the data (something DeepMind disputes).
What's the legal status and overall vibe of something like this in the UK?
It's a bit different in the USA as we don't really have an NHS here with everybody's data and it'd be done directly with multiple insurers or medical providers. I'm guessing this would violate some type of patient privacy laws as well.
Given the option I bet many people, including your humble commenter, would opt-out too. (or just not opt-in if we're lucky).
> including your humble commenter, would opt-out too. (or just not opt-in if we're lucky).
At this moment, do you know what organizations own a copy of your medical records -- in whole or part -- and what laws apply to each of those partial records? If not, then how can you possibly hope to opt-out?
> At this moment, do you know what organizations own a copy of your medical records -- in whole or part -- and what laws apply to each of those partial records? If not, then how can you possibly hope to opt-out?
I don't and that's partly why I prefixed that line with, "Given the option ..."
I see, I thought you meant "give the option to opt-out". As in the option to opt-out is the missing thing, rather than knowing who you should even ask for an opt-out.
What's the legal status and overall vibe of something like this in the UK?
The most basic issue is that health records about an identifiable individual are classified as "sensitive personal data" under the Data Protection Act, which is our primary privacy legislation. As such, there are several extra conditions that apply, in addition to all the ones covering all personal data, which constrain how "data controllers" and "data processors" are allowed to use that data. (The technical terms are defined in the Act itself.)
A lot of the details discussed in the original report are relevant because in this case the "data subjects" (the patients) did not give their explicit consent. There are specific conditions required under the Act for processing sensitive personal data without such consent, and it's not clear whether this agreement met them, for reasons such as those discussed in the report we're talking about. If in fact the conditions were not met then a lot of people have probably broken the law, and both the organisations involved and their officers are potentially guilty of offences.
So if I go to them to have my knee replaced, and I go to a different trust to have a lump-ectomy, the data Deepmind gets doesn't include (I think) the lumpectomy.
As for your question about whether this kind of thing is popular: a while ago the NHS wanted to run something called Care.Data (care dot data) which was a big data project. A bunch of people complained about not being allowed to opt out, and so an opt out was added, and a bunch of people then opted out. Personally, I would have opted in if they'd given that option.
> The report notes that DeepMind was given access not only to relevant blood tests and diagnostics, but historical medical records dating back five years, including information on HIV diagnoses, drug overdoses, and abortions. The report also says the wording of the 2015 deal did not constrain the company from using AI analytical techniques on the data (something DeepMind disputes).
What's the legal status and overall vibe of something like this in the UK?
It's a bit different in the USA as we don't really have an NHS here with everybody's data and it'd be done directly with multiple insurers or medical providers. I'm guessing this would violate some type of patient privacy laws as well.
Given the option I bet many people, including your humble commenter, would opt-out too. (or just not opt-in if we're lucky).