Google’s DeepMind made ‘inexcusable’ errors handling UK health data, says report

Finally their is nothing wrong in writing a paper about a politically charged topic, but completely dismissing existing standards to paint a picture of doom and gloom is ridiculous. E.g. just look at the references cited by that paper.

From what I understand, this program has exactly the sort of contractual legal limits on use that the authors are asking for:

"Qualified entities may use the information obtained under section 1874(e) of the Act for the sole purpose of evaluating the performance of providers of services and suppliers, and to generate specified public reports".

> but completely dismissing existing standards to paint a picture of doom and gloom is ridiculous

The authors don't dismiss existing standards, but rather explain how the DeepMind agreement was particularly troubling in light of standard data sharing agreements.

And in any case, two wrongs don't make a right. If NHS hands health data over to private companies, there should be very strong legal protections governing the use of that data. PR statements and unenforceable promises are not enough.

To the extent that it is common for private companies to get access to identifiable health information without agreeing to strong legal protections, the authors of this paper are completely validated re: their doom and gloom tone.

And to the extent that this is not the case, the DeepMind agreement was exceptional and particularly troubling.

In either case, you're just strengthening the paper's thesis.

None of this is good for the individuals whose data is potentially at risk, and it's perfectly fair and reasonable to ask whether some of the most sensitive data there is about individuals is being properly handled by those entrusted with it given the implications of modern technology. There might be a lot of potential good in big data analysis for improving healthcare outcomes, but there is also a lot of potential harm if people stop, say, being confident in discussing potentially limiting conditions with their doctors, or reaching out for help with mental health issues because they're worried about confidentiality.

> 1) We do not know––and have no power to find out––what Google and DeepMind are really doing with NHS patient data, nor the extent of Royal Free’s meaningful control over what Google and DeepMind are doing;

> 2) Any assurances about use of the dataset come from public relations statements, rather than independent oversight or legally binding documents;

> 3) The amount of data transferred is far in excess of the requirements of those publicly stated needs, but not in excess of the information sharing agreement and broader memorandum of understanding governing the deal, both of which were kept private for many months;

> 4) The data transfer was done without consulting relevant regulatory bodies, with only one superficial assessment of server security, combined with a post-hoc and inadequate privacy impact assessment;

> 5) None of the millions of identified individuals in the dataset were either informed of the impending transfer to DeepMind, nor asked for their consent;

> 6) The transfer relies on an argument that DeepMind is in a “direct care” relationship with each patient that has been admitted to Royal Free constituent hospitals, even though DeepMind is developing an app that will only conceivably be used in the treatment of one sixth of those individuals; and

> 7) More than 12 months into the deal being made, no regulator had issued any comment or pushback.

Quite a few of these strike me as rather absurd, but I don't know the regulatory environment in the UK.

It also appears that you are casually dismissive of concerns about the risks of that data being de-anonymised. Your best rebuttal seems to be some vague allusion that the parent poster, who was essentially correct, didn't know what they were talking about. (This is something of a digression anyway, because in the actual case we're talking about, as the report notes, the data supplied was already identifiable anyway.)

You have accused the authors of the report of going on a witch-hunt, but again you have offered little real argument except that such things are going on in other places, as if that makes those practices above criticism or automatically acceptable.

Do you realise that you are providing a near perfect, real-time example of the need for stricter controls on medical data and who is allowed to access it?