Data Science Investment Counter —Funding raised by UK data science companies in 2018.
£ 5.640 Million

Royal Free-DeepMind Deal Breached UK Data Law

The data-sharing agreement between the Royal Free hospital and AI firm DeepMind, which resulted in 1.6 million patient data being  made available to the Alphabet-owned company, was in breach of UK’s Data Protection Act, the Information Commissioner’s Office (ICO) has found.

The deal, which had been uncovered in 2016 by a New Scientist investigation, was part of a scheme in which the London-based hospital partnered with DeepMind to build Streams— a healthcare application that flags up early signs of acute kidney injury. ICO said that patients had not been sufficiently informed about their data’s transfer before the start of the project.

“Our investigation found a number of shortcomings in the way patient records were shared for this trial,” information commissioner Elizabeth Denham said. “Patients would not have reasonably expected their information to have been used in this way, and the Trust could and should have been far more transparent with patients as to what was happening.”

“We’ve asked the Trust to commit to making changes that will address those shortcomings, and their co-operation is welcome. The Data Protection Act is not a barrier to innovation, but it does need to be considered wherever people’s data is being used.”

ICO explained that Royal Free was not entitled to transfer its patients’ information, even much so as the data handed over to DeepMind was detailed and broad in scope.

“A patient presenting at accident and emergency within the last five years to receive treatment or a person who engages with radiology services and who has had little or no prior engagement with the Trust would not reasonably expect their data to be accessible to a third party for the testing of a new mobile application, however positive the aims of that application may be,” ICO added.

While the organisation touched on the Royal Free’s cooperation with DeepMind during Streams’ initial trials, ICO did not discuss the legality of recent arrangements in other British hospitals where DeepMind’s app has been adopted for actual clinical purposes—and which have raised some eyebrows among privacy advocates.

ICO’s ruling will require that London-based Royal Free start an independent audit of the deal, carry out a privacy assessment, and come up with a plan to better comply with data regulation in future trials involving DeepMind.

The hospital commented on the verdict in a statement: “We are pleased that the information commissioner has allowed us to continue using the app which is helping us to get the fastest treatment to our most vulnerable patients – potentially saving lives,” it said.

“We accept the ICO’s findings and have already made good progress to address the areas where they have concerns. For example, we are now doing much more to keep our patients informed about how their data is used.”

DeepMind also weighed in on the matter, admitting how the complex rules around patient data had been underestimated during  the early phases of the Stream initiative,  and stressing how it has since implemented changes to improve transparency and data protection.

Image via


Co-working space and blog dedicated to all things data science.

Subscribe to our newsletter