Published on Liberty’s blog, 7 July 2017
By Silkie Carlo
There’s been a privacy scandal unravelling behind the scenes in the NHS for the last 18 months. You might be affected – and you wouldn’t even know.
If you or a loved one visited the Royal Free London Hospital between 2010 and 2015 – or Barnet or Chase Farm hospitals between July 2014 and 2015* – Google DeepMind may well have a copy of your medical records.
The hospitals have been handing over millions of patient records to the artificial intelligence company – entirely without patients’ knowledge or consent.
This week, two national authorities on data law declared that the Royal Free London NHS Trust broke data protection law by gifting the 1.6 million patient identifiable records.
Astonishingly, Google DeepMind didn’t obtain the data for a limited, specific medical project . It was made available to them for general clinical product development.
Your information is a high value commodity
It’s clear this was a serious breach of data protection law– but this is also a human rights matter.
There’s little information that’s more deeply personal than our medical records. They chronicle the inner workings of our bodies and minds and often punctuate the landmarks of our lives.
Think about the enormously wide-ranging, complex reasons that bring people through hospital doors – accidents, pregnancy, substance abuse, domestic violence, long term illness or suicidality.
All this personal – even bodily – information is a high value commodity for commercial entities that rely on big data for innovation.
In this case, a five-year history of patients’ private medical data was the oil Google DeepMind needed to fuel their data processors and develop market-leading products.
But at what cost to patients?
With no assurance of privacy and control over our records, patients would feel unable speak openly with health professionals and could be deterred from seeking healthcare at all – jeopardising not only their own wellbeing but potentially wider public health.
The new frontline in human rights
This new type of human rights issue risks becoming more common as our privacy struggles to survive the technological revolution – unless action is taken now.
The Information Commissioner’s Office (ICO) published its findings of illegality against the Royal Free this week. But they stopped short of issuing a fine or requiring Google DeepMind to delete the records.
It was in the ICO’s power to demand the Royal Free let patients know what had happened to their data – but that hasn’t happened either.
So Google DeepMind continues to hold an information trove on every patient admission, every blood test result, demographic information, and all discharges and transfers within constituent hospitals of Royal Free – including A and E admissions over a more than five-year period dating back to 2010.
The data was given to Google DeepMind for free. But they’re entitled to sell back to the NHS any products they might build using that data.
All this, and the patients affected haven’t even been told – let alone asked permission.
Navigating the tech revolution
To hand over patients’ personal information without their consent is reprehensible and reckless.
But it’s also a self-defeating oversight of how crucial privacy and consent are as pillars of our democracy, the rule of law, public health – and technological innovation itself.
The promises of modern technology mean the potential for advances in medical research and healthcare has never been greater.
To reach that potential, innovators must respect our human rights framework and our values of privacy, dignity and consent.
There’s no conflict between privacy and innovation. There’s no conflict between protecting human rights and progress.
At Liberty, we’ll always support innovation – particularly in areas like healthcare, where it can do great public good.
But that doesn’t necessitate trampling on our hard won right to privacy, especially in this, the most sensitive of fields.
As we navigate these seismic shifts in technology and society, human rights should be our guiding light – and Liberty will be working to make sure that light is never dimmed.
If you believe you may have been affected by the issues raised in this blog, you can contact Liberty’s Advice and Information service.
*Barnet Hospital and Chase Farm Hospital became part of the Royal Free London NHS Trust in July 2014.