The ICO has published information on its review of the Royal Free NHS Foundation Trust and the Trust’s use of the Google DeepMind AI project to analyse patient data. This follows up the case from a couple of years back whereby the Trust were found to be in breach of data protection law as the patients hadn’t been given enough information about the sharing of their medical data.
Most of the latest information from the ICO reflects on it’s review on the measures enforced upon the Trust, namely:
- establish a proper legal basis under the Data Protection Act for the Google DeepMind project and for any future trials
- set out how it will comply with its duty of confidence to patients in any future similar trial
- complete a privacy impact assessment, including specific steps to ensure transparency
- commission an audit of the trial, the results of which to be shared with the Information Commissioner
But whilst Royal Free appears to have done everything the ICO asked for, it has raised further issues around clarity relating to how the duty of confidentiality (common law which is outside the purview of the ICO) fits with data protection. This appears to be the issue of balancing a clinicians “conscience” against patient’s expectations.
The ICO say they will consider this further by working with the National Data Guardian and Health Research Authority to ensure guidance is clear to help the healthcare implement data-drive technology safely and legally. In fact NHS Digital’s consent mechanisms project has been selected to take part in the ICO’s Sandbox, so maybe we may see some health-sector driven guidance via that project.
Providing cost-effective, simple to understand and practical GDPR and ePrivacy advice and guidance, via my one-stop-shop helpline. I ❤️ GDPR
