12 ms·

Google DeepMind's first deal with the NHS was illegal, UK data regulator rules

98 points by antr 9y ago

ocdtrekkie 9y ago
This was one of those things that truly blew my mind: That the hospital could hand confidential patient data over to Google without their consent. My assumption was that it was just an example of the U.K.'s weaker privacy laws, but I'm glad to see that isn't the case.
- 7Z7 9y ago
  >U.K.'s weaker privacy laws Weaker than who's?
unwind 9y ago
Admins: please fix the typo in the title, the second word should be "regulator" not "regualtor". It's spelled correctly in the actual article title, so probably just a typo in the submission. Thanks.
mattcoles 9y ago
> While the ICO found the deal to be illegal, it has no plans to punish the Royal Free or DeepMind. What the hell? Why do we let Google get away with this.
- toomuchtodo 9y ago
  Call your MP.
- IanCal 9y ago
  From the press release > We aim to help organisations comply with PECR and promote good practice by offering advice and guidance. We will take enforcement action against organisations that persistently ignore their obligations. I don't think that the first step they typically seem to take then is punishment, but steps to bring whatever it is the company is doing back in line with the regulations. The trust is required to: > establish a proper legal basis under the Data Protection Act for the Google DeepMind project and for any future trials; > set out how it will comply with its duty of confidence to patients in any future trial involving personal data; > complete a privacy impact assessment, including specific steps to ensure transparency; and > commission an audit of the trial, the results of which will be shared with the Information Commissioner, and which the Commissioner will have the right to publish as she sees appropriate. edit - ICO site https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... Edit - some more details about the case > In terms of the technical security of the dataset, it is understood that the data is subject to encryption at rest and whilst in transit. It is also understood that the Royal Free has received confirmation from the appropriate body that approval had been obtained for the Logical Connection Architecture for the transfer of data, and that the hosting location has been confirmed as compliant with two relevant Information Security Standards2 . On this basis, the Commissioner accepts that there is no current evidence that the data has or will be at risk of processing by an unauthorised third party. > - It is further understood that all access to raw patient-identifiable data by DeepMind staff as part of the system administration is carefully logged in an audit trail, and is only carried out under the instruction of the Royal Free as part of the data processing. The ICO would like to make it clear that for as long as the data remains in DeepMind’s or indeed any third parties possession, appropriate audit trails, logs and restrictive access provisions should be in place; https://ico.org.uk/media/action-weve-taken/undertakings/2014353/royal-free-undertaking-cover-letter-03072017.pdf https://ico.org.uk/media/action-weve-taken/undertakings/2014... I think the level of the breaches, security of the data and how far things have been taken beyond what is legal make a big difference in what they've decided.
- deleted 9y ago
  [deleted]
- patrickaljord 9y ago
  > What the hell? Why do we let Google get away with this. So Google signed a deal with a government agency that was approved by said agency and they should be fined for that? Wow.
  - detaro 9y ago
    Both sides in a contract are responsible for them acting according to laws, yes. (one-sided punishment would be unfair though, so I think in this case the requirement for proper follow-up and doing it better next time is good resolution, unless it caused actual damage)
  - DanBC 9y ago
    The Royal Free NHS Foundation Trust is not a government agency. There are several layers between the Royal Free and government. https://en.wikipedia.org/wiki/NHS_foundation_trust https://en.wikipedia.org/wiki/NHS_foundation_trust
- k-mcgrady 9y ago
  The issue here doesn't seem to be Google but the NHS providing the data in the first place. So the NHS is to blame. Also, even if the blame was laid on both parties you couldn't punish Google without punishing the NHS - and punishing a publicly funded organisation financially is bad for everyone. It's much more useful to ensure the issue can't happen again.
  - mvitorino 9y ago
    While I agree with you, there is always the option of firing people responsible for the decisions.
    - heavenlyblue 9y ago
      NHS isn't exactly in a position where they could easily fire anyone right now, as it seems.
    - k-mcgrady 9y ago
      ICO doesn't have that power. They can prosecute people but only if they've deliberately breached the DPA and that doesn't seem to be the case here. The NHS should definitely hold the people responsible to account though.
      - pbhjpbhj 9y ago
        So, the system for protection of personal data in the NHS is broken then - if managers can choose to flout the law without any personal repercussions then that law is useless. IIRC you have to have a license to work with certain types of data, that person/those people need to lose grades to the point they have no controlling decision with respect to personal data. It shouldn't be up to their colleagues whether they get held responsible. I work in a craft studio and face a large fine - so I'm told - if I reveal personal data, or make that possible ... because perish the thought someone could learn you painted a piece of pottery, but reveal personal health information against patient wishes and nothing happens?
        9y ago
- DanBC 9y ago
  UK regulators take a light touch approach. They ask people to stop doing what they're doing; then if the behaviour continues they take further action. This has an advantage when action eventually is taken: the offender finds it harder to claim to not know what the law is, or that their behaviour is compliant with law.
Eridrus 9y ago
The outrage people feel about this sort of thing always feels misplaced since it assumes that their data is currently being safe guarded properly and that DeepMind/Google having it would somehow lead to worse outcomes. Hospitals routinely get hacked by the most bottom of the barrel mass malware. I doubt small practices are any better, though I guess they may still have paper files. I had a work experience gig for a week when I was ~14 in a hospital, and in an effort to try to occupy me they gave me an access database on 50k people including things like HIV status to mess around with.
- rubatuga 9y ago
  Yeah, but when hospitals get hacked and if they are just following security protocols set out by the government, the only people to really blame are the hackers. Also what does the fact that you got to see patient data have to do with anything? Didn’t you sign forms saying you wouldn’t disclose patient information? (HIPA) Also, as if you had the authorization to conduct any sort of research or studies on them. What’s so hard to understand about following laws? And why are you implying that the reason people are concerned is due to the safety of their data? It doesn’t matter if Google has their data, or a shitty hackable hospital has it, it shouldn’t be used in any clinical studies without approval.
  - Eridrus 9y ago
    The discussion seems to focus on privacy, the article mentions this. Given DeepMind didn't do any trials, I'm not sure how that is relevant. Labelling statistical analysis as a "trial" seems like it's own farce.
  - KekDemaga 9y ago
    >Yeah, but when hospitals get hacked and if they are just following security protocols set out by the government, the only people to really blame are the hackers. I'd argue the regulators are also to blame.
- a_imho 9y ago
  Anyone having your medical records is bad, especially Google ymmv. I'm sure you can imagine ways how they can abuse it from making shadow profiles, target people with med ads, not to mention they are having leverage on the competition not having access to the same data.
jostmey 9y ago
As someone in the biomedical sciences in the United States, I wish the barrier to access patient information was much lower. The pendulum has swung too far the other direction--toward too much patient protection at the expense of medical progress. Where I work, we've spent nearly 2 years trying to get approval to collect samples (with patient consent) that are being thrown away. No one on the ethics board wants to sign off on it (maybe because they are afraid of being blamed if something bad happens?). We agreed to pay ridiculous fees to de-identify samples and are crossing our fingers that we will finally get the samples. I am glad to see that Google got access to this data and is not being punished. There has to be balance so that medical science can move forward at a reasonable rate
- ocdtrekkie 9y ago
  I totally understand why you could find it irritating to have difficulty getting information with patient consent (this sounds like the sort of frustrating bureaucracy I also deal with regularly), but how does that translate into happiness Google was able to violate people's privacy without their consent?
- k-mcgrady 9y ago
  >> There has to be balance so that medical science can move forward at a reasonable rate. No there doesn't. If I don't want my personal information being provided to Google by the NHS it shouldn't happen. In a country where private healthcare isn't an option for most, the only option (the NHS) shouldn't be giving personal data to private, foreign companies, in breach of the law. 'It'll make my job easier' is awful reasoning for violating privacy and the law.
  - jostmey 9y ago
    I haven't been able to do my job with respect to this project. There's a distinction between hard and impossible
    - k-mcgrady 9y ago
      Fair point. If you were in the UK I would say that means you're trying to do a job that requires you to break the law and it's been decided that it's in the best interests of society that you don't do that job. Obviously as you said you're in the US and it sounds like your situation is very different (you haven't identified a law stopping your work just an ethics board that won't sign off for a reason you don't know).
Jyaif 9y ago
This is the kind of limitation that I imagine do not exist in China, and what will allow/is allowing them to leapfrog the western world in terms of healthcare and science. Of course in a hundred year or so China will itself be paralyzed by regulations and some other part of the world will take over.
- mtgx 9y ago
  On the other hand, China is using that data to develop a "perfect citizen" score system and use AI to censor, spy on, and deny citizens services for "bad behavior" (like say criticizing the president - but you would never do that in the U.S. anyway, right?!) So I'm not sure we want to go in that direction anyway... http://www.ibtimes.com/china-use-big-data-rate-citizens-new-social-credit-system-1898711 http://www.ibtimes.com/china-use-big-data-rate-citizens-new-... http://boingboing.net/2017/02/16/chinas-citizen-scores-us.html http://boingboing.net/2017/02/16/chinas-citizen-scores-us.ht...
taivokasper 9y ago
Who gave access to the UK regulator to determine whether the shared data is ok to be shared or not!?
- DanBC 9y ago
  The ICO operates under a framework of legislation. The list of legislation is here: https://ico.org.uk/about-the-ico/what-we-do/ https://ico.org.uk/about-the-ico/what-we-do/
shif 9y ago
Can't they fine the strawberrynet blatant disregard for privacy?, It's based on the UK, you can access personal information of anyone registered in the site with only their email address and they say It's not a big deal.
plesiv 9y ago
Is there any research done on attempting to use crypto for some smart scheme of anonymizing patient data bundles to: - allow for cryptographically safe usage of the bundles for research (with some limitations?) - make exact mapping of the health data bundle to a particular person impractical? Considering the miracles of public-key cryptography and blockchains, it would seem to me that there could be a scheme that would allow for something like this.
kiasta 9y ago
I'm curious what would happen if this breach occured in the US. We have severe penalties for these kinds of breaches outlined in HIPAA. I work in the healthcare industry as a software developer and know full well the costs for a single breach for the company. The thing about it is, there doesn't even have to be a breach per say. There just needs to be the potential for a breach for it to be considered. For instance, someone steals a laptop that has remote access to hospital records. That is a breach. Not because data was stolen, but because of the potential for data to be stolen. I don't know what kinds of privacy laws you have in the UK but if they are even remotely similar to here in the US, I will gladly watch google burn for this. Edit: Also, the fact that people are actually OK with a corporate entity free access to our medical records is appalling. Especially on a website such as this. I can't believe people are actually defending this.
- DanBC 9y ago
  The ICO site lists plenty of fines handed out for that type of lost data. HEALTH: https://ico.org.uk/action-weve-taken/enforcement/?facet_type=&facet_sector=Health&facet_date=&date_from=&date_to= https://ico.org.uk/action-weve-taken/enforcement/?facet_type... LOCAL GOVERNMENT: https://ico.org.uk/action-weve-taken/enforcement/?facet_type=&facet_sector=Local+government&facet_date=&date_from=&date_to= https://ico.org.uk/action-weve-taken/enforcement/?facet_type...
mtgx 9y ago
> “We were almost exclusively focused on building tools that nurses and doctors wanted, and thought of our work as technology for clinicians rather than something that needed to be accountable to and shaped by patients, the public and the NHS as a whole. We got that wrong, and we need to do better.” Oh wow. How can any Google executive still be ignorant about the privacy implications of its data mining and tracking technologies? That seems unbelievable to me. https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act https://www.theguardian.com/technology/2017/jul/03/google-de... With such mentality, people should really question just how seriously Google takes the privacy of their email, Drive docs, and so on, if they don't even consider the privacy implications of using your data when building their data mining tools.
- deleted 9y ago
  [deleted]
peoplewindow 9y ago
The UK ICO is one of the better regulators out there, and it seems the punishment (nothing) is proportionate to the actual harm done here (apparently none). But this is still a sad outcome. The message that tech workers will take away from this sort of thing is "don't try to work with the NHS or do anything innovative in healthcare". DeepMind didn't appear to have any actual business plan in mind for Streams - all the stuff I read from them on this project implied it was driven simply by a desire to help the UK's national treasure/obsession. Being owned by Google does let important execs do pet projects like this so I don't see any need for conspiracy theories here. Both the ICO and the NHS are part of the government and yet they reached different decisions about the same laws, I expect DeepMind had their own legal advice which also concluded it was OK. It is unlikely any other company or startup could get a hard-and-fast 100% guaranteed correct deal with the NHS to do things with patient data. It's doubly unfortunate because the NHS has deeply dysfunctional IT and badly needs the assistance of data specialists. It faces huge challenges to become more efficient and shows little ability to do so. Healthcare records are still passed around on paper, the biggest IT failure in history was an attempt to digitise the NHS, medical data leaks all over the place and is guarded far more loosely than Google would ever consider, many genetic diseases are fairly rare and need a lot of data analysis to make progress on, and so on. Healthcare and the tech industry should be a match made in heaven. Instead the very, very few attempts to dance together inevitably seem to end badly.
- dm319 9y ago
  I mostly agree with you - healthcare and tech should absolutely be a match made in heaven, but here in the UK it's the ethics and data protection laws which make that so difficult. Even with explicit consent from patients (and this article states this was not the case), the rules make it very hard to work effectively with the data. I can give a couple of examples. [The 100'000 genomes project](https://www.genomicsengland.co.uk/the-100000-genomes-project/ https://www.genomicsengland.co.uk/the-100000-genomes-project...) is in the process of sequencing 100'000 genomes of patients with cancer and rare disease and will be the largest sequencing project in the world once completed. Because whole genome data can potentially identify a person and give information on conditions they have or might be prone to, their genomic data is seen as confidential. As a result, even with explicit patient permission, the data can only be accessed through a remote desktop onto a machine which does not have internet access, which makes working with some genomic tools (which rely on large databases) very problematic. I understand they're working on this, but it is just an example of the 'inconvenience' of abiding by security rules. Another example, with my own research, is that even with patient consent, the thumbs up from the ethics committee, and being clinically involved with patients (with a corresponding contract with the hospital), I am unable to store patient information on encrypted devices on university computers. Instead this must be stored on NHS computers, even though the analysis occurs on university computers. Having said all of that, there is a way to get really great data from many patients using NHS IT systems - [the million women study](http://www.millionwomenstudy.org/methods/ http://www.millionwomenstudy.org/methods/) successfully did this and have not run into any ethical/regulatory problems. That's because they did it the right way - i.e. it is formally registered as research, permission was asked and received from the regional ethics committee, patients were given information, both by paper and verbally, to ask for consent for the study. Of course this study was run by Oxford University, who, like other universities, know clearly the pitfalls and hoops of conducting research on patients. This is a whole world of bureaucracy (which has come about for good reasons), which tech companies will have to navigate and abide by if they wish to carry out human research.
rscho 9y ago
I am in the healthcare industry (public services) and I actually agree with both sides of the argument. Freeing healthcare data from its current ethical/legal shackles would definitely allow for great things in science. It is just as true that it destroys privacy at the population level. There is no doubt that the data will also be used to evil ends and restrains everyone's right to autodetermination (destabilizing politicians, discrimination on hiring, etc.) so the question is simply "do we, as the whole population, want to take that risk?". Some will say yes, others no. This should be subject to a vote at the national level. Progress has often impinged on individual freedom in the past, and I am pretty confident we will solve this the usual way: without asking the public's opinion.
- benchaney 9y ago
  >"do we, as the whole population, want to take that risk?". Some will say yes, others no. This should be subject to a vote at the national level. No it shouldn't. It should be a personal decision for each individual.
vonnik 9y ago
People tell me the irony is that the NHS data was crap anyway. Too messy to work with.
deleted 9y ago
[deleted]

98 points by antr 9y ago

This was one of those things that truly blew my mind: That the hospital could hand confidential patient data over to Google without their consent. My assumption was that it was just an example of the U.K.'s weaker privacy laws, but I'm glad to see that isn't the case.

7Z7 9y ago
>U.K.'s weaker privacy laws Weaker than who's?

unwind 9y ago

Admins: please fix the typo in the title, the second word should be "regulator" not "regualtor". It's spelled correctly in the actual article title, so probably just a typo in the submission. Thanks.

mattcoles 9y ago

> While the ICO found the deal to be illegal, it has no plans to punish the Royal Free or DeepMind. What the hell? Why do we let Google get away with this.

toomuchtodo 9y ago
Call your MP.
IanCal 9y ago
From the press release > We aim to help organisations comply with PECR and promote good practice by offering advice and guidance. We will take enforcement action against organisations that persistently ignore their obligations. I don't think that the first step they typically seem to take then is punishment, but steps to bring whatever it is the company is doing back in line with the regulations. The trust is required to: > establish a proper legal basis under the Data Protection Act for the Google DeepMind project and for any future trials; > set out how it will comply with its duty of confidence to patients in any future trial involving personal data; > complete a privacy impact assessment, including specific steps to ensure transparency; and > commission an audit of the trial, the results of which will be shared with the Information Commissioner, and which the Commissioner will have the right to publish as she sees appropriate. edit - ICO site https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... Edit - some more details about the case > In terms of the technical security of the dataset, it is understood that the data is subject to encryption at rest and whilst in transit. It is also understood that the Royal Free has received confirmation from the appropriate body that approval had been obtained for the Logical Connection Architecture for the transfer of data, and that the hosting location has been confirmed as compliant with two relevant Information Security Standards2 . On this basis, the Commissioner accepts that there is no current evidence that the data has or will be at risk of processing by an unauthorised third party. > - It is further understood that all access to raw patient-identifiable data by DeepMind staff as part of the system administration is carefully logged in an audit trail, and is only carried out under the instruction of the Royal Free as part of the data processing. The ICO would like to make it clear that for as long as the data remains in DeepMind’s or indeed any third parties possession, appropriate audit trails, logs and restrictive access provisions should be in place; https://ico.org.uk/media/action-weve-taken/undertakings/2014353/royal-free-undertaking-cover-letter-03072017.pdf https://ico.org.uk/media/action-weve-taken/undertakings/2014... I think the level of the breaches, security of the data and how far things have been taken beyond what is legal make a big difference in what they've decided.
deleted 9y ago
[deleted]
patrickaljord 9y ago
> What the hell? Why do we let Google get away with this. So Google signed a deal with a government agency that was approved by said agency and they should be fined for that? Wow.
- detaro 9y ago
  Both sides in a contract are responsible for them acting according to laws, yes. (one-sided punishment would be unfair though, so I think in this case the requirement for proper follow-up and doing it better next time is good resolution, unless it caused actual damage)
- DanBC 9y ago
  The Royal Free NHS Foundation Trust is not a government agency. There are several layers between the Royal Free and government. https://en.wikipedia.org/wiki/NHS_foundation_trust https://en.wikipedia.org/wiki/NHS_foundation_trust
k-mcgrady 9y ago
The issue here doesn't seem to be Google but the NHS providing the data in the first place. So the NHS is to blame. Also, even if the blame was laid on both parties you couldn't punish Google without punishing the NHS - and punishing a publicly funded organisation financially is bad for everyone. It's much more useful to ensure the issue can't happen again.
- mvitorino 9y ago
  While I agree with you, there is always the option of firing people responsible for the decisions.
  - heavenlyblue 9y ago
    NHS isn't exactly in a position where they could easily fire anyone right now, as it seems.
  - k-mcgrady 9y ago
    ICO doesn't have that power. They can prosecute people but only if they've deliberately breached the DPA and that doesn't seem to be the case here. The NHS should definitely hold the people responsible to account though.
    - pbhjpbhj 9y ago
      So, the system for protection of personal data in the NHS is broken then - if managers can choose to flout the law without any personal repercussions then that law is useless. IIRC you have to have a license to work with certain types of data, that person/those people need to lose grades to the point they have no controlling decision with respect to personal data. It shouldn't be up to their colleagues whether they get held responsible. I work in a craft studio and face a large fine - so I'm told - if I reveal personal data, or make that possible ... because perish the thought someone could learn you painted a piece of pottery, but reveal personal health information against patient wishes and nothing happens?
      - 9y ago
DanBC 9y ago
UK regulators take a light touch approach. They ask people to stop doing what they're doing; then if the behaviour continues they take further action. This has an advantage when action eventually is taken: the offender finds it harder to claim to not know what the law is, or that their behaviour is compliant with law.

Eridrus 9y ago

The outrage people feel about this sort of thing always feels misplaced since it assumes that their data is currently being safe guarded properly and that DeepMind/Google having it would somehow lead to worse outcomes. Hospitals routinely get hacked by the most bottom of the barrel mass malware. I doubt small practices are any better, though I guess they may still have paper files. I had a work experience gig for a week when I was ~14 in a hospital, and in an effort to try to occupy me they gave me an access database on 50k people including things like HIV status to mess around with.

rubatuga 9y ago
Yeah, but when hospitals get hacked and if they are just following security protocols set out by the government, the only people to really blame are the hackers. Also what does the fact that you got to see patient data have to do with anything? Didn’t you sign forms saying you wouldn’t disclose patient information? (HIPA) Also, as if you had the authorization to conduct any sort of research or studies on them. What’s so hard to understand about following laws? And why are you implying that the reason people are concerned is due to the safety of their data? It doesn’t matter if Google has their data, or a shitty hackable hospital has it, it shouldn’t be used in any clinical studies without approval.
- Eridrus 9y ago
  The discussion seems to focus on privacy, the article mentions this. Given DeepMind didn't do any trials, I'm not sure how that is relevant. Labelling statistical analysis as a "trial" seems like it's own farce.
- KekDemaga 9y ago
  >Yeah, but when hospitals get hacked and if they are just following security protocols set out by the government, the only people to really blame are the hackers. I'd argue the regulators are also to blame.
a_imho 9y ago
Anyone having your medical records is bad, especially Google ymmv. I'm sure you can imagine ways how they can abuse it from making shadow profiles, target people with med ads, not to mention they are having leverage on the competition not having access to the same data.

jostmey 9y ago

As someone in the biomedical sciences in the United States, I wish the barrier to access patient information was much lower. The pendulum has swung too far the other direction--toward too much patient protection at the expense of medical progress. Where I work, we've spent nearly 2 years trying to get approval to collect samples (with patient consent) that are being thrown away. No one on the ethics board wants to sign off on it (maybe because they are afraid of being blamed if something bad happens?). We agreed to pay ridiculous fees to de-identify samples and are crossing our fingers that we will finally get the samples. I am glad to see that Google got access to this data and is not being punished. There has to be balance so that medical science can move forward at a reasonable rate

ocdtrekkie 9y ago
I totally understand why you could find it irritating to have difficulty getting information with patient consent (this sounds like the sort of frustrating bureaucracy I also deal with regularly), but how does that translate into happiness Google was able to violate people's privacy without their consent?
k-mcgrady 9y ago
>> There has to be balance so that medical science can move forward at a reasonable rate. No there doesn't. If I don't want my personal information being provided to Google by the NHS it shouldn't happen. In a country where private healthcare isn't an option for most, the only option (the NHS) shouldn't be giving personal data to private, foreign companies, in breach of the law. 'It'll make my job easier' is awful reasoning for violating privacy and the law.
- jostmey 9y ago
  I haven't been able to do my job with respect to this project. There's a distinction between hard and impossible
  - k-mcgrady 9y ago
    Fair point. If you were in the UK I would say that means you're trying to do a job that requires you to break the law and it's been decided that it's in the best interests of society that you don't do that job. Obviously as you said you're in the US and it sounds like your situation is very different (you haven't identified a law stopping your work just an ethics board that won't sign off for a reason you don't know).

Jyaif 9y ago

This is the kind of limitation that I imagine do not exist in China, and what will allow/is allowing them to leapfrog the western world in terms of healthcare and science. Of course in a hundred year or so China will itself be paralyzed by regulations and some other part of the world will take over.

mtgx 9y ago
On the other hand, China is using that data to develop a "perfect citizen" score system and use AI to censor, spy on, and deny citizens services for "bad behavior" (like say criticizing the president - but you would never do that in the U.S. anyway, right?!) So I'm not sure we want to go in that direction anyway... http://www.ibtimes.com/china-use-big-data-rate-citizens-new-social-credit-system-1898711 http://www.ibtimes.com/china-use-big-data-rate-citizens-new-... http://boingboing.net/2017/02/16/chinas-citizen-scores-us.html http://boingboing.net/2017/02/16/chinas-citizen-scores-us.ht...

taivokasper 9y ago

Who gave access to the UK regulator to determine whether the shared data is ok to be shared or not!?

DanBC 9y ago
The ICO operates under a framework of legislation. The list of legislation is here: https://ico.org.uk/about-the-ico/what-we-do/ https://ico.org.uk/about-the-ico/what-we-do/

shif 9y ago

Can't they fine the strawberrynet blatant disregard for privacy?, It's based on the UK, you can access personal information of anyone registered in the site with only their email address and they say It's not a big deal.

plesiv 9y ago

Is there any research done on attempting to use crypto for some smart scheme of anonymizing patient data bundles to: - allow for cryptographically safe usage of the bundles for research (with some limitations?) - make exact mapping of the health data bundle to a particular person impractical? Considering the miracles of public-key cryptography and blockchains, it would seem to me that there could be a scheme that would allow for something like this.

kiasta 9y ago

I'm curious what would happen if this breach occured in the US. We have severe penalties for these kinds of breaches outlined in HIPAA. I work in the healthcare industry as a software developer and know full well the costs for a single breach for the company. The thing about it is, there doesn't even have to be a breach per say. There just needs to be the potential for a breach for it to be considered. For instance, someone steals a laptop that has remote access to hospital records. That is a breach. Not because data was stolen, but because of the potential for data to be stolen. I don't know what kinds of privacy laws you have in the UK but if they are even remotely similar to here in the US, I will gladly watch google burn for this. Edit: Also, the fact that people are actually OK with a corporate entity free access to our medical records is appalling. Especially on a website such as this. I can't believe people are actually defending this.

DanBC 9y ago
The ICO site lists plenty of fines handed out for that type of lost data. HEALTH: https://ico.org.uk/action-weve-taken/enforcement/?facet_type=&facet_sector=Health&facet_date=&date_from=&date_to= https://ico.org.uk/action-weve-taken/enforcement/?facet_type... LOCAL GOVERNMENT: https://ico.org.uk/action-weve-taken/enforcement/?facet_type=&facet_sector=Local+government&facet_date=&date_from=&date_to= https://ico.org.uk/action-weve-taken/enforcement/?facet_type...

mtgx 9y ago

> “We were almost exclusively focused on building tools that nurses and doctors wanted, and thought of our work as technology for clinicians rather than something that needed to be accountable to and shaped by patients, the public and the NHS as a whole. We got that wrong, and we need to do better.” Oh wow. How can any Google executive still be ignorant about the privacy implications of its data mining and tracking technologies? That seems unbelievable to me. https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act https://www.theguardian.com/technology/2017/jul/03/google-de... With such mentality, people should really question just how seriously Google takes the privacy of their email, Drive docs, and so on, if they don't even consider the privacy implications of using your data when building their data mining tools.

deleted 9y ago
[deleted]

peoplewindow 9y ago

The UK ICO is one of the better regulators out there, and it seems the punishment (nothing) is proportionate to the actual harm done here (apparently none). But this is still a sad outcome. The message that tech workers will take away from this sort of thing is "don't try to work with the NHS or do anything innovative in healthcare". DeepMind didn't appear to have any actual business plan in mind for Streams - all the stuff I read from them on this project implied it was driven simply by a desire to help the UK's national treasure/obsession. Being owned by Google does let important execs do pet projects like this so I don't see any need for conspiracy theories here. Both the ICO and the NHS are part of the government and yet they reached different decisions about the same laws, I expect DeepMind had their own legal advice which also concluded it was OK. It is unlikely any other company or startup could get a hard-and-fast 100% guaranteed correct deal with the NHS to do things with patient data. It's doubly unfortunate because the NHS has deeply dysfunctional IT and badly needs the assistance of data specialists. It faces huge challenges to become more efficient and shows little ability to do so. Healthcare records are still passed around on paper, the biggest IT failure in history was an attempt to digitise the NHS, medical data leaks all over the place and is guarded far more loosely than Google would ever consider, many genetic diseases are fairly rare and need a lot of data analysis to make progress on, and so on. Healthcare and the tech industry should be a match made in heaven. Instead the very, very few attempts to dance together inevitably seem to end badly.

dm319 9y ago
I mostly agree with you - healthcare and tech should absolutely be a match made in heaven, but here in the UK it's the ethics and data protection laws which make that so difficult. Even with explicit consent from patients (and this article states this was not the case), the rules make it very hard to work effectively with the data. I can give a couple of examples. [The 100'000 genomes project](https://www.genomicsengland.co.uk/the-100000-genomes-project/ https://www.genomicsengland.co.uk/the-100000-genomes-project...) is in the process of sequencing 100'000 genomes of patients with cancer and rare disease and will be the largest sequencing project in the world once completed. Because whole genome data can potentially identify a person and give information on conditions they have or might be prone to, their genomic data is seen as confidential. As a result, even with explicit patient permission, the data can only be accessed through a remote desktop onto a machine which does not have internet access, which makes working with some genomic tools (which rely on large databases) very problematic. I understand they're working on this, but it is just an example of the 'inconvenience' of abiding by security rules. Another example, with my own research, is that even with patient consent, the thumbs up from the ethics committee, and being clinically involved with patients (with a corresponding contract with the hospital), I am unable to store patient information on encrypted devices on university computers. Instead this must be stored on NHS computers, even though the analysis occurs on university computers. Having said all of that, there is a way to get really great data from many patients using NHS IT systems - [the million women study](http://www.millionwomenstudy.org/methods/ http://www.millionwomenstudy.org/methods/) successfully did this and have not run into any ethical/regulatory problems. That's because they did it the right way - i.e. it is formally registered as research, permission was asked and received from the regional ethics committee, patients were given information, both by paper and verbally, to ask for consent for the study. Of course this study was run by Oxford University, who, like other universities, know clearly the pitfalls and hoops of conducting research on patients. This is a whole world of bureaucracy (which has come about for good reasons), which tech companies will have to navigate and abide by if they wish to carry out human research.

rscho 9y ago

I am in the healthcare industry (public services) and I actually agree with both sides of the argument. Freeing healthcare data from its current ethical/legal shackles would definitely allow for great things in science. It is just as true that it destroys privacy at the population level. There is no doubt that the data will also be used to evil ends and restrains everyone's right to autodetermination (destabilizing politicians, discrimination on hiring, etc.) so the question is simply "do we, as the whole population, want to take that risk?". Some will say yes, others no. This should be subject to a vote at the national level. Progress has often impinged on individual freedom in the past, and I am pretty confident we will solve this the usual way: without asking the public's opinion.

benchaney 9y ago
>"do we, as the whole population, want to take that risk?". Some will say yes, others no. This should be subject to a vote at the national level. No it shouldn't. It should be a personal decision for each individual.

vonnik 9y ago

People tell me the irony is that the NHS data was crap anyway. Too messy to work with.

deleted 9y ago

[deleted]