5 ms·

> While the ICO found the deal to be illegal, it has no plans to punish the Royal Free or DeepMind. What the hell? Why do we let Google get away with this.

toomuchtodo 9y ago
Call your MP.
IanCal 9y ago
From the press release > We aim to help organisations comply with PECR and promote good practice by offering advice and guidance. We will take enforcement action against organisations that persistently ignore their obligations. I don't think that the first step they typically seem to take then is punishment, but steps to bring whatever it is the company is doing back in line with the regulations. The trust is required to: > establish a proper legal basis under the Data Protection Act for the Google DeepMind project and for any future trials; > set out how it will comply with its duty of confidence to patients in any future trial involving personal data; > complete a privacy impact assessment, including specific steps to ensure transparency; and > commission an audit of the trial, the results of which will be shared with the Information Commissioner, and which the Commissioner will have the right to publish as she sees appropriate. edit - ICO site https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... Edit - some more details about the case > In terms of the technical security of the dataset, it is understood that the data is subject to encryption at rest and whilst in transit. It is also understood that the Royal Free has received confirmation from the appropriate body that approval had been obtained for the Logical Connection Architecture for the transfer of data, and that the hosting location has been confirmed as compliant with two relevant Information Security Standards2 . On this basis, the Commissioner accepts that there is no current evidence that the data has or will be at risk of processing by an unauthorised third party. > - It is further understood that all access to raw patient-identifiable data by DeepMind staff as part of the system administration is carefully logged in an audit trail, and is only carried out under the instruction of the Royal Free as part of the data processing. The ICO would like to make it clear that for as long as the data remains in DeepMind’s or indeed any third parties possession, appropriate audit trails, logs and restrictive access provisions should be in place; https://ico.org.uk/media/action-weve-taken/undertakings/2014353/royal-free-undertaking-cover-letter-03072017.pdf https://ico.org.uk/media/action-weve-taken/undertakings/2014... I think the level of the breaches, security of the data and how far things have been taken beyond what is legal make a big difference in what they've decided.
deleted 9y ago
[deleted]
patrickaljord 9y ago
> What the hell? Why do we let Google get away with this. So Google signed a deal with a government agency that was approved by said agency and they should be fined for that? Wow.
- detaro 9y ago
  Both sides in a contract are responsible for them acting according to laws, yes. (one-sided punishment would be unfair though, so I think in this case the requirement for proper follow-up and doing it better next time is good resolution, unless it caused actual damage)
- DanBC 9y ago
  The Royal Free NHS Foundation Trust is not a government agency. There are several layers between the Royal Free and government. https://en.wikipedia.org/wiki/NHS_foundation_trust https://en.wikipedia.org/wiki/NHS_foundation_trust
k-mcgrady 9y ago
The issue here doesn't seem to be Google but the NHS providing the data in the first place. So the NHS is to blame. Also, even if the blame was laid on both parties you couldn't punish Google without punishing the NHS - and punishing a publicly funded organisation financially is bad for everyone. It's much more useful to ensure the issue can't happen again.
- mvitorino 9y ago
  While I agree with you, there is always the option of firing people responsible for the decisions.
  - heavenlyblue 9y ago
    NHS isn't exactly in a position where they could easily fire anyone right now, as it seems.
  - k-mcgrady 9y ago
    ICO doesn't have that power. They can prosecute people but only if they've deliberately breached the DPA and that doesn't seem to be the case here. The NHS should definitely hold the people responsible to account though.
    - pbhjpbhj 9y ago
      So, the system for protection of personal data in the NHS is broken then - if managers can choose to flout the law without any personal repercussions then that law is useless. IIRC you have to have a license to work with certain types of data, that person/those people need to lose grades to the point they have no controlling decision with respect to personal data. It shouldn't be up to their colleagues whether they get held responsible. I work in a craft studio and face a large fine - so I'm told - if I reveal personal data, or make that possible ... because perish the thought someone could learn you painted a piece of pottery, but reveal personal health information against patient wishes and nothing happens?
      - 9y ago
DanBC 9y ago
UK regulators take a light touch approach. They ask people to stop doing what they're doing; then if the behaviour continues they take further action. This has an advantage when action eventually is taken: the offender finds it harder to claim to not know what the law is, or that their behaviour is compliant with law.

toomuchtodo 9y ago

Call your MP.

IanCal 9y ago

From the press release > We aim to help organisations comply with PECR and promote good practice by offering advice and guidance. We will take enforcement action against organisations that persistently ignore their obligations. I don't think that the first step they typically seem to take then is punishment, but steps to bring whatever it is the company is doing back in line with the regulations. The trust is required to: > establish a proper legal basis under the Data Protection Act for the Google DeepMind project and for any future trials; > set out how it will comply with its duty of confidence to patients in any future trial involving personal data; > complete a privacy impact assessment, including specific steps to ensure transparency; and > commission an audit of the trial, the results of which will be shared with the Information Commissioner, and which the Commissioner will have the right to publish as she sees appropriate. edit - ICO site https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... Edit - some more details about the case > In terms of the technical security of the dataset, it is understood that the data is subject to encryption at rest and whilst in transit. It is also understood that the Royal Free has received confirmation from the appropriate body that approval had been obtained for the Logical Connection Architecture for the transfer of data, and that the hosting location has been confirmed as compliant with two relevant Information Security Standards2 . On this basis, the Commissioner accepts that there is no current evidence that the data has or will be at risk of processing by an unauthorised third party. > - It is further understood that all access to raw patient-identifiable data by DeepMind staff as part of the system administration is carefully logged in an audit trail, and is only carried out under the instruction of the Royal Free as part of the data processing. The ICO would like to make it clear that for as long as the data remains in DeepMind’s or indeed any third parties possession, appropriate audit trails, logs and restrictive access provisions should be in place; https://ico.org.uk/media/action-weve-taken/undertakings/2014353/royal-free-undertaking-cover-letter-03072017.pdf https://ico.org.uk/media/action-weve-taken/undertakings/2014... I think the level of the breaches, security of the data and how far things have been taken beyond what is legal make a big difference in what they've decided.

deleted 9y ago

[deleted]

patrickaljord 9y ago

> What the hell? Why do we let Google get away with this. So Google signed a deal with a government agency that was approved by said agency and they should be fined for that? Wow.

detaro 9y ago
Both sides in a contract are responsible for them acting according to laws, yes. (one-sided punishment would be unfair though, so I think in this case the requirement for proper follow-up and doing it better next time is good resolution, unless it caused actual damage)
DanBC 9y ago
The Royal Free NHS Foundation Trust is not a government agency. There are several layers between the Royal Free and government. https://en.wikipedia.org/wiki/NHS_foundation_trust https://en.wikipedia.org/wiki/NHS_foundation_trust

k-mcgrady 9y ago

The issue here doesn't seem to be Google but the NHS providing the data in the first place. So the NHS is to blame. Also, even if the blame was laid on both parties you couldn't punish Google without punishing the NHS - and punishing a publicly funded organisation financially is bad for everyone. It's much more useful to ensure the issue can't happen again.

mvitorino 9y ago
While I agree with you, there is always the option of firing people responsible for the decisions.
- heavenlyblue 9y ago
  NHS isn't exactly in a position where they could easily fire anyone right now, as it seems.
- k-mcgrady 9y ago
  ICO doesn't have that power. They can prosecute people but only if they've deliberately breached the DPA and that doesn't seem to be the case here. The NHS should definitely hold the people responsible to account though.
  - pbhjpbhj 9y ago
    So, the system for protection of personal data in the NHS is broken then - if managers can choose to flout the law without any personal repercussions then that law is useless. IIRC you have to have a license to work with certain types of data, that person/those people need to lose grades to the point they have no controlling decision with respect to personal data. It shouldn't be up to their colleagues whether they get held responsible. I work in a craft studio and face a large fine - so I'm told - if I reveal personal data, or make that possible ... because perish the thought someone could learn you painted a piece of pottery, but reveal personal health information against patient wishes and nothing happens?
    - 9y ago

DanBC 9y ago

UK regulators take a light touch approach. They ask people to stop doing what they're doing; then if the behaviour continues they take further action. This has an advantage when action eventually is taken: the offender finds it harder to claim to not know what the law is, or that their behaviour is compliant with law.