3 ms·

The UK ICO is one of the better regulators out there, and it seems the punishment (nothing) is proportionate to the actual harm done here (apparently none). But

The UK ICO is one of the better regulators out there, and it seems the punishment (nothing) is proportionate to the actual harm done here (apparently none). But this is still a sad outcome. The message that tech workers will take away from this sort of thing is "don't try to work with the NHS or do anything innovative in healthcare". DeepMind didn't appear to have any actual business plan in mind for Streams - all the stuff I read from them on this project implied it was driven simply by a desire to help the UK's national treasure/obsession. Being owned by Google does let important execs do pet projects like this so I don't see any need for conspiracy theories here. Both the ICO and the NHS are part of the government and yet they reached different decisions about the same laws, I expect DeepMind had their own legal advice which also concluded it was OK. It is unlikely any other company or startup could get a hard-and-fast 100% guaranteed correct deal with the NHS to do things with patient data. It's doubly unfortunate because the NHS has deeply dysfunctional IT and badly needs the assistance of data specialists. It faces huge challenges to become more efficient and shows little ability to do so. Healthcare records are still passed around on paper, the biggest IT failure in history was an attempt to digitise the NHS, medical data leaks all over the place and is guarded far more loosely than Google would ever consider, many genetic diseases are fairly rare and need a lot of data analysis to make progress on, and so on. Healthcare and the tech industry should be a match made in heaven. Instead the very, very few attempts to dance together inevitably seem to end badly.

dm319 9y ago
I mostly agree with you - healthcare and tech should absolutely be a match made in heaven, but here in the UK it's the ethics and data protection laws which make that so difficult. Even with explicit consent from patients (and this article states this was not the case), the rules make it very hard to work effectively with the data. I can give a couple of examples. [The 100'000 genomes project](https://www.genomicsengland.co.uk/the-100000-genomes-project/ https://www.genomicsengland.co.uk/the-100000-genomes-project...) is in the process of sequencing 100'000 genomes of patients with cancer and rare disease and will be the largest sequencing project in the world once completed. Because whole genome data can potentially identify a person and give information on conditions they have or might be prone to, their genomic data is seen as confidential. As a result, even with explicit patient permission, the data can only be accessed through a remote desktop onto a machine which does not have internet access, which makes working with some genomic tools (which rely on large databases) very problematic. I understand they're working on this, but it is just an example of the 'inconvenience' of abiding by security rules. Another example, with my own research, is that even with patient consent, the thumbs up from the ethics committee, and being clinically involved with patients (with a corresponding contract with the hospital), I am unable to store patient information on encrypted devices on university computers. Instead this must be stored on NHS computers, even though the analysis occurs on university computers. Having said all of that, there is a way to get really great data from many patients using NHS IT systems - [the million women study](http://www.millionwomenstudy.org/methods/ http://www.millionwomenstudy.org/methods/) successfully did this and have not run into any ethical/regulatory problems. That's because they did it the right way - i.e. it is formally registered as research, permission was asked and received from the regional ethics committee, patients were given information, both by paper and verbally, to ask for consent for the study. Of course this study was run by Oxford University, who, like other universities, know clearly the pitfalls and hoops of conducting research on patients. This is a whole world of bureaucracy (which has come about for good reasons), which tech companies will have to navigate and abide by if they wish to carry out human research.
DanBC 9y ago
> The message that tech workers will take away from this sort of thing is "don't try to work with the NHS or do anything innovative in healthcare" They shouldn't, because ICO has been clear that this decision should not deter people from this type of project, and that the modifications needed are relatively minor. https://iconewsblog.wordpress.com/2017/07/03/four-lessons-nhs-trusts-can-learn-from-the-royal-free-case/ https://iconewsblog.wordpress.com/2017/07/03/four-lessons-nh... https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... > and the NHS It wasn't "The NHS" (eg NHS England) but a single hospital trust. Many other NHS trusts and Caldicott Guardians expressed concern.

dm319 9y ago

I mostly agree with you - healthcare and tech should absolutely be a match made in heaven, but here in the UK it's the ethics and data protection laws which make that so difficult. Even with explicit consent from patients (and this article states this was not the case), the rules make it very hard to work effectively with the data. I can give a couple of examples. [The 100'000 genomes project](https://www.genomicsengland.co.uk/the-100000-genomes-project/ https://www.genomicsengland.co.uk/the-100000-genomes-project...) is in the process of sequencing 100'000 genomes of patients with cancer and rare disease and will be the largest sequencing project in the world once completed. Because whole genome data can potentially identify a person and give information on conditions they have or might be prone to, their genomic data is seen as confidential. As a result, even with explicit patient permission, the data can only be accessed through a remote desktop onto a machine which does not have internet access, which makes working with some genomic tools (which rely on large databases) very problematic. I understand they're working on this, but it is just an example of the 'inconvenience' of abiding by security rules. Another example, with my own research, is that even with patient consent, the thumbs up from the ethics committee, and being clinically involved with patients (with a corresponding contract with the hospital), I am unable to store patient information on encrypted devices on university computers. Instead this must be stored on NHS computers, even though the analysis occurs on university computers. Having said all of that, there is a way to get really great data from many patients using NHS IT systems - [the million women study](http://www.millionwomenstudy.org/methods/ http://www.millionwomenstudy.org/methods/) successfully did this and have not run into any ethical/regulatory problems. That's because they did it the right way - i.e. it is formally registered as research, permission was asked and received from the regional ethics committee, patients were given information, both by paper and verbally, to ask for consent for the study. Of course this study was run by Oxford University, who, like other universities, know clearly the pitfalls and hoops of conducting research on patients. This is a whole world of bureaucracy (which has come about for good reasons), which tech companies will have to navigate and abide by if they wish to carry out human research.

DanBC 9y ago

> The message that tech workers will take away from this sort of thing is "don't try to work with the NHS or do anything innovative in healthcare" They shouldn't, because ICO has been clear that this decision should not deter people from this type of project, and that the modifications needed are relatively minor. https://iconewsblog.wordpress.com/2017/07/03/four-lessons-nhs-trusts-can-learn-from-the-royal-free-case/ https://iconewsblog.wordpress.com/2017/07/03/four-lessons-nh... https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/07/royal-free-google-deepmind-trial-failed-to-comply-with-data-protection-law/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... > and the NHS It wasn't "The NHS" (eg NHS England) but a single hospital trust. Many other NHS trusts and Caldicott Guardians expressed concern.