The Information Commissioner’s Office has ruled the Royal Free NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google-owned artificial intelligence (AI) firm DeepMind.
The ICO began an investigation into the deal in May 2016, after receiving a complaint from a member of the public.
The deal gave DeepMind access to the healthcare records of 1.6 million patients that pass through three hospitals in North London, which fall under the care of the Royal Free Hospital Trust, as part of a trial to test an alert, diagnosis and detection system for acute kidney injury.
Despite assurances Google could not use the data in any other part of its business; that the data is stored in the UK by a third party, and that all data will be deleted when the agreement expires at end of September 2017, the data sharing agreement raised concerns when it was first brought to public attention.
At the time, a spokesperson for the Royal Free said that, although patients would not be aware that data was being made available, it would be encrypted and such an arrangement was standard practice.