July 3, 2017

expert reaction to Information Commissioner’s Office (ICO) ruling on Royal Free Hospital and DeepMind Health sharing of patient data

A UK hospital did not do enough to protect the privacy of patients with it shared data with Google, the UK’s Information Commission (ICO) has ruled.

Prof. Nils Hoppe, Professor of Ethics and Law in the Life Sciences, University of Hannover, said:

“It is interesting to note that the ICO responded with requiring the Royal Free to give an undertaking, rather than imposing a fine. This is in line with the ICO’s very constructive and thoughtful response to Royal Free’s and DeepMind’s data sharing arrangement. At the same time this matter highlights a problem which we will encounter with increasing frequency: modern, big data-based health research struggles with antiquated models of fully informed consent. The type of research in issue here is of great benefit to society as a whole and it should be a priority to develop novel approaches to data governance which strike an appropriate balance between the autonomy of the patient, and the significant benefit we can expect from this type of data sharing.”

Ms Aisling Burnand, Chief Executive of the Association of Medical Research Charities (AMRC), said: 

“We hope this decision paves the way for more clarity around the use of patient data. We know how vital patient data can be to medical research but also how important the safeguarding of it is. Although a blog from the Information Commissioner offers some advice on this thorny issue, we believe clear, firm guidelines are still needed.”

Ms Nicola Perrin, Head of Understanding Patient Data, said:

“The ICO’s constructive approach will help ensure that new digital technologies can be introduced in an appropriate way to provide better clinical care.  Key lessons – the need for transparency, public engagement and proportionate use of data – must be learnt, so that everyone can have confidence that patient data is being used responsibly.  It is good that both DeepMind and Royal Free have recognised that mistakes were made, and are now taking steps to address the concerns. The ICO ruling makes clear that data protection and innovation can work together for the benefit of patients.”

Declared interests

Prof. Nils Hoppe: Self-employment: consultant lawyer in the life sciences. Grant funding: EU-funded research (incl. some EFPIA funded research (pharma industry)), otherwise publicly funded research only. Voluntary appointments: member of the UK Biobank Ethics and Governance Council (MRC and Wellcome Trust); External EU expert for ethics in biomedicine. Memberships: Royal Society of Medicine; Chartered Institute of Arbitrators

Ms Aisling Burnard: DeepMind hosted an event for AMRC in February, but other than that no conflicts of interest to declare.

Ms Nicola Perrin: Is Head of Understanding Patient Data, which receives funding from Wellcome, the MRC, Department of Health, ESRC, and Public Health England.