Google DeepMind received 1.6 million NHS patient records through a legally inappropriate deal (GOOG)

DeepMind, a London-based artificial intelligence (AI) research lab acquired by Google in 2014 for £400 million, was quietly given access to 1.6 million NHS patient records in 2015 to help it develop a mobile app called Streams on the legal basis that it was offering "direct care."

Legally speaking, patients are "implied" to have consented to their medical records being shared if it was shared for the purpose of "direct care."

But Caldicott, the UK's health data regulator, wrote in her letter: "When I wrote to you in December, I said that I did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis."

Caldicott, who does not dispute the app's ability to help clinicians save lives today, added: "Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application may have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer.

"My considered opinion therefore remains that it would not have been within this reasonable expectation of patients that their records would have been shared for this purpose."

The letter, which DeepMind expected to be published last Friday, was sent by email to people including DeepMind cofounder Mustafa Suleyman and DeepMind strategy lead, Will Cavendish.

A spokesperson for the National Data Guardian confirmed to Business Insider that the letter is real.

Privacy campaign group medConfidential said in a statement: "Google's lawyers are expensive, but 'inappropriate legal basis' is still a euphemism for unlawful."

The National Data Guardian, which was set up to help ensure that citizens' confidential medical information is safeguarded securely and used properly, explained at the end of the letter that she would be passing on her views to the Information Commissioner, Elizabeth Denham, who is the data protection officer of the UK.

The Information Commissioner's Office is carrying out its own investigation into whether the data transfer between from Royal Free to DeepMind was legal under the Data Protection Act. A verdict is expected to be made public in the coming weeks.

Streams is a clinical app designed to help clinicians identify and treat patients as quickly as possible. It pulls together patient information and generates an automatic alert when a problem is detected. It does not make use of DeepMind's AI or machine learning technologies.

Dominic King, the clinical lead at Google DeepMind, told Sky News: "It's really important to say that DeepMind is a British company, and although acquired by Google, operates independently. At no point has any patient data been shared with other Google products or services, or used for commercial purposes.

"I think one thing that we do recognise that we could have done better is make sure that the public are really informed about how their data is used."

A spokesperson for DeepMind Health sent Business Insider the following statement:

Google DeepMind's first deal with Royal Free London was torn apart in an academic paper published in March. The "Google DeepMind and healthcare in an age of algorithms" paper — coauthored by Cambridge University's Julia Powles and The Economist's Hal Hodson — questioned why DeepMind was given permission to process millions of NHS patient records so easily and without patient approval. It concluded that the deal was riddled with "inexcusable" mistakes.

A spokesperson for the Royal Free London sent the following statement to Business Insider:

A spokesperson for the National Data Guardian for Health and Care (NDG) told Business Insider:

Google DeepMind received 1.6 million NHS patient records through a legally inappropriate deal (GOOG)

Enhance Your Pulse News Experience!

JOIN OUR PULSE COMMUNITY!