That the Google-owned artificial intelligence company DeepMind obtained the personal medical records of 1.6 million patients on a “legally inappropriate” basis is unnerving. The complacency of both the NHS in north London and Google in the face of basic principles of privacy is remarkable. Why weren’t alarm bells ringing? The reason is the overwhelming asymmetry between a wealthy, technologically supercilious firm and overstretched public services in possession of our most sensitive, identifiable data.
DeepMind said it was designing an app that would diagnose acute kidney injuries early and therefore was entitled to all patient data, because it was, like a physician, offering direct care. In her first ever ruling, the national data guardian, Dame Fiona Caldicott, disagreed, saying the transfer was in effect unlawful.
It is now up to the information commissioner’s office to decide whether to fine Google’s AI division, the NHS or both. It should levy the maximum penalty of £500,000, the amount of revenue Google clocks up in four minutes, and accompany this by a strong admonition of Silicon Valley’s unacceptable behaviour.
