So the data deal between Royal Free London NHS Foundation Trust and DeepMind 鈥渇ailed to comply with鈥� the law. So says the Information Commissioner鈥檚 Office (ICO), the UK regulator charged with upholding data protection rules.
The deal, the ICO said, erred in several ways. Royal Free should have notified its patients before handing their data to DeepMind, giving them a chance to opt out. Given that the deal was with a subsidiary of Google parent company Alphabet, Royal Free ought to have closely examined the privacy implications before signing it.
It also said the volume of data shared, 1.6 million identifiable patient records, was not proportionate to the work being done, of testing an app.
Advertisement
The ruling vindicates New 厂肠颈别苍迟颈蝉迟鈥�s reporting from April 2016, which revealed the true extent of the data transfer and questioned its validity.
However, there are broader questions about the involvement of DeepMind and other technology companies with the NHS that run far deeper than data protection. These are questions about the kind of digital health services people want. How should the value of NHS datasets be accounted for in deals with these firms? How can we ensure that the open standards DeepMind and others are working on serve the needs of patients, and allow new players to enter the market? How much control do American parent corporations have over their UK-based subsidiaries?
Flawed deal
Data protection law and the ICO cannot answer these questions. The ICO鈥檚 role is to enforce data protection law, so naturally its verdict does not touch on issues of competition, or address whether the public is getting good value for its data. Monday鈥檚 ruling must be the beginning of a much bigger discussion about how large technology companies use health data, not a final line drawn under a flawed deal.
It may seem specious to talk about monopolies and competition when DeepMind鈥檚 involvement with the NHS is barely a year old, but look to other digital services for an example of how fast digital firms can dominate.
WhatsApp took just a few years to become the chat app of choice for hundreds of millions of people, and was then bought by Facebook. It has taken Facebook itself 10 years to amass 2 billion users, and become the only social network that really matters in Europe and America. Alphabet, DeepMind鈥檚 parent, owns the only search engine that matters, Google.
What DeepMind is building for NHS hospitals is not just an app, it is infrastructure. Just like railways and electricity networks, there is only so much space available for vital infrastructure, even in the digital realm. No company is going to compete with Network Rail by building a second railway grid in the UK, just as no chat app can really compete with Facebook by building a WhatsApp competitor.
It seems likely that health analytics companies will have a hard time competing with DeepMind if it owns and runs the infrastructure they are trying to interface with. Interopen, a new health data standards body in the UK, will go some of the way to addressing these concerns. It may or may not be a good idea for DeepMind to build, run and control core NHS infrastructure. But it would be a bad idea for DeepMind to build, run and control core NHS infrastructure with no public debate on how that ought to be done.
Public debate
Turning that public debate into workable regulation goes far beyond the remit of the ICO. We have Ofcom and Ofgem for regulating British communication and energy networks. We may now also need Ofdim, the Office of Digital Markets.
All this chimes with last week鈥檚 saying the existing framework for governing the wider management and use of data cannot keep pace with technological advances.
The agglomeration of power and influence online is already taking a toll. The rest of the media industry has suffered, as the vast majority of online advertising spend now flows through either Facebook or Google. Facebook and Google hold disproportionate power when it comes to informing and influencing the public. Facebook鈥檚 own research shows that it can meaningfully influence voter turnout by tweaking its interfaces around elections.
We cannot afford to wait and see if analogous harms arise from digital healthcare platforms. Solid foundations for the industry must be laid now. These are serious discussions with wide implications 鈥� are new regulations needed, or the stimulation of competition in digital health services? It is a sorry state of affairs when a few large companies hold effective control of information dissemination in the rich world. Effective control of the delivery of healthcare would be worse.
Read more: 6 technology pledges that should be in every political manifesto
