Royal Free breached UK data law in 1.6m patient deal with Google's DeepMind

Information Commissioner's Office rules record transfer from London hospital to AI company failed to comply with Data Protection Act

London's Royal Free hospital failed to comply with the Data Protection Act when it handed over personal data of 1.6 million patients to DeepMind, a Google subsidiary, according to the Information Commissioner's Office.

The data transfer was part of the two organisation's partnership to create the healthcare app Streams, an alert, diagnosis and detection system for acute kidney injury. The ICO's ruling was largely based on the fact that the app continued to undergo testing after patient data was transferred. Patients, it said, were not adequately informed that their data would be used as part of the test.