Google DeepMind, Royal Free London rapped for patient data sharing

The Royal Free London NHS Foundation Trust improperly shared the personal medical records of approximately 1.6 million patients with Google subsidiary DeepMind without adequate legal basis or transparent consent, prompting regulatory action and broader debate over healthcare data governance. What happened In 2015, the Royal Free London NHS Foundation Trust entered a partnership with Google’s DeepMind to develop and deploy the Streams mobile application, designed to help clinicians detect acute kidney injury more rapidly. As part of this collaboration, the trust transmitted identifiable patient data, including names, NHS numbers, dates of birth and clinical information for roughly 1.6 million patients, to DeepMind for testing and development of the app. The UK Information Commissioner’s Office investigated following public complaints and media scrutiny, ruling in July 2017 that the data sharing “failed to comply with the Data Protection Act” because patients were not adequately informed and the trust lacked a proper legal basis for processing their records for the app’s development and testing, not solely for direct patient care. While no fines were imposed at that time, the ICO required the trust to commit to corrective actions, including conducting a privacy impact assessment, commissioning an independent audit of the trial, and establishing a lawful basis for future data processing. Why it happened The incident was driven by a "rush to innovate" that bypassed established regulatory safeguards. Transparency failures: Both the Trust and DeepMind operated with a lack of openness, with the deal only coming to light after an investigation by New Scientist in 2016. Accountability gaps: DeepMind admitted they "underestimated the complexity of the NHS" and focused almost exclusively on building tools for clinicians while ignoring their accountability to the public. Corporate ambition: Critics argued that DeepMind sought to "prove" its general AI capabilities and secure a foothold in the lucrative healthcare market by using a "one-way mirror" approach—gaining access to public data without allowing the public to track how that data influenced corporate decision-making or commercial products. What it means For the patients whose data was shared, the ruling underscored the importance of clear notice, consent and legal frameworks governing the use of sensitive health information. It also raised concerns about patient trust and autonomy in digital health innovations. For healthcare providers and technology partners, the case served as a cautionary lesson about strict compliance with data protection laws and the necessity of transparent engagement with patients and regulators when integrating AI and analytics into clinical settings. More broadly, the incident contributed to intensified scrutiny of how tech firms access and use health data globally, influencing debates on data governance, privacy rights, and ethical frameworks for AI in healthcare. It highlighted that even well‑intentioned innovation must operate within robust legal and ethical boundaries to maintain public confidence and protect individual rights. System 🤖 Streams Developer: Google; NHS Country: UK Sector: Health Technology: Prediction algorithm Purpose: Detect & predict acute kidney disease Issue: Accountability; Alignment; Privacy; Security; Transparency Resource s 📃 Royal Free London (2019). Information Commissioner’s Office (ICO) investigation Royal Free London (2018). Royal Free London publishes audit into Streams app Google Deepmind (2018). Scaling Streams with Google Google Deepmind (2017). The Information Commissioner, the Royal Free, and what we’ve learned Timeline ⏰ May 2016. The New Scientist reveals that Deepmind had failed to secure approval from the Confidentiality Advisory Group of the Medicines and Healthcare Products Regulatory Agency. July 2017. The UK Information Commissioner's Office rules that the Royal Free hospital had failed to comply with the UK

Date it happened

2016-04-01

Organisation involved

Royal Free London NHS Foundation Trust

Product, system or model

Streams

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.