Caldicott had written to the RFH in December explaining that she was advising the Information Commissioner’s Office on the common law duty of confidentiality around the sharing of identifiable medical records where consent is implied for the purpose of direct care. She said:
My view is that when work is taking place to develop new technology this cannot be regarded as direct care, even if the intended end result when the technology is deployed is to provide direct care. Implied consent is only an appropriate legal basis for the disclosure of identifiable data for the purposes of direct care if it aligns with people’s reasonable expectations, i.e. in a legitimate relationship.
If the ICO, which is probing the transfer of information, agrees with Calidcott that there was no legal basis for the records to be shared with DeepMind, then Google will be required to delete the data.
Powis was told in December that Caldicott “did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis.”
The professor told Sky News that the RFH was grateful for the DP adviser’s support, adding that it would “absolutely welcome further guidance on this issue.”
DeepMind’s clinical chief, Dr. Dominic King, said: “At no point has any patient data been shared with other Google products or services, or used for commercial purposes.
“I think one thing that we do recognise that we could have done better is make sure that the public are really informed about how their data is used.”