Google Inc.’s DeepMind team formed a partnership with the U.K. National Health Service to streamline healthcare using artificial intelligence in November, but the project has hit a major legal roadblock.

The U.K.’s Information Commissioner Office, a government organization that regulates data privacy, has determined the DeepMind’s access to citizen health records is not legal.

DeepMind was using the data to build Streams (pictured), an AI-powered healthcare system that would make it easier for doctors to keep charge of patients’ medical history and test results in real time, allowing doctors to act quickly and respond to new developments. The ICO agreed that once DeepMind’s system was complete, the company’s access to health data would be perfectly legal, but it said that DeepMind could not use personal health information simply to develop its AI.

Dame Fiona Caldicott, who oversees health data privacy at the U.K.’s Department of Health, issued a letter to DeepMind in May informing the company that its access to health data may have “inappropriate legal basis,” saying that “Streams was going through testing and therefore could not be relied upon for patient care.”

Today, the ICO officially confirmed its ruling the DeepMind’s access was illegal, but the regulator also admitted that the laws regarding data privacy are sometimes vague and difficult to understand, especially when it comes to new technology like AI.

“There’s no doubt the huge potential that creative use of data could have on patient care and clinical improvements, but the price of innovation does not need to be the erosion of fundamental privacy rights,” said Elizabeth Denham, information commissioner at the ICO. “Our investigation found a number of shortcomings in the way patient records were shared for this trial. Patients would not have reasonably expected their information to have been used in this way, and the Trust could and should have been far more transparent with patients as to what was happening.”

Denham added that the ICO has asked the Trust to make changes to address those shortcomings. “The Data Protection Act is not a barrier to innovation, but it does need to be considered wherever people’s data is being used,” she said.

DeepMind responded to the ruling in a statement, saying, “We welcome the ICO’s thoughtful resolution of this case, which we hope will guarantee the ongoing safe and legal handling of patient data for Streams.”

The ICO’s decision primarily centered on DeepMind’s partner in the Stream project, the Royal Free London NHS Foundation Trust, which is a coalition of U.K. hospitals. DeepMind noted in its statement that the ICO recognized that many of the issues it found with the Royal Free have already been corrected, and that “no issues have been raised about the safety or security of the data.”

Photo: Google