Did Google's NHS patient data deal need ethical approval?

Three weeks ago, New Scientist revealed that Google's artificial intelligence company DeepMind has access to the identifiable personal medical information of millions of UK patients through a data-sharing agreement with the Royal Free London NHS Foundation Trust. Now, a New Scientist investigation has found that Google DeepMind deployed a medical app called Streams for monitoring kidney conditions without first contacting the relevant regulatory authority. Our investigation also asks whether an ethical approval process that covers this kind of data transfer should have been obtained, and raises questions about the basis under which Royal Free is sharing data with Google DeepMind. DeepMind's partnership with the Royal Free provides it with fully identifiable information – including names, addresses and details of medical conditions – for the 1.6 million patients treated at Barnet, Chase Farm and the Royal Free each year. It also includes complete data on all patients treated by the trust in the past five years.