Royal Free breached UK data law in 1.6m patient deal with Google's DeepMind

London's Royal Free hospital failed to comply with the Data Protection Act when it handed over personal data of 1.6 million patients to DeepMind, a Google subsidiary, according to the Information Commissioner's Office. The data transfer was part of the two organisation's partnership to create the healthcare app Streams, an alert, diagnosis and detection system for acute kidney injury. The ICO's ruling was largely based on the fact that the app continued to undergo testing after patient data was transferred. Patients, it said, were not adequately informed that their data would be used as part of the test. "Our investigation found a number of shortcomings in the way patient records were shared for this trial," said Elizabeth Denham, the information commissioner.