Contracts for a number of coronavirus data deals that the U.K. government inked in haste with U.S. tech giants, including Google and Palantir, plus a U.K.-based AI firm called Faculty, have been published today by openDemocracy and law firm Foxglove — which had threatened legal action for withholding the information.
Concerns had been raised about what is an unprecedented transfer of health data on millions of U.K. citizens to private tech companies, including those with a commercial interest in acquiring data to train and build AI models. Freedom of Information requests for the contracts had been deferred up to now.
In a blog post today, openDemocracy and Foxglove write that the data store contracts show tech companies were “originally granted intellectual property rights (including the creation of databases), and were allowed to train their models and profit off their unprecedented access to NHS data.”
“Government lawyers have now claimed that a subsequent (undisclosed) amendment to the contract with Faculty has cured this problem, however they have not released the further contract. openDemocracy and Foxglove are demanding its immediate release,” they add.
https://twitter.com/Foxglovelegal/status/1268901855880450050
They also say the contracts show that the terms of at least one of the deals — with Faculty — were changed “after initial demands for transparency under the Freedom of Information Act.”
They have published PDFs of the original contracts for Faculty, Google, Microsoft and Palantir. Amazon Web Services was also contracted by the NHS to provide cloud hosting services for the data store.
Back in March, as concern about the looming impact of COVID-19 on the UK’s National Health Service (NHS) took hold, the government revealed plans for the health service to work with the aforementioned tech companies to develop a “data platform” — to help coordinate its response, touting the “power” of “secure, reliable and timely data” to inform “effective” pandemic decisions.
However the government’s lack of transparency around such massive health data deals with commercial tech giants — including the controversial firm Palantir, which has a track record of working with intelligence and law enforcement agencies to track individuals, such as supplying tech to ICE to aid deportations — raises major flags.
As does the ongoing failure by the government to publish the amended contracts — with the claimed tightened IP clauses.
The (now published, original) Google contract — to provide “technical, advisory and other support” to NHSX to tackle COVID-19 — is dated March 1, and specifies that services will be provided by Google to the NHS for zero charge.
The Palantir contract, for provision of its Foundry data management platform services, is dated as beginning March 12 and expiring June 11 — with the company charging a mere £1 ($1.27) for services provided.
While the Faculty contract — providing “strategic support to the NHSX AI Lab” — has a value in excess of £1M (including VAT), and an earlier commencement date (February 3), with an expiry date of August 3.
The government announced its plan to launch an AI Lab within NHSX, the digital transformation branch of the health service, just under a year ago — saying then that it would plough in £250 million to apply AI to healthcare related challenges, and touting the potential for “earlier cancer detection, discovering new treatments and relieving the workload on our NHS workforce.”
The lab had been slated to start spending on AI in 2021. Yet the Faculty contract, in which the AI firm is providing “strategic support to the NHSX AI Lab,” and described as an “AI Lab Strategic Partner,” suggests the pandemic nudged the government to accelerate its plan.
Update: Faculty has now sent the following statement regarding the amended contract:
As is standard for contracts procured through GCloud, Faculty’s contract for the NHS AI lab already gives the NHS an indefinite licence to the intellectual property (IP) arising from the project meaning the NHS has free use of any software created for the project, even after the contract ends.
However, we felt this did not go far enough. Faculty therefore asked for its contract to be amended to make clear that it will derive no commercial benefit from any software, including trained machine learning models, developed during the course of the project and that the use of the IP is under the sole control of the NHS. We have made this unprecedented move in recognition of the unique circumstances of the COVID-19 emergency and the overriding public interest in ensuring public trust in the responsible use of anonymised NHS data. Faculty is proud to be able to play its part in the data response to COVID-19.
We’ve reached out to the Department of Health with questions.
Last month, NHS England and NHS Improvement responded to an FOI request that TechCrunch filed in early April asking for the contracts — but only to say a response was delayed, already around a month after our original request. (The normal response time for U.K. FOIs is within 20 working days, although the law allows for “a reasonable extension of time to consider the public interest test.”)
Earlier this month, The Telegraph reported that Google-owned DeepMind co-founder Mustafa Suleyman — who has since moved over to work for Google in a policy role — was temporarily taken on by the NHS in March, in a pro bono advisory capacity that reportedly included discussing how to collect patient data.
An NHSX spokesperson told Digital Health that Suleyman had “volunteered his time and expertise for free to help the NHS during the greatest public health threat in a century,” and denied there had been any conflict of interest.
The latter refers to the fact that when Suleyman was still leading DeepMind the company inked a number of data-sharing agreements with NHS Trusts — gaining access to patient health data as part of an app development project. One of these contracts, with the Royal Free NHS Trust, was subsequently found to have breached U.K. data protection law. Regulators said patients could not have “reasonably expected” their information to be shared for this purpose. The Trust was also reprimanded over a lack of transparency.
Google has since taken over DeepMind’s health division and taken on most of the contracts it had inked with the NHS — despite Suleyman’s prior insistence that NHS patient data would not be shared with Google.
Comment