David Davis's privacy arguments have no backbone
This is a guest post by Frank Fisher
If you're going to declare war on a corporation, you might as well pick on someone big, and at first glance David Davis has done just that with his Times attack on mooted Tory plans to scrap the NHS “spine” and store health data with Google. A spot of populist rabble rousing never hurts a backbencher's public profile, and with a target like Google matched to a lexicon of attack buzzwords like "privacy", "trust" and even "database", it's rabble rousing with a civil libs edge, and that's the flavour of the month. But a closer reading of a really quite finely detailed piece presents a much more nuanced and less confrontational picture.
For one, Davis doesn't actually dismiss the idea of private companies handling confidential patient records at all; he just wants a secure framework in which it might happen. For another, his arguments in favour of that tally less with the notion of handing the job to another, perhaps "nicer" corporation, like Microsoft (snigger), than with the prevailing mood for data storage/retrieval in IT circles; making use of the Cloud.
A wise stance, as scrap with Google if you like, but taking on the Cloud People is foolhardy. Those pushing for distributed storage aren't just doing so with commercial gain in mind, they're zealots. The Cloud isn't just a means to an end, it is an end. Distributed processing, distributed applications, distributed storage, distributed risk, distributed targets, distributed ownership - it makes a lot of sense, commercially, ethically, technically. But where it won't make sense is to government, to quangos, and to the civil, and not so civil, servants who figure a patient's data belongs to almost anyone except that patient.
Sadly, without an innovative and genuinely cutting edge approach from NHS IT providers and developers - and we've seen little of that to date - it won't make sense in practical terms for this particular application either. Why? Because unlike other personal data, health records must be accessible by third parties - even against the key record owner's will. You could be comatose, insane, or carrying an illness that might affect others beside yourself. Hey, get off your high horse, privacy advocates; medical ethics apply to patients too, I reckon, and harming another individual by withholding information... well I don't care if it is embarrassing or upsetting, it's a moral no-no. And because unlike other personal data, these third parties need uniform, regularised access to it, their unique identifier, probably your NHS number, should be able to draw on your records, no matter where you might have stored them: with Google, with the NHS, sitting in your shared P2P drive, anywhere else in the Cloud - and sure, that's doable. Place a secure escrow layer between your GP and your data that has your NHS number on one side, your data path on the other, and you have a nice smooth app that delivers flexibility, security, and gives you limited control of your own data. But it ain't going to happen - a cutting edge app developed by the NHS's favoured suppliers? These are the people who built the swine flu panic site in classic ASP...
No, unfortunately a more traditional answer will have to do - and that may well be Google, as Davis knows. And he sees the value in it. Let's look at one line again, where he's ruling out many of the ways in which Google could, but won't be allowed to, make money: “That means it should not be sold on, it should not be data mined for commercial insights, and it should not be used for targeted advertising.” Firm words. But in fact, the biggest money earner with this kind of data wouldn’t be any of those – it would be data mining for medical insights. A practice the pharmaceutical giants carry out every day. And that of course returns them income in the long run – but only when it benefits medical care – and wouldn’t appear to be ruled out in DD’s little list. Call me a cynic, but that’s no oversight. And a good thing too.
When therapies are becoming ever more targeted, when genetic groupings even at national levels are proven to work with or against certain compounds and therapies (as an example, there are compounds licensed for use in China that have no better than placebo value against the same conditions in European populations), when contra-indications are springing up unnoticed from products taken in combination, you really want the largest pool of patient data possible to sift, mine, crunch. An NHS archive would be extremely valuable for this. Hugely so. And is that a bad thing? Why? Altruism is supposed to be good, right? Why wouldn’t you want your data crunched, if it could benefit others? What harm would it do?
Anonymisable data stored with Google, Microsoft, or even in the Cloud would be a valuable resource – easy to imagine cash changing hands to get at it. For some this seems to produce an instinctive fear – anger even. But if they’d donate blood, why not data?
There’s a lot of tosh talked about privacy – and Davis is as guilty as any; people up in arms about Google Streetview, yet also annoyed that we can’t take a photo of a copper - reconcile those two views. Privacy is both an abstract and a practical concept; reality and theory, and it works for both you, and I. Both us, and them. In the field of medical information it seems to me that some necessary loss of privacy is legitimate, to advance medicine, so too is some degree of potential loss, for practical administrative reasons, to support data transfer, access, recovery. The big question would then appear to be, is the private sector more or less able than the public sector to deliver a working system that ensures privacy loss, and privacy loss risks, are as low as possible. The answer has to be a big vote of confidence in the private sector. I may not trust Google a great deal more than David Davis does, but I trust them a damn sight more than I’d trust the NHS.
©Frank Fisher
If you're going to declare war on a corporation, you might as well pick on someone big, and at first glance David Davis has done just that with his Times attack on mooted Tory plans to scrap the NHS “spine” and store health data with Google. A spot of populist rabble rousing never hurts a backbencher's public profile, and with a target like Google matched to a lexicon of attack buzzwords like "privacy", "trust" and even "database", it's rabble rousing with a civil libs edge, and that's the flavour of the month. But a closer reading of a really quite finely detailed piece presents a much more nuanced and less confrontational picture.
For one, Davis doesn't actually dismiss the idea of private companies handling confidential patient records at all; he just wants a secure framework in which it might happen. For another, his arguments in favour of that tally less with the notion of handing the job to another, perhaps "nicer" corporation, like Microsoft (snigger), than with the prevailing mood for data storage/retrieval in IT circles; making use of the Cloud.
A wise stance, as scrap with Google if you like, but taking on the Cloud People is foolhardy. Those pushing for distributed storage aren't just doing so with commercial gain in mind, they're zealots. The Cloud isn't just a means to an end, it is an end. Distributed processing, distributed applications, distributed storage, distributed risk, distributed targets, distributed ownership - it makes a lot of sense, commercially, ethically, technically. But where it won't make sense is to government, to quangos, and to the civil, and not so civil, servants who figure a patient's data belongs to almost anyone except that patient.
Sadly, without an innovative and genuinely cutting edge approach from NHS IT providers and developers - and we've seen little of that to date - it won't make sense in practical terms for this particular application either. Why? Because unlike other personal data, health records must be accessible by third parties - even against the key record owner's will. You could be comatose, insane, or carrying an illness that might affect others beside yourself. Hey, get off your high horse, privacy advocates; medical ethics apply to patients too, I reckon, and harming another individual by withholding information... well I don't care if it is embarrassing or upsetting, it's a moral no-no. And because unlike other personal data, these third parties need uniform, regularised access to it, their unique identifier, probably your NHS number, should be able to draw on your records, no matter where you might have stored them: with Google, with the NHS, sitting in your shared P2P drive, anywhere else in the Cloud - and sure, that's doable. Place a secure escrow layer between your GP and your data that has your NHS number on one side, your data path on the other, and you have a nice smooth app that delivers flexibility, security, and gives you limited control of your own data. But it ain't going to happen - a cutting edge app developed by the NHS's favoured suppliers? These are the people who built the swine flu panic site in classic ASP...
No, unfortunately a more traditional answer will have to do - and that may well be Google, as Davis knows. And he sees the value in it. Let's look at one line again, where he's ruling out many of the ways in which Google could, but won't be allowed to, make money: “That means it should not be sold on, it should not be data mined for commercial insights, and it should not be used for targeted advertising.” Firm words. But in fact, the biggest money earner with this kind of data wouldn’t be any of those – it would be data mining for medical insights. A practice the pharmaceutical giants carry out every day. And that of course returns them income in the long run – but only when it benefits medical care – and wouldn’t appear to be ruled out in DD’s little list. Call me a cynic, but that’s no oversight. And a good thing too.
When therapies are becoming ever more targeted, when genetic groupings even at national levels are proven to work with or against certain compounds and therapies (as an example, there are compounds licensed for use in China that have no better than placebo value against the same conditions in European populations), when contra-indications are springing up unnoticed from products taken in combination, you really want the largest pool of patient data possible to sift, mine, crunch. An NHS archive would be extremely valuable for this. Hugely so. And is that a bad thing? Why? Altruism is supposed to be good, right? Why wouldn’t you want your data crunched, if it could benefit others? What harm would it do?
Anonymisable data stored with Google, Microsoft, or even in the Cloud would be a valuable resource – easy to imagine cash changing hands to get at it. For some this seems to produce an instinctive fear – anger even. But if they’d donate blood, why not data?
There’s a lot of tosh talked about privacy – and Davis is as guilty as any; people up in arms about Google Streetview, yet also annoyed that we can’t take a photo of a copper - reconcile those two views. Privacy is both an abstract and a practical concept; reality and theory, and it works for both you, and I. Both us, and them. In the field of medical information it seems to me that some necessary loss of privacy is legitimate, to advance medicine, so too is some degree of potential loss, for practical administrative reasons, to support data transfer, access, recovery. The big question would then appear to be, is the private sector more or less able than the public sector to deliver a working system that ensures privacy loss, and privacy loss risks, are as low as possible. The answer has to be a big vote of confidence in the private sector. I may not trust Google a great deal more than David Davis does, but I trust them a damn sight more than I’d trust the NHS.
©Frank Fisher
Comments