Trustworthy Governance and Commercial Users of Health Data: What is a reasonable expectation of privacy?

Abstract

There is evidence that people are increasingly unwilling to share health data, especially with commercial end users including tech companies. This comes at a time when many of the benefits associated with big data and machine learning in the healthcare context are reliant upon such sharing. How can law and governance establish the conditions for sharing health data, including with commercial end users, while protecting a reasonable expectation of privacy?

In this presentation I consider the requirements for ‘Trustworthy Governance’ and how English law currently protects a reasonable expectation of privacy. I suggest that the legal tools necessary to protect and promote public confidence may already exist, but we currently lack agreement on how to interpret and apply them. If we can establish what it is reasonable to expect of commercial users, at least in relation to the vulnerabilities that they create, then we can move to ensure that they only process health data for purposes patients and public have reason to expect and agree to be appropriate. Until we do this, it will be difficult to achieve the benefits of sharing whilst protecting public trust in a confidential healthcare service.