"Those involved must answer for it": Major inquiry begins into "illegal" AI trial

Several parties are now demanding answers over a hidden AI trial run by Danish healthcare regions, in which patient data was shared with third parties. Ingeniøren, which broke the story, reports that Datatilsynet, the Danish data protection authority, is stepping in over the sharing of 100,000 patient messages without any assessment of the risk to citizens' data. Regional politicians are also pressing for answers.

The affected patients did not know that an AI had access to thousands of their confidential messages. According to Ingeniøren, neither the regional councils nor Datatilsynet were told about the trial at any point before the paper revealed it. Related coverage describes parents of sick children who were told nothing, and lists the hospital departments that shared confidential data in a project described as "illegal."

Ingeniøren has repeatedly asked the two regions involved for an interview. Instead, the Capital Region's Center for IT and Medical Technology replied in writing on behalf of both. It said it is still Region Hovedstaden's assessment that the project was carried out lawfully within the framework of GDPR, and that this applied across departments.

Reader comments point to the central legal questions. One commenter argues that a data protection impact assessment under GDPR Article 35 should have been done before the project began, with Datatilsynet consulted if the risks could not be reduced. Another argues that training an American AI model, in this case Microsoft's, is not the purpose the data was collected for. A third questions whether "shared" is the right word, since the messages sit in the MinSundhedsplatform system and were processed technically. These are reader views, not findings.

The chairs of the regions maintain that AI can matter greatly for healthcare. Lars Gaardhøj wrote that this must never come at the expense of protecting patients' data, and that the region must keep a strong focus on security and on complying with the rules.