Reference no: EM132858451

CST4080 Legal, Ethical and Security Aspects of Data Science - Middlesex University

Assessment Brief - Case study on legal aspects of Data Science

CASE STUDY

GoldCare Ltd, is a healthcare company in Manchester (UK), that provides clinical treatment to thousands of patients for a variety of health conditions. They employ many medical professionals and administrative staff including one data controller. Two months ago, the data controller discovered a cyberattack that resulted in an extensive data beach. The company had no incident response protocol for dealing with breaches, and fearing bad publicity the manager decided to keep it quiet.

The management of GoldCare Ltd recently expanded the centre to include the establishment of a new data science department to pursue research and data analyses. This new department employs data scientists and uses machine learning/deep learning among other Artificial Intelligence techniques for many activities including: profiling of patients; monitoring of patients, analysis and prediction of patient healthcare needs; and assessing the effectiveness of various treatments. The department also installed a new IT system, and developed new services and processes that all involve the collection and use of medical and non-medical data. The data is obtained from patients and other places including numerous online and offline documents. GoldCare Ltd also has an online databank consisting of anonymised data produced by their data science department. They provide access to this databank to researchers and other medical professionals. Everyone needing access must sign a special licence agreement (attached).

QUESTION 1

(a) A former disgruntled worker at GoldCare Ltd recently informed the Information Commission's Office (ICO) of the cyberattack at GoldCare Ltd. Following the tip-off the IOC sent an Information Notice to GoldCare Ltd asking for the following: (a) to provide their security audit logs for the past two years and (b) to provide the content of any communications with their lawyers regarding their liabilities under the Data Protection law. Discuss the legality of the following conduct by GoldCare Ltd, citing appropriate sections of relevant laws.

(i) GoldCare Ltd remained quiet about their cyberattack.
(ii) GoldCare Ltd edited their security logs to remove any evidence of the data breach that they experienced, before submitting the logs to the Information Commissioner.
(iii) GoldCare Ltd, told the ICO that would not disclose any communications which they had with their lawyers.

(b) A patient named Debra recently received a letter inviting her to join a new gym at a cost of £40 per month which was a special rate for diabetic people. She was surprised when she received the letter since she was not aware that she was a diabetic. Later she wrote to GoldCare Ltd, asking them for a copy of all personal information that they had about her. After receiving the information she found out that she was listed as a diabetic, her telephone number was incorrect and that she was referred to as "chubby". Advise Debra on her legal position regarding the following below citing appropriate legislation.

(i) She wants to stop GoldCare Ltd from using her information to target her to buy products/services.
(ii) She is concerned about her incorrect telephone number and wants it corrected.
(iii) She wants to have the reference to her as "chubby" removed from her record.
(iv) She would like to have her medical records transferred to a new doctor in a new medical centre.

QUESTION 2

In the context of Intellectual property law, advise GoldCare Ltd on the legality of undertaking the following actions. In your answers, please cite relevant legal authority.

(i) GoldCare Ltd wants to include in their portfolio of company excellence, a paper written by an employee, but without the name of the employee as the author. The employee insists that his name should also appear on the paper as the author. His employment contact does not address such an issue.

(ii) A researcher at BestHeath wants to perform text and data mining on information extracted from a database that they legally access. The licence agreement does not address the issue of text and data mining.

(iii) BestHeath was recently approached by a company Medix Ltd about developing a new medical device. After signing a non-disclosure agreement with Medix Ltd, they held three secret meetings where Medix Ltd disclosed their ideas for the new medical device. Later talks broke down due to disagreement over financial issues. GoldCare Ltd now wants to use the ideas that were in the discussions to develop a similar medical device.

(iv) GoldCare Ltd wants to import a drug from Mexico, although they are aware that the drug is manufactured without a from licence from the UK pharmaceutical company that developed the drug.

(v) GoldCare Ltd wants to use a trade mark similar to the trade mark of another UK company, in order to trick customers into buying similar products produced by the other company.

QUESTION 3

Comment on the legality of the actions taken my various RECIPIENTS (R1, R2, R3, R4, A5,) party to the GoldCare Databank licence agreement. In your answer you must reference specific sections in the licence agreement.

(a) RECIPIENT R1 recently received an email from the GoldCare Data Manager informing them that they would not be able to access the database during the morning of the next day due to database updating processes and that no downloading of data was allowed at that time. On the morning of the next day due to an emergency need to complete a report an R1 staff member attempted to access the database and found that it was accessible. The staff member therefore quickly downloaded 2GB of data needed to complete his report.

(b) RECIPIENT R2 is a company in Germany and it has been unable to access the Data Bank for over six weeks resulting in loss of revenue. After many calls to GoldCare Ltd, R2 were still unable to gain access and accused GoldCare Ltd of not honouring their duty to provide data under the licence agreement. They therefore launched a lawsuit against GoldCare Ltd in the German courts.

(c) Before signing the licence agreement RECIPIENT R3 was told by a sales representative for GoldCare Ltd, that the databank is always available for access 24 hours a day and 7 days a week without any interruptions. Due to daily interruptions in access over the past two months RECIPIENT R3 decided to sue GoldCare Ltd for not having the access promised by the sales representative.

(d) RECIPIENT R4 consists of 50 people working on various projects. All have access to the GoldCare databank and are free to download data at any time without restrictions. The username and password details to access the databank are published in a monthly hardcopy newsletter distributed to all staff.

(e) RECIPIENT R5 used the data in the GoldCare databank to do research on the effects of a drug on patients with cancer. Some of the data collected from the databank was incorrect and this resulted in the drug company suing RECIPIENT R5. A UK court ordered RECIPIENT R5 to pay the drug company £4 Million pounds in damages. RECIPIENT R5 recently launched a lawsuit against GoldCare Ltd for providing incorrect information resulting in a loss of £4 Million.

QUESTION 4
GoldCare Ltd would like you to advise them on possible legal concerns regarding the use of machine learning (i.e., its analytical and predictive capabilities) in the specific context of healthcare as intended in the case study.
Research and discuss at least four possible legal concerns and for each concern explain: (i) what the concern is; (ii) why the concern is importance and (ii) advise GoldCare Ltd on at least two ways in which they can address/mitigate the concern (e.g. processes/policies that can be put in place or actions that can be taken). Marks will be given for citing your sources of information and your advice must be given in the context of the case study.

Attachment:- Security Aspects of Data Science.rar