Data Protection and Intellectual Property Law Case Study: BestHealth Ltd.

CASE STUDY
BestHealth Ltd, is a healthcare company in London (UK), that provides clinical treatment to thousands of patients for a variety of health conditions. They employ many medical professionals and administrative staff including one data controller. Two months ago, the data controller discovered a cyberattack that resulted in an extensive data beach. The company had no incident response protocol for dealing with breaches, and fearing bad publicity the manager decided to keep it quiet. The management of BestHealth Ltd recently expanded the centre to include the establishment of a new data science department to pursue research and data analyses. This new department employs data scientists and uses machine learning/deep learning among other Artificial Intelligence techniques for many activities including: profiling of patients; monitoring of patients, analysis and prediction of patient healthcare needs; and assessing the effectiveness of various treatments.

 

The department also installed a new IT system, and developed new services and processes that all involve the collection and use of medical and non-medical data. The data is obtained from patients and other places including numerous online and offline documents. BestHealth Ltd also has an online databank consisting of anonymised data produced by their data science department. They provide access to this databank to researchers and other medical professionals. Everyone needing access must sign a special licence agreement (attached).

 

QUESTION 1 [26 marks]
(a) Before the establishment of the new data science department at BestHealth Ltd, they were required to undertake a data protection impact assessment (GDPR Art 35). One important aspect of a data protection impact assessment is the identification and assessment of the risks to the rights and freedoms of data subjects. Discuss at least four different types of risks to patients related to the processing activities of BestHealth Ltd. [8 marks]

 

(b) BestHealth Ltd was sent an Information Notice by the Information Commissioner’s Office asking for the following: (a) to state whether they had experienced any data breaches in the past 6 months; (b) to provide their security audit logs for the past two years and (c) to provide the content of any communications with their lawyers regarding their liabilities under the Data Protection Act 2018. Discuss the legality of the following conduct by BestHealth Ltd, citing relevant sections of the UK Data Protection Act 2018.
(i) BestHealth Ltd responded that they did not experience any data breach in the past 6 months.
(ii) BestHealth Ltd edited their security logs to remove any evidence of the data breach that they experienced, before submitting the logs to the Information Commissioner.
(iii) BestHealth Ltd, told the Information Commissioner that they were not entitled to any communications which they had with their lawyers regarding their liabilities under the Data Protection Act 2018. [6 marks]

Question 2

 

(c) A patient named Almina recently wrote to BestHealth Ltd, informing them that she had registered with a new health care provider called CapitalHealth Ltd. She therefore demanded (i) to know what data BestHealth had about her ; (ii) that all her data should be sent to CapitalHealth Ltd and (iii) that BestHealth Ltd erase all copies of data about her (after sending her data to CapitalHealth Ltd) since she would no longer be a patient.
Advise BestHealth Ltd on whether Almina has any legal rights in relation to her three demands and how they should respond to each demand. Please quote any relevant legal authorities.

 

QUESTION 2 [20 marks]
In the context of Intellectual property law, advise BestHealth Ltd on the legality of undertaking any of the following actions. In your answers please cite any relevant legislation.
(a) Copying texts contained in an existing published work to include in a paper published by BestHealth Ltd.
(b) Extracting and using a substantial amount of data from a UK database without having any licence to use the database, obtaining permission or citing the source.
(c) Using highly confidential business data belonging to a UK business competitor, obtained from encrypted documents by cracking the encryption key.
(d) Using a trade mark belonging to another UK company, in order to trick customers into buying similar products produced by the other company.
(e) Importing a drug from China, that is manufactured without a licence from the UK pharmaceutical company who developed the drug. [4 marks x 5 = 20 marks]

 

QUESTION 3 [30 marks]

Machine Learning (ML) algorithms are increasingly being used as part of decision-making processes in both the public and private sectors, with
potentially significant consequences for individuals, organisations and societies. The governance of such algorithms (with social impacts) should include principles such as: (a) Fairness (b) Transparency (c) Accountability
(d) Explainability and (e)Accuracy. Carry out individual research and for each principle, explain to BestHealth Ltd
(i) the meaning of the principle and what it involves/entails.
(ii) why it is important to BestHealth Ltd.
In your answers cite any relevant legal authorities or sources of information used for each principle. Do not copy & paste information from any source! [30 marks]

 

QUESTION 4 [24 marks]
{See LICENSE AGREEMENT attached}
Advise BestHealth on the legality of the actions taken my various RECIPIENTS (A1, A2, A3, A4, A5, A6) party to the BestHealth Databank licence agreement. In your answer you must reference specific sections in the licence agreement.
(a) RECIPIENT A1 is a University research lab. The lab does consultancy work for several clients. One of the clients recently asked for access to the some of the data collected from BestHealth Ltd. The lab agreed to allow access to the data collected from the BestHealth Databank in their possession for a small fee. 4/7

 

(b) On the 1st June 2020, RECIPIENT A2 sent an email to BestHealth,  informing them of their decision to terminate their licence agreement at the  end of June 2020. They also demanded a refund on the remaining amount  of their Licence fee payment since they paid for 12 months at the start of  2020. Advise BestHealth Ltd.

 

(c) RECIPIENT A3 used the data in the BestHealth databank to publish some  scientific papers on the effects of Covid-19. The Keywords of the paper  consisted of: “Covid-19, pandemic, mortality, contact-tracing“

 

(d) RECIPIENT A4 used the data in the BestHealth databank to do research on  the effects of a drug on patients with heart disease. Some of the data collected from the databank was incorrect and this resulted in the drug company suing RECIPIENT A4. The case was settled out of court after RECIPIENT A4 agreed to pay the drug company £2 Million pounds in damages. RECIPIENT A4 recently launched a lawsuit against BestHealth for providing incorrect information resulting in a loss of £2 Million.

 

(e) Before signing the licence agreement RECIPIENT A5 was told my a sales representative for BestHealth Ltd, that the databank is always available for access 24 hours a day and 7 days a week without any interruptions. Due to daily interruptions in access over the past two months RECIPIENT A5 decided to sue BestHealth Ltd for not having the access promised by the sales representative.

 

(f) RECIPIENT A6 consists of 100 scientists working on various projects. All  have access to the BestHealth databank and are free to download data at any time without restrictions. The username and password details to access the databank are published in a monthly hardcopy newsletter distributed to all staff. [4 marks x 6 = 24 marks]