A UK hospital did not do enough to protect the privacy of patients when it shared data with Google, the UK's Information Commission (ICO) has ruled.
The ICO censured the Royal Free NHS Foundation Trust about data handed over during trials of a novel way to detect acute kidney injury.
Among other failings, the ICO said the hospital did not tell patients enough about the way their data was used.
The trust said it would tackle "shortcomings" in its data-handling.
Details on about 1.6 million patients was provided to Google's Deep Mind division during the medical trial.
Information was used to develop and refine an alert, diagnosis and detection system for acute kidney injury.
In a statement, information commissioner Elizabeth Denham said attempts to make creative use of data had to be carefully managed.
"The price of innovation does not need to be the erosion of fundamental privacy rights," she said.
Google has yet to comment on the ICO's findings.