UK Biobank Suspends Data Access After 500,000 Participant Records Listed on Alibaba
Professor Sir Rory Collins, head of UK Biobank, confirmed that de-identified medical data belonging to 500,000 participants was listed for sale on Alibaba, a Chinese e-commerce platform. The datasets, made available to researchers at three academic institutions, were reportedly removed swiftly before any purchases occurred, according to a government statement last Thursday.
Sir Rory expressed his "anger" and "upset" over the incident, stating that the implicated institutions have been banned from the Biobank's platform. The organisation has now put "science on hold" by temporarily suspending all access to its online research platform. This pause is intended to implement additional controls to prevent future breaches.
Data Security Under Scrutiny
The Biobank is a critical repository of health data from UK volunteers, used to advance research into conditions such as dementia, various cancers, and Parkinson's disease. Its platform allows approved academic institutions globally to access anonymised medical information for research purposes.
Technology Minister Ian Murray informed MPs in the House of Commons that while the listed data did not include participants' names, addresses, or contact details, it could comprise gender, age, birth month and year, socioeconomic status, lifestyle habits, and biological sample measurements. Sir Rory acknowledged it was "impossible" to entirely rule out potential re-identification using this de-identified data in conjunction with other information, though he noted no such evidence exists.
The organisation has referred itself to the UK's data watchdog, the Information Commissioner's Office (ICO), which confirmed it is making enquiries. An ICO spokesperson emphasised the highly sensitive nature of medical data and organisations' legal responsibility for its secure handling. A "comprehensive and forensic board-led investigation" is also underway, according to the Biobank. Sir Rory acknowledged that while improvements could always be made, a balance must be struck between facilitating scientific discovery and robust data protection.
