Data Ethics Club: UK Biobank has my data, but I’m not worried. I know the benefits are too great to consider pulling out#
Article Summary#
The UK Biobank is a biomedical dataset and one of the world’s most detailed studies for tracking the long-term health of people as they age. Beginning in 2003, the project now has data of half a million people between 40 and 69 years old living in the UK when they joined. With consent, participants continue to provide detailed information about their lifestyles via online questionnaires, health records, and other related information. Since opening access to Biobank data for scientific research in 2012, more than 18,000 peer reviewed papers have been published using the data.
In May 2026, UK Biobank data was found to have been put up for sale on the Chinese site Alibaba, apparently by rogue researchers from three Chinese institutions. No names, addresses, or identifiers were included, the Chinese government responded quickly in taking it down, and no data is known to have been sold. Nevertheless, it has given many cause for concern. Some have called for Biobank data to be better locked up and only available to people who visit in person.
Problems with biometric data breaches include the risks artificial intelligence (AI) poses for data privacy. AI tools are highly effective at identifying complex patterns. This can be exploited to deanonymise data by connecting points that would be otherwise difficult to link and thereby uncover identities.
Perhaps, however, we should not be quick to withdraw our data from places like the UK Biobank. The risks of compromised data need to be balanced with the risks of not having enough data to conduct meaningful research. Biobank data has contributed to a long list of scientific discoveries used to improve healthcare and medical knowledge. It is especially valuable due to the potential it holds for longitudinal studies, which are notoriously difficult to sustain but highly valuable in what their findings can reveal.
Discussion Summary#
Are we surprised that a data leak like this has happened? Why/why not?#
Some of us were not surprised about the UK Biobank leak, seeing it as an unfortunately inevitable result of these kinds of datasets. In domains such health and telecoms which contain highly sensitive information, data breaches are a very common occurrence. Media reports abound regarding large companies in these areas having issues with compromised data. We’ve experienced data breaches that have involved our driving licenses and meant that we’ve had to change our IDs.
The Biobank leak seems to have come from very human mistakes, exemplifying how easily things like this can happen. We expected the Biobank leak to have occurred because of a cyber security incident, but it was much more human than that. Two of the cases originated in legitimate research groups who had been granted access to data, after which an unauthorised person used a researcher’s login and password to get access, downloaded the data, and then tried to sell it. Previous Biobank leaks have occurred because of datasets being inadvertently included in code bases that researchers are required to include with publications.
It’s easy to assume that people doing bad things have some sort of masterplan, like in the Vastaamo data breach where psychotherapy data was stolen for extortion, but we can’t be sure this is always the case. Criminality also comes from opportunity and is not always due to malicious intent. It’s better to spend more time evaluating the implications of the event than the motivations.
Would we feel differently if this was a data leak from a commercial organisation? Why?#
Leaks from commercial organisations tend to be perceived differently because they are not accountable in the same way as a public body and do not have the same motivations towards creating public good. The relationship between money and health research feels like a conflict of interest, as it changes the underlying incentives from helping people to making profit. Money alters how we view things; the fact that leaked data was put up for sale in the Biobank leak makes it more problematic than if it has just been exposed. None of the gains of sale would have been returned to participants.
Comparing the more privatised US and less privatised UK healthcare systems, the US has huge amounts of data on customers/patients. It is possible to get hold of a lot of US healthcare data, but you need to pay for it. We did not think it seems right for researchers funded by public money to pay private companies to get access to data. We also wondered whether people in the US consent to their data being used for certain purposes when they join Medicaid.
The NHS does much more linkage data than the US, showing off the benefits of a public model. It’s important to make a point of the NHS’s strengths, especially at a time when there is a risk of creeping privatisation in the NHS.
If the NHS became more privatised, people might be less willing to share their data. Distrust of privatisation can be seen in the case of Palantir’s presence in the NHS. Palantir is a large US company which works in AI surveillance and is contracted to the NHS to provide a “data integration” platform. People are very concerned about Palantir handling their data. In the US, Palantir has used medical records to target people for US Immigration and Customs Enforcement (ICE). The UK parliament is has found that Palantir shouldn’t play such a significant role in the UK public sector (Palantir also has contracts with the Ministry of Defence, local councils, and the police force), and petitions are underway for the UK government to exercise its break clause when the contract ends in 2027.
Has this article made you more or less likely to take part in a population-wide study?#
On one hand, there are very real and consequential problems that can come from the wrong parties having access to your biomedical data, which the article might have downplayed too much. We wondered about the worst-case scenario and what Biobank considers to be the biggest risk. Biomedical data could be used by scammers to quickly narrow down vulnerable people they want to target. For those of us who have worked in rare diseases, we’ve seen how information about one person with a particular disease can reduce the scope quite significantly.
It is important to consider the risk to the individual versus the risk to the community and be clear about how much risk we are willing to take at the community or subcommunity level. Sometimes, subcommunities that stand most to gain from being included in data collection are at the most danger of being harmed by it (also known as the paradox of exposure). For example, data collected in the US to improve trans healthcare was later weaponised by DOGE to make cuts.
On the other hand, we were reassured that responsible parties were quick to respond, and it seems that nobody has been obviously harmed in this particular leak. Data collection is always a trade-off between risk and utility, and Biobank has been transparent in acknowledging that some risk is inevitable when granting access to sensitive data. The most risk-free strategy is simply not to collect the data at all, and sacrifice research advancements. The most useful strategy for open research would be to collect non-anonymous data and publish it all online, with no privacy and high risk of it being used for malicious purposes.
When the whole project is taken into consideration, a huge amount of good has come through the scientific discoveries it has enabled. To us, it does seem to be a clear winner on risks versus rewards.
What change would you like to see on the basis of this piece? Who has the power to make that change?#
UK Biobank’s initial response said that no identifying data were provided to researchers. The representative argued that participants are only identifiable by cross-referencing data and this is why they tell participants not to put information which reveals something about their health online. However, whilst the exposed Biobank files do not include names or addresses, they may still pose privacy concerns by listing information such as hospital diagnoses and associated dates. In cases where there is only one person with that diagnosis on that date, it is enough information to identify them.
After the breach, Biobank published an oversight committee report into data security. The report describes how the leak occurred and highlights action points of what steps to take next. It also discusses the level of risk Biobank are prepared to accept, explicitly highlighting that some risk is acceptable. We were reassured that measures had been taken to investigate what went wrong and that Biobank were communicating what they plan to do in the future to prevent it from happening again.
Recommendations from the report include getting up-to-date contact details of participants and making sure that researchers are required to justify which fields of data they need. It is vital that contact details of participants do not leave Biobank and are never given to researchers. Ethics applications could support proper justification of data usage by researchers, even if they can be a frustrating hurdle to overcome. Informed consent is also important, but it’s difficult to be certain about how far informed consent goes in relation to the possibility of data leaks and secondary uses of data. The original Biobank consent form (available on their website) doesn’t seem to mention data leaks, and we weren’t sure whether participants would have anticipated this risk.
The protocol of Biobank is slightly based on trust, which they seem to acknowledge. Sometimes, security is based on trust that people in research institutions or public bodies like the NHS have good intentions. Sometimes, deeper investigation like a background check should be used before granting access to data.
There is a cost-benefit trade-off as to how thoroughly researchers should be checked and how much good can be done by making data easily accessible. Researcher positions may change over time. Individuals can start off in a legitimate area and later move into more questionable positions.
Being clear about who has access to what is important because people with the right skills can do a lot with data. Analysts, for example, are often granted a lot of access to the backend of datasets compared to others who handle health data like GPs. With this access comes the opportunity to do powerful research, but if it is combined with naivety then also the potential for substantial harm.
Attendees#
Huw Day, Data Scientist, University of Bristol: LinkedIn, BlueSky
Jessica Woodgate, PhD Student, University of Bristol
Tessa Alexander-Holmes, Research Software Engineer, Research IT, University of Bristol
Joe Carver, Data Scientist, Brandwatch
Amy Joint, Clinical Trials Publisher - LinkedIn
Nabeel Akram, Data Scientist/ PGR - University of Manchester - Github
Vanessa Hanschke, Researcher, University of Bristol
Zosia Beckles, Research Information Analyst, University of Bristol
Zoë Turner, NHS Data Scientist, GitHub
Paul Matthews, Lecturer, UWE Bristol
Kamilla Wells, Citizen Developer / AI Product Manager, Brisbane