Data of 500,000 UK Biobank volunteers listed for sale in China

UK Biobank, a non-government British charity, recently announced that medical data of as many as 500,000 volunteers shared with three academic institutions was listed for sale on Chinese e-commerce platform Alibaba.

 

The news came to light when Minister of State for Digital Government and Data Ian Murray told the House of Commons on Thursday that the health data of 500,000 individuals, who volunteered to share their data with UK Biobank, was listed for sale on a website managed by the e-commerce giant in China.

 

UK Biobank collects detailed health data from volunteers and shares them with academic and scientific research institutions to support scientific testing and discoveries that improve patient health. Researchers have used data from UK Biobank over the past decade to find preventive solutions to Parkinson’s, dementia, cancer, heart diseases, and infections like Covid-19.

 

The British healthcare charity informed the government on April 20 that it had identified three separate listings on Ali Baba e-commerce platforms in China, one of which contained detailed health data of 500,000 volunteers. The other two listings offered support for applying for legitimate access to UK Biobank or analytical support for researchers who already have access to the data. All three listings had been advertised for sale on the e-commerce website.

 

"I want to reassure the House up front however, that Biobank have advised that this data did not contain participants’ names, addresses, contact details, or telephone numbers," Murray said. "The government has spoken to the vendor today and they do not believe that there were any purchases from the 3 listings before they were taken down."

 

Murray said that as soon as the government learned about the data breach, it worked with UK Biobank, Alibaba and the Chinese government to get the listings removed before any sale occurred. "I want to thank the Chinese government for the speed and seriousness with which they worked with us to help remove these listings and ongoing work to remove any further listings," he added.

 

The government has ensured that UK Biobank suspended access to the three academic institutions that have been confirmed as sources of the data leak, and temporarily pause access to its data until it puts technical controls in place to prevent a similar data leak in the future.

 

Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank, said the data shared with the three academic institutions for research purposes had been de-identified, which meant that volunteers’ names, addresses, contact details, dates of birth and NHS numbers were not compromised.

 

The charity has imposed strict limits on the file size of data that research institutions download from its research platform, ensuring that researchers will not be able to download large amounts of participant data but will have the opportunity to export the results of their research.

 

Sir Collins said UK Biobank is also developing the world’s first automated checking system which will prevent third parties from taking de-identified volunteer data from its platform without preventing the important research that is being done by thousands of scientists around the world.