The UK Biobank project, a vast repository of health data from half a million British volunteers, has come under scrutiny after it was revealed that confidential records were offered for sale on a Chinese website. This incident has reignited concerns over how such sensitive information is safeguarded, even as the project continues to enable significant medical discoveries.
What is the UK Biobank project?
Launched in 2003, the UK Biobank recruited 500,000 participants aged 40 to 69 between 2006 and 2010. Volunteers provided genetic data, clinical measurements, health information, biological samples, and lifestyle data, with regular follow-ups. Since 2012, researchers have been able to request access to anonymised data to study the causes, prevalence, and treatment of numerous diseases, making it a critical resource for global health research.
Has it been a success?
Thousands of research papers have been published using UK Biobank data. Prof Andrew Morris, director of HDR UK, highlighted that key discoveries include identifying four blood proteins that could help diagnose dementia before symptoms appear. Last year, the project celebrated scanning the brains, hearts, and other organs of 100,000 participants, aiming to aid earlier disease detection and provide insights into human ageing. These scans have already revealed that even small amounts of alcohol are linked to brain changes, diabetes affects heart structure, and Covid-19 damages the brain's smell centre. Recent studies using the data have shown that air pollution accelerates disease onset, and an AI tool trained on the data can predict risk for over 1,000 diseases.
Morris emphasised that the true achievement lies in assembling biosamples and linked data at scale. "It is among the largest studies for imaging, protein biomarkers, genomics and more," he said. "The depth of research enabled across all disease areas is unique and why it is heralded worldwide."
Why is the UK Biobank in the news now?
On Thursday, it was reported that data belonging to UK Biobank participants was listed for sale on three separate Alibaba listings last week. At least one listing allegedly contained data from all 500,000 volunteers. The data was de-identified, excluding names, addresses, and precise dates of birth. Although the listings have been removed and no sales are believed to have occurred, this is not the first data protection concern. Last month, the Guardian revealed multiple instances of participant health data being leaked online by researchers, some traceable back to volunteers.
Prof Luc Rocher of the Oxford Internet Institute noted that this incident marks the 198th known exposure of UK Biobank data since last summer. "UK Biobank data is not just available for sale, it also remains available online for anyone to download today," they said.
What has the UK Biobank said?
Prof Rory Collins, CEO and principal investigator of UK Biobank, wrote to participants assuring them that their personal identifying information is "safe and secure." He announced new security measures, including restricting file export sizes from the research platform to "severely limit" the ability to export de-identified participant data. "In addition, we will conduct a comprehensive and forensic board-led investigation of this incident," he wrote.
What have others said?
Experts welcomed the swift removal of the listings. Prof John Gallacher of the University of Oxford said, "As a 'Biobanker' I am reassured that the value of my small contribution to global health is jealously guarded." However, some called for a full investigation. Morris stated, "It is important that there is a full review," adding that participant trust is crucial for health research using large de-identified datasets. "The future of healthcare is increasingly data-dependent. We must double down on implementation of secure systems to enable essential research that is responsible, trusted and can operate at scale."
