The boss of UK Biobank in Stockport has issued a lengthy apology after it was revealed that medical information of 500,000 participants had been listed for sale in China.
Technology Minister, Ian Murray, made a statement to the Commons to confirm that information from all members of the database had been found for sale on Alibaba.
“On Monday 20 April, […] the UK Biobank charity informed the government that they had identified their data had been advertised for sale by several sellers on Ali Baba e-commerce platforms in China,” he said.
“Biobank told us that 3 listings that appear to sell UK Biobank participant data had been identified. At least one of these 3 datasets appears to contain data from all 500,000 UK Biobank volunteers. Additional listings offered support for applying for legitimate access to UK Biobank or analytical support for researchers who already have access to the data.”
He added that Biobank said that the data did not contain “participants’ names, addresses, contact details, or telephone numbers.”
“The government has spoken to the vendor today and they do not believe that there were any purchases from the 3 listings before they were taken down,” he continued.
The listings were removed through work with Biobank, the Chinese government and the Alibaba vendor.
As a result, Biobank has revoked access to the research institutions identified as the source of the information and it is currently pausing further access to data until a technical solution has been put in place to prevent data from being downloaded in this way again.
The organisation has also referred itself to the Information Commissioner’s Office.
READ MORE – UK Biobank begins multi-million new Manchester national HQ fit-out
Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank wrote to participants:
“We apologise to our participants for the concern this will cause, and we hope to provide reassurance by outlining the serious actions we are taking in response.”
He added that the listings were “swiftly removed before any purchases were made.”
“We will conduct a comprehensive investigation into this incident.
“Since UK Biobank started to make your de-identified data available for research in 2012, it has led to thousands of discoveries that are already leading to improvements in the prevention and treatment of many different diseases,” he said.
“We take the protection of your data extremely seriously. Researchers have to go through our rigorous access review process, and their institutions sign a contract committing to keep the data secure, before we make the data available to them for research. Even though we only ever share de-identified data and have no evidence of any of you being identified unwillingly, we don’t want any use by anyone who has not been approved for access.
“Last week, we found that de-identified participant data made available to researchers at three academic institutions were listed for sale on a consumer website in China, owned by Alibaba. With support from both the UK and Chinese governments, Alibaba swiftly removed those listings before any sales were made. This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended.
“Researchers are required to do their research on our restricted, cloud-based research platform hosted in the UK to prioritise the safe and secure use of your data. In light of this incident, we are taking further steps to enhance our systems to prevent this from happening again.”
The organisation said it was currently developing the world’s first automated checking system able to prevent de-identified participant data from being taken off the UK Biobank research platform and that it intended to have this in place by the end of the year.
“We are grateful to the UK Government for their support in this matter, as well as the rapid co-operation from the Chinese authorities and Alibaba. We understand that the existence of these listings, even temporarily, will be concerning to you. We want to reassure you that all the data are de-identified; they do not contain any personally identifying information (such as names, addresses, dates of birth, and NHS numbers).
“By making data available responsibly to scientists around the world, UK Biobank is allowing discoveries to be made that would not otherwise be possible, leading to new ways to prevent and treat disease, and better health for all of us. Your participation in UK Biobank is making this possible.
“We are sorry that this incident has occurred and hope you are reassured by the swift and decisive action we have taken. If you have any questions or concerns, we would be pleased to discuss these with you.”
The UK Biobank is currently in the process of moving to a new cutting edge campus at Bruntwood SciTech’s Greenheys. Its 350-strong team is due to move in later this year.
