UK Biobank suspends access following Alibaba revelations

Following recent revelations in The Guardian on breaches of UK Biobank data, the charity has suspended access to set in place a strict limit on the size of files that can be taken off the platform.

“We found that de-identified participant data made available to researchers at three academic institutions were listed for sale on a consumer website in China, owned by Alibaba," said CEO and Principal Investigator of UK Biobank, Professor Sir Rory Collins. "With support from both the UK and Chinese governments, Alibaba swiftly removed those listings before any sales were made. This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended.”

As a result of the data breach the UK Biobank has temporarily suspended all access, while they put in place a strict limit on the size of files that can be taken off the platform. In addition, the charity says that all files exported from the research platform will be monitored daily for any suspicious behaviour and that a comprehensive and forensic board-led investigation will take place.

World’s most comprehensive health dataset

The UK Biobank, launched in 2006, has enrolled over half a million people aged 40-69 to help scientists better understand why diseases develop and how they might be prevented or treated. Volunteers are reassured that their data is anonymised and will only be used for research purposes. The biobank describes itself as “the world’s most comprehensive dataset of biological, health and lifestyle information”.

After personally identifying information is removed from the data, scientists from around the world can apply to use it for research in the public interest. In collaboration with research partners, participants have shared whole-genome sequencing data, as well as measurements of proteins, hormones, and metabolites in the blood. As scientific techniques continue to evolve, the resource is expected to yield even deeper insights, making it a valuable tool for studying the causes and progression of disease.

Luc Rocher, an Associate Professor and UKRI Future Leaders Fellow at Oxford University, who specialises in privacy-enhancing technologies, AI accountability and algorithm auditing, set up a tracker of takedown notices issued by the UK Biobank. According to his research, there have been 110 notices filed so far, targeting 197 code repositories by 170 developers across the world, on GitHub, an open-source platform.

The revelations raise questions as the EU develops its European Health Data Space. Still in its early stages, there will be growing concern and interest in how those who consent to have their data used for research (‘secondary use’) can be assured that this information is protected.