Government confirms UK health data appeared for sale on Chinese website

Health data from 500,000 people who had taken part in the UK Biobank project was offered for sale online in China, it has emerged.

Technology minister Ian Murray confirmed the breach on the Alibaba website, which he called an ‘unacceptable abuse’.

He told MPs that the Government had been made aware of the data breach on Monday by the Biobank team.

The information offered for sale did not have names, addresses, contact details, NHS numbers or telephone numbers but that it could include gender, age, month and year of birth, socioeconomic status, lifestyle habits, and measures from biological samples.

In a statement on its website UK Biobank apologised to participants and said it was investigating the incident and would be putting additional security measures in place to ‘prevent this happening again’.

The message from Professor Sir Rory Collins, chief executive and principal investigator of UK Biobank said personally identifying information was safe and secure.

Listings which had offered access to UK Biobank data – which was de-identified participant data that had been made available to researchers at three academic institutions – were found on the Alibaba website and were ‘swiftly removed’ before any purchases were made, it said.

‘This is a clear breach of the contract signed by these academic institutions and they, along with the individuals involved, have had their access suspended,’ the statement said,

It continued: ‘We have temporarily suspended all access to the UK Biobank research platform, while we put in place a strict limit on the size of files that can be taken off the platform.’

The half a million participants to the Biobank study were adults aged 40 to 69 years who were recruited between 2006 and 2010. It is the world’s largest database of human genome sequencing, proteomic and human imaging.

Professor Andrew Morris, director of HDR UK – the national institute for health data science – said to find put that the data had been put up for sale on a website in China will be greatly concerning for participants.

‘Even with all identifying information removed from the data, this is still sensitive data and a serious data breach.  

‘I am glad to see that rapid action has been taken at the highest levels with a joined-up response between UK Biobank and the UK and Chinese governments.

‘The fact that the datasets were rapidly taken down and interim measures have been put in place offers reassurance.’

He added a full review of what happened would be important.

‘Health research using large de-identified datasets is delivering great advances in the prevention, diagnosis and treatment of diseases affecting millions of people in the UK and globally.

‘UK Biobank has been at the vanguard of many of these discoveries. But such research is only possible with the trust of participants in how their data is handled.’  

But Professor Luc Rocher, associate professor at the Oxford Internet Institute at the University of Oxford, raised concerns about ongoing breaches of the data.

‘This is the 198th known exposure of UK Biobank data since last summer.

‘UK Biobank data is not just available for sale, it also remains available online for anyone to download today.

‘Researchers have, in the past, repeatedly and accidentally uploaded datasets to online code sharing platforms, and many of these files are now replicated across the web.’

He added: ‘The actions being taken today are inadequate to take down data from the web, and cannot protect the 500,000 participants whose intimate health records have been exposed this year.’

In February, NHS England began to extract identifiable patient data for research from GP records, on an opt-in basis.

A new legal direction allows NHS England to establish a service to enable GP data to be ‘collected and disseminated’ for specific research studies that have been approved to access the information.

‘Explicit consent’ needs to be provided ‘by or on behalf of the participant to their data being shared with that study for health research’, the direction said.