UK Biobank health data listed for sale on Alibaba platform

A UK government minister confirmed in Parliament that health data from 500,000 volunteers contributed to the UK Biobank charity was briefly listed for sale by three vendors on the Alibaba e-commerce platform in China. Ian Murray, a minister of state at the Department of Science, Innovation and Technology, stated that the charity first alerted authorities to the issue on Monday, prompting immediate action to protect participant information.

The listings were removed following intervention from the Chinese government and Alibaba, with the British Embassy in Beijing involved in the process. Murray expressed gratitude for the speed and seriousness with which these entities assisted in taking down the advertisements, noting that no buyers were believed to have paid for access before the removal.

While the minister reassured the House that the data did not contain personal identifiers such as names, addresses, contact details, or telephone numbers, the charity could not assure 100 per cent that re-identification was impossible. Murray clarified that the specific details of how the data ended up for sale remain under investigation by the charity, which has asked them to ascertain the exact sequence of events as a priority.

In response to the incident, UK Biobank has suspended all access to its research platform as a short-term precautionary measure. Chief executive Rory Collins described the actions of the individuals responsible for the leak as a clear breach of the contract they signed with the charity, stating that the three research institutions identified as the source of the information have had their access revoked.

The minister highlighted that the data potentially listed included gender, age, month and year of birth, attendance dates, socioeconomic status, lifestyle habits, sleep, diet, mental health, and health outcomes. Although the likelihood of individuals being identified using this information was considered low, the strict accreditation process that usually governs access to such datasets has been temporarily halted.

Collaborative efforts between the UK and Chinese authorities ensured the removal of the listings, yet the incident underscores ongoing concerns regarding data privacy and the security of sensitive health information in the digital age. The Information Commissioner's Office has been referred the matter for a formal review, while UK Biobank continues to work with the charity to improve security measures and vetting procedures for research institutes.