PARLIAMENTARY DEBATE
UK Biobank Data - 23 April 2026 (Commons/Commons Chamber)

With permission, Madam Deputy Speaker, I will make a statement about the use of UK Biobank data.

UK Biobank is a non-profit charity, independent of Government. The Biobank brings together data, kindly donated by its volunteer participants, that is shared with accredited researchers globally to make significant scientific discoveries that improve patient health. That includes discovering genes that affect the risk of heart disease or cancer, identifying new ways of predicting dementia, identifying early warning signs for cancers, understanding immunity to covid-19, and work towards earlier detection of Parkinson’s. It is one of the most successful and important studies of its type, and it continues to benefit patients in the UK and around the world. We are all grateful to those individuals who are part of this landmark study that is so important for all of our health.

On Monday 20 April, the UK Biobank charity informed the Government that it had identified that its data had been advertised for sale by several sellers on Alibaba’s e-commerce platforms in China. Biobank told us that three listings that appeared to sell UK Biobank participation data had been identified. At least one of the three datasets appeared to contain data from all 500,000 UK Biobank volunteers. Additional listings offered support for applying for legitimate access to UK Biobank data or analytical support for researchers who already have access to the data. I want to reassure the House up front, however, that Biobank has advised that this data did not contain participants’ names, addresses, contact details or telephone numbers. The Government have spoken to the vendor today and they do not believe that there were any purchases from the three listings before they were taken down.

Once the Government were made aware of the situation, we took immediate action to protect participants’ data. First, we worked with Biobank, the Chinese Government and the vendor to ensure that the three listings that UK Biobank informed us included participant data had been removed. I want to thank the Chinese Government for the speed and seriousness with which they worked with us to help remove the listings and the ongoing work to remove any further listings. Secondly, we ensured that the Biobank charity revoked access to the three research institutions identified as the source of the information. Thirdly, we have asked that the Biobank charity pauses further access to its data until it has put in place a technical solution to prevent data from its current platform from being downloaded in this way again. I can confirm to the House that this pause is now in place. UK Biobank has also referred itself to the Information Commissioner’s Office.

We are still working with Biobank to ascertain from it the specific detail of what has happened. We have asked it to investigate how this data ended up for sale online as a priority, but I wanted to ensure that the House was aware of the incident and the action that the Government are taking.

Officials have been in regular contact with UK Biobank since the Government were made aware of the issue on Monday. I personally spoke to the chief executive and chair last night, alongside the Minister of State for Science and the Minister for Health Innovation and Safety. We have received assurances that the charity will conduct a rapid board-level review of the safeguards in place for accessing its data.

As I mentioned, in the short term, Biobank will suspend downloads from its platform. That is until a new system is brought in to control analysis downloads to approved researchers and will significantly enhance data access controls and safeguards. We have advised the chair and chief executive of Biobank to write to all participants as soon as possible to ensure that they are aware of what has happened.

In summary, and to be clear to the House and to those people affected, the charity has assured us that the data did not contain anybody’s names, addresses or contact details. It includes only data of people who have explicitly opted in to be part of the Biobank. Those are people who have given their explicit consent that this data can be used, in the knowledge that it will be shared with researchers globally.

Participants have done a great service to the people of this country, and human health globally, through their participation. For example, valuable research is being carried out at McGill University in Canada into chronic pain, which afflicts millions of people here in the UK. We expect UK Biobank to remain one of the leading health research resources.

This has been an unacceptable abuse of the UK Biobank charity’s data, and an abuse of the trust that participants rightly expect when sharing their data for research purposes. The Government take the incident extremely seriously, which is why we have acted rapidly to support the UK Biobank charity in its response and why I wanted to update the House at the earliest opportunity.

The Government will soon be issuing new guidance on control of data from research studies. I take this opportunity once again to urge all businesses and charities to ensure that that their systems and data-sharing processes are as secure as possible. We wrote to businesses last week about the cyber-security tools available to them—for free—from the Government and the steps they should take to maximise security. Ensuring the safe use of UK data is a priority for the Government. I commend this statement to the House.

I call the shadow Minister.

I thank the Minister for his statement and for prior sight of it. This is indeed a serious breach. In another life, I was the chief operating officer of a tech company and we, too, had data breaches. We found that the best way to deal with them was to have developed a culture of openness and honesty in the organisation, not to flap or panic, to plug the leak and to limit the damage. Ideally that is all rehearsed, because it is too late to learn to swim when the ship starts sinking.

A couple of things in the Minister’s statement require clarification. The statement says what the data does not include, with the implication being that the participants could not be individually identified. What was in the data? Could it be used to identify participants, even if only mosaically?

The statement says that the research institutions identified as the source of the leak have had their access blocked. I am left thinking: is that it? Were those institutions Chinese? What sanctions are available either to the UK Biobank or to the Government on those institutions? Is their blocking permanent or temporary? How has UK Biobank reassured itself and its participants that no further copies of the data exist? What is the possibility or likelihood that the full dataset is now in the hands of the Chinese state?

I hope that the Minister will forgive me for not being an instant expert on UK Biobank. Can he tell me whether any research institutions that have access to UK Biobank data are based in Russia, Iran or North Korea? What is the Government’s risk assessment?

When I served on the Cyber Security and Resilience (Network and Information Systems) Bill Committee, I distinctly remember the Government whipping their Back Benchers to vote down a Conservative amendment to oblige the Secretary of State to maintain a register of hostile actors posing a threat to the cyber-security of critical UK industries and sectors, including health. Will the Minister commit to reviewing that in the light of this serious data breach?

This is a grave incident. UK Biobank is an amazing project with thousands of trusting volunteers. I hope that the Government will send in the relevant agencies to help UK Biobank to secure its systems for the future, including vetting the research institutions that it trusts.

I thank the shadow Minister for the way in which he has approached this matter—indeed, with his expertise as a former COO of a tech company. Let me answer his questions directly.

As we understand it—this is from UK Biobank, which is not a Government organisation, but an independent charity—UK Biobank cannot be entirely sure about the data that was included, because it was taken down from the Alibaba websites. However, we do know that there is no personal data in it, in terms of identifiers. I can give an indication of some of the characteristics that are potentially in UK Biobank datasets, which include gender; age; month and year of birth; assessment centre data; attendance date; socioeconomic status; lifestyle habits; measures from biological samples such as haematology and biochemistry—this is the kind of stuff that has been detected—online questionnaires data; sleep; diet; work environment; mental health, and health outcomes data.

The shadow Minister asked whether there are identifiers for individuals. There are not, but it would be wrong for me to give 100% assurance—and UK Biobank cannot do so—that someone could not be identified from the data. However, it would have to be used in a very advanced way in order to do that.

The hon. Gentleman asked about the three institutions. They have been immediately banned from the platform, and that will be permanent. The Biobank only works with accredited organisations, institutions and individual academic researchers, and the accreditation system is there to make sure that those using it are doing so for valid purposes. It has been running since 2012 and has been used for hundreds of thousands of different analyses. It works incredibly well and will continue to do so.

Let me explain how the system works and where the problem has arisen. In 2024, the system was changed from Biobank issuing datasets to accredited organisations and academic researchers to having all the information on the Biobank platform. When people access the data, they do their analysis and then download it. The system also allows people—although, contractually, accredited organisations are not supposed to do this—to download datasets. We understand from Biobank that what has probably happened is that the three institutions have downloaded the datasets themselves. As yet, we are unclear as to how those datasets ended up on the website, but UK Biobank, along with institutions and organisations attached to the Government, is working through that at the moment.

The hon. Gentleman asked for reassurance that Russia, Iran and North Korea are not accredited, and I understand from UK Biobank that they are not. He also mentioned hostile actors. UK Biobank is very strict about who has access, because there is an accreditation process. Secondly, although the three institutions are Chinese in this particular instance, the Chinese Government and Alibaba have been very proactive in helping us, through the British embassy in Beijing, to take down and whack-a-mole anything else that comes up, and they are currently going through that process. Yale University had its accreditation suspended for a breach of data, so this is not a country-specific issue. It just so happens that, in this particular case, the three institutions were Chinese. I think that answers the shadow Minister’s questions.

Health datasets of the size that UK Biobank has are incredibly important, because they allow us to find answers to the huge health challenges that many of us face, whether that is pain, as the Minister referred to, dementia or heart conditions. My concern is that this breach will make people think twice before donating their data. That could have a huge impact on our ability to treat conditions right across the world, but particularly here in the UK. The scientific community has always worked across borders and collaborated, whether that is with Europe, Canada, the US or even China. Given that it is only through these datasets that we can make medical breakthroughs, can the Minister reassure people who are thinking about participating that the protections that he, UK Biobank and other platforms of this kind are putting in place will absolutely protect people in the future?

My hon. Friend makes an incredibly important point. I will say from the Dispatch Box that we should encourage more participation in UK Biobank. It is a global leader in research and is funded by the Wellcome Trust and the Medical Research Council. It also receives significant funding from Cancer Research UK, the British Heart Foundation and the National Institute for Health and Care Research. That shows the breadth of research that it does on all the key diseases that we suffer from in this country, and it is resolving some of these problems. Chinese researchers are making significant progress on diseases such as Alzheimer’s. Biobank is a global platform, and it is very much welcomed as a research resource. We should encourage the public to make sure that they can volunteer their data, so that the health of all of us is improved as a result.

I call the Liberal Democrat spokesperson.

I, too, thank the Minister for advance sight of his statement, and I join the Government in thanking the volunteers who have given researchers access to deeply personal medical records. A very close family member of mine has recently taken the decision to share medical data—although not with UK Biobank—in order to advance such research. It is not an easy decision, but this is such an important cause. Without the many people who have handed over their data, many of the transformational medical breakthroughs of recent years would not have been possible. That is precisely why what has happened is so serious.

This is not the first leak from UK Biobank. In March, The Guardian reported that sensitive medical data donated in good faith had been posted online without the consent of donors, and records have now been put up for sale on a Chinese e-commerce site. This is a profound betrayal of the people who trusted this institution with some of the most intimate details of their lives. UK Biobank has sought reassurances that no names, contact details, NHS numbers or phone numbers were leaked. That is reassuring, but the dismissal of privacy concerns shows a shocking lack of understanding of how easily individuals can be identified, especially in today’s world of artificial intelligence and social media. I urge the Government to hold UK Biobank accountable, and to ensure that protocols are followed and that confidential patient data is not shared online.

Although we are pleased to see a quick and full response from the UK Government in this instance, volunteers need more. Will the Secretary of State require UK Biobank to provide a full, step-by-step breakdown of how it will reform its data privacy once and for all? We need not just guidance or reassurance, but binding commitments that this will not happen again, and that includes some of the technical elements. We cannot just rely on people’s commitment not to download something; the technical barriers should be there. Will the Government ensure that any new guidance strikes the right balance between enabling vital research and guaranteeing watertight protections for patient data? Such data is vital for research, which is so important for the future.

Finally, has UK Biobank even offered an apology to its volunteers? We cannot find one, so we are calling on UK Biobank to issue a full apology without delay. People gave their data to save lives, and they at least deserve accountability.

I thank the Liberal Democrat spokesperson for the way in which she has dealt with this issue. I echo her thanks to all the volunteers—not only those who give their sensitive data to UK Biobank for critical purposes, but all the volunteers who give data for all research purposes.

The Liberal Democrat spokesperson used the word “leak”, but this was not a leak; it was a legitimate download by a legitimately accredited organisation. We have identified a problem with the UK data bank system, in the sense that accredited users have used the system to analyse data sources and then download their results from that analysis, but the system has not prevented them from also downloading the source data. It is that downloaded source data that is against the terms of use for accredited organisations. The three Chinese organisations have been found to have done that, which is why they have been suspended from the site. This was not a leak as such. How that data has got from those institutions on to the Alibaba website is still to be concluded, but this was not a leak of data or a cyber-attack. This was a legitimate download of legitimate data by a legitimately accredited organisation, which is why we should not use the word “leak” for the purposes of reassuring the volunteers who put their data into the system.

Let me answer the hon. Lady’s question about what has been done and what the Government have asked Biobank to do. I reiterate that the whole system has been paused, and the board has taken actions to write to all participants; in fact, there is a statement on Biobank’s website. I cannot recall whether the statement includes an apology, but we will take that back to Biobank—I am sure it is watching this statement. The Information Commissioner’s Office will also be involved, because this issue relates to data. Biobank has referred this incident to the ICO, and we will work very closely with it. I emphasise that we take this matter extremely seriously. We came to the House at the first available opportunity this morning, before the release from Biobank had gone out, to make sure that Members could reassure the volunteers and also see how seriously we take this issue.

The hon. Lady referred to an article in The Guardian. It is because journals demand source data before publication in order to reduce fraud that the source data was included in some journal articles that linked directly to the source data on UK Biobank. Again, it was not a leak; it is about the way in which researchers used data incorrectly.

I am deeply concerned by today’s statement, not least because I am a former research scientist who is all too aware of the professional ramifications of research institutions breaching data control regulations. I know that the vast majority of researchers would never dream of abusing data in this way. Will the Minister provide a reassurance that researchers will not generally be prevented from accessing and using such data appropriately in the future?

UK Biobank has assured us over the past 24 hours that it is looking for a technical fix, which should happen relatively shortly, and we will hold it to that. To show that we are taking the situation as seriously as it should be taken, we have insisted as a Government that UK Biobank should pause all access to, downloads from and use of the system until the fix comes into place. I do not know the exact figures of usage, but across the globe there are somewhere in the region of more than 16,000 researchers using this resource, because it is so valuable. We should thank them for doing that and ensure that they have full access to UK Biobank in the safe way in which it should be used as soon as possible.

This scandal is essentially a China data theft of UK Biobank’s data, which is generously donated by some half a million British citizens. Let us remember that the UK taxpayer funded approximately £200 million for setting up UK Biobank. They fund about £15 million every single year, which is used by some 22,000 researchers, including 2,000 or 3,000 in China, I understand. Will the Minister confirm that our generosity will not be abused by Chinese researchers and that UK Biobank should exclude them in the future in order to ensure that this data theft comes with sanctions?

I do not think the tone of the hon. Gentleman’s question fits the seriousness of this issue. We are yet to get a conclusion from UK Biobank on what the process looked like for the three institutions that have been identified as downloading some datasets to transfer them to the seller, and we will update Members when we are clear on that. UK Biobank has told us quite clearly that that is what has happened.

There are thousands of Chinese researchers working every day on data from UK Biobank and other datasets from across the world, and they have been doing that since 2012 safely and securely. The issue here is that a loophole in the system has allowed datasets to be downloaded alongside the analytical research. If the hon. Gentleman saw some of the advances being made, particularly on Alzheimer’s, he would know that we are working very closely with the research community across the world, from all countries.

As I said to the shadow Minister, the previous suspension of accreditation was for Yale in the United States for misuse of data. Participants know that this research is used globally, and it is right that it is used globally for the advancement of us all. Banning researchers from the site would not be the way in which to advance the outcomes of UK Biobank.

I thank the Minister for his statement. Fundamentally, this is valuable data, and it relies on trust. I therefore welcome UK Biobank’s actions in suspending the agreement with these researchers. Will the Minister provide a commitment and welcome the technical solution for protecting this data? More and more, we are seeing papers published by AI bots, so there needs to be a way to trace back to the evidence used. There needs to be a workaround on the technical support in order to advance medical research. Will the Minister comment on that?

Significant undertakings were given by the chair and board of UK Biobank this week. They have answered all the questions and worked very closely with the Government, the British embassy in Beijing and the Chinese Government to ensure that this instance is resolved as quickly as possible. They have immediately identified the loopholes that enabled the download of the data from the institution, and they are carrying out mitigation work to ensure that that cannot happen again and to tighten up the system. That should happen within weeks, but in the meantime the UK Government insisted that all access to and downloads from it be paused, and the entire system was paused to allow that work to happen. I pay tribute to UK Biobank for the swiftness with which it has done that. To echo the words of the shadow Minister, it has dealt with the issue transparently, and we welcome that—that is what is required in these kinds of circumstances.

I thank the Minister very much for his statement. As my party’s health spokesperson, I know that research on health is so important initially. UK Biobank is a critical part of that in finding the methods and drugs for cures. The disclosure of data is always a worrying issue, so will the Minister confirm that the breakdown and the data breach do not reach as far as Northern Ireland? For example, Queen’s University Belfast and Ulster University are deeply involved in all sections of health research. Has their research been compromised in any way? We always ask for close co-operation with our universities as an integral part of the United Kingdom, and it is essential that opportunity and protection be afforded throughout the whole United Kingdom of Great Britain and Northern Ireland.

I pay tribute to the Belfast universities and the way in which they have advanced research. As has already been mentioned, tens of thousands of individual accredited researchers use UK Biobank regularly, as do thousands of institutions across the globe. We need to ensure that the system is safe, so that volunteers participating in the system can be assured that their data is safe and secured, and that is why it has been paused.

The hon. Gentleman challenges me on whether Belfast universities have been affected by this issue. They will be affected by it in the short term, because there is currently no access to the system, but we hope that that will be resolved. I understand from UK Biobank and from officials that they have been in talks with the pharmaceutical industry and researchers in the field to see whether that would cause a problem, and as long as this situation is temporary, it should not. They will technically be affected in the short term until access is fully recovered.

Yes, I can give that assurance. This Government are giving UK Biobank all the support that it requires to resolve the immediate issue and in the short term to get the system back up and running in as secure a way as possible. Let me echo that participants in UK Biobank have done a great service to the people of this country and around the world. We owe it to them to be transparent and secure, and to ensure that their data is not only safe but advancing UK and worldwide medical research for the benefit of everyone.

I will not mention Harlow Town, I promise. [Laughter.]

May I thank the Minister for his statement? I agree with others that UK Biobank is an excellent resource, and I have no doubt that its research has made a huge difference to the health of my constituents. Although this issue is not specifically a cyber-security breach, as he correctly said, will he join me in welcoming the Government’s Cyber Security and Resilience (Network and Information Systems) Bill? Along with the hon. and gallant Member for Spelthorne (Lincoln Jopp), I had the pleasure of serving on the Bill Committee. Will the Minister add to the work that this Government are doing to ensure that our data across all industries, including the charity sector and Government, is safe under this Government?

In a previous question, my hon. Friend said that Harlow Town were the Man City of non-league football. May I simply suggest that he is the Man City of speaking in this Chamber in terms of the quality and regularity of his contributions? That may be challenged by the hon. Member for Strangford (Jim Shannon)—let us look at the data.

I echo what my hon. Friend said in his question, because it is really important for us to impress on the public that data is secure and safe. This Government take that incredibly seriously, not just in the legislation being passed, which he has been a part of, but in the cyber-security tools available for free from this Government to businesses, organisations and institutions right across the country. We wrote to those organisations last week to inform them that those tools were available, and I continue to echo to all businesses, institutions and organisations that they should get involved in ensuring that they are as cyber-secure as possible. We are only as secure as the weakest, and we all have to be as secure as we possibly can be.