UK Biobank Data

Victoria Collins Excerpts

Thursday 23rd April 2026 Commons Chamber

[Madam Deputy Speaker]

I call the Liberal Democrat spokesperson.

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

I, too, thank the Minister for advance sight of his statement, and I join the Government in thanking the volunteers who have given researchers access to deeply personal medical records. A very close family member of mine has recently taken the decision to share medical data—although not with UK Biobank—in order to advance such research. It is not an easy decision, but this is such an important cause. Without the many people who have handed over their data, many of the transformational medical breakthroughs of recent years would not have been possible. That is precisely why what has happened is so serious.

This is not the first leak from UK Biobank. In March, The Guardian reported that sensitive medical data donated in good faith had been posted online without the consent of donors, and records have now been put up for sale on a Chinese e-commerce site. This is a profound betrayal of the people who trusted this institution with some of the most intimate details of their lives. UK Biobank has sought reassurances that no names, contact details, NHS numbers or phone numbers were leaked. That is reassuring, but the dismissal of privacy concerns shows a shocking lack of understanding of how easily individuals can be identified, especially in today’s world of artificial intelligence and social media. I urge the Government to hold UK Biobank accountable, and to ensure that protocols are followed and that confidential patient data is not shared online.

Although we are pleased to see a quick and full response from the UK Government in this instance, volunteers need more. Will the Secretary of State require UK Biobank to provide a full, step-by-step breakdown of how it will reform its data privacy once and for all? We need not just guidance or reassurance, but binding commitments that this will not happen again, and that includes some of the technical elements. We cannot just rely on people’s commitment not to download something; the technical barriers should be there. Will the Government ensure that any new guidance strikes the right balance between enabling vital research and guaranteeing watertight protections for patient data? Such data is vital for research, which is so important for the future.

Finally, has UK Biobank even offered an apology to its volunteers? We cannot find one, so we are calling on UK Biobank to issue a full apology without delay. People gave their data to save lives, and they at least deserve accountability.

[Ian Murray]

I thank the Liberal Democrat spokesperson for the way in which she has dealt with this issue. I echo her thanks to all the volunteers—not only those who give their sensitive data to UK Biobank for critical purposes, but all the volunteers who give data for all research purposes.

The Liberal Democrat spokesperson used the word “leak”, but this was not a leak; it was a legitimate download by a legitimately accredited organisation. We have identified a problem with the UK data bank system, in the sense that accredited users have used the system to analyse data sources and then download their results from that analysis, but the system has not prevented them from also downloading the source data. It is that downloaded source data that is against the terms of use for accredited organisations. The three Chinese organisations have been found to have done that, which is why they have been suspended from the site. This was not a leak as such. How that data has got from those institutions on to the Alibaba website is still to be concluded, but this was not a leak of data or a cyber-attack. This was a legitimate download of legitimate data by a legitimately accredited organisation, which is why we should not use the word “leak” for the purposes of reassuring the volunteers who put their data into the system.

Let me answer the hon. Lady’s question about what has been done and what the Government have asked Biobank to do. I reiterate that the whole system has been paused, and the board has taken actions to write to all participants; in fact, there is a statement on Biobank’s website. I cannot recall whether the statement includes an apology, but we will take that back to Biobank—I am sure it is watching this statement. The Information Commissioner’s Office will also be involved, because this issue relates to data. Biobank has referred this incident to the ICO, and we will work very closely with it. I emphasise that we take this matter extremely seriously. We came to the House at the first available opportunity this morning, before the release from Biobank had gone out, to make sure that Members could reassure the volunteers and also see how seriously we take this issue.

The hon. Lady referred to an article in The Guardian. It is because journals demand source data before publication in order to reduce fraud that the source data was included in some journal articles that linked directly to the source data on UK Biobank. Again, it was not a leak; it is about the way in which researchers used data incorrectly.