Medical data belonging to 500,000 participants of the UK’s health data project, UK Biobank, were offered for sale online in China, the government has confirmed.
Technology minister Ian Murray said he was notified about the breach by the Biobank team on Monday, which he called “unacceptable” as confidential information of all database members was listed for sale on the Alibaba website.
Names, addresses and contact details were excluded from the advertisements online, however Murray admitted other personal information such as gender, age, month and year of birth could be included.
Will Richmond-Coggan, a partner specialising in data breach litigation at Freeths LLP, commented that it is “important to understand that just because this data was ‘deidentified’ doesn’t stop it being personal data”.
“The level of information included about home location and personal circumstances, coupled with potentially highly individual medical symptoms, may present a real risk of re-identification. This is why such data is still treated as special category personal data, and organisations handling it ought to be putting a robust framework of protections in place to protect such information.”
In a statement posted on their website, Biobank apologised for the incident and vowed to conduct an investigation.
The UK Biobank apologised to participants and confirmed that an investigation is underway. In a message to volunteers, chief executive Rory Collins said all data involved was “de-identified” and that personally identifying information remained secure.
The datasets had originally been made available to researchers at three academic institutions but were improperly listed online in breach of strict contractual terms. The listings were removed quickly, and Biobank said no purchases were made. Access for the institutions and individuals involved has since been suspended and Biobank has temporarily halted access to its research platform and introduced tighter controls on data downloads.
The UK Biobank contains DNA sequences, medical records and imaging from volunteers recruited between 2006 and 2010 to support advancing research into diseases such as dementia, cancer and Parkinson’s.
