UK Health Data Listed for Sale on Alibaba in China

The UK government is examining how health data shared with a charity for research purposes appeared on sale through three vendors on Alibaba’s e-commerce platform in China. One of the listings included information from 500,000 individuals. A UK minister revealed this during a parliamentary session on Thursday, stating that data from the UK Biobank charity had been briefly offered for sale by at least three vendors on the Chinese platform.

Labour MP Ian Murray, who serves as a minister of state at the Department of Science, Innovation and Technology, informed Parliament that the charity first raised the issue with the government on Monday. He noted that the data is no longer available for sale and that no buyers are believed to have paid for it before the listings were removed. Murray expressed gratitude to the Chinese government for its “speed and seriousness” in collaborating to take down the listings.

“At least one dataset appeared to contain information from all 500,000 UK Biobank volunteers,” Murray stated in the House of Commons. “However, Biobank has confirmed this data did not include people’s names, addresses, contact details, or telephone numbers.”

UK Biobank, a prominent global biobank, suspended access to its research platform as a temporary measure. Chief executive Rory Collins explained in a message to participants that the charity imposed a strict limit on file sizes to prevent further data leaks. Murray also mentioned that the charity has referred the incident to the Information Commissioner’s Office for a thorough review.

“The individuals involved breached the contract they signed with UK Biobank,” Collins stated. “Their academic institutions were immediately barred from accessing the data.”

Conservative MP Lincoln Jopp, drawing from his experience managing data breaches as a tech company executive, labeled the incident “a very grave event.” He highlighted the trust placed in UK Biobank’s volunteers and urged the government to bolster security measures, including vetting research institutions. Jopp questioned whether the banned institutes were based in China and sought clarity on the data’s current status with the Chinese authorities.

Murray outlined the type of data potentially exposed, such as gender, age, birth dates, attendance records, socioeconomic status, and health metrics. He noted that while the charity cannot guarantee absolute anonymity, the likelihood of identifying individuals from this data is considered low in most cases. The minister also mentioned that Russia, Iran, and North Korea were among the countries associated with institutions that had access to UK Biobank records.

Biobanks, like UK Biobank, are typically government-backed initiatives aimed at gathering medical data and samples. They are celebrated as critical advancements in biomedical research, enabling swift access to extensive datasets for scientists worldwide. The incident has sparked concerns about data privacy and international data sharing practices.