The statement made by Ian Murray, the Minister for Digital Government and Data, in the House of Commons on 23 April 2026.
With permission, Madam Deputy Speaker, I will make a statement about the use of UK Biobank data.
UK Biobank is a non-profit charity, independent of Government. The Biobank brings together data, kindly donated by its volunteer participants, that is shared with accredited researchers globally to make significant scientific discoveries that improve patient health. That includes discovering genes that affect the risk of heart disease or cancer, identifying new ways of predicting dementia, identifying early warning signs for cancers, understanding immunity to covid-19, and work towards earlier detection of Parkinson’s. It is one of the most successful and important studies of its type, and it continues to benefit patients in the UK and around the world. We are all grateful to those individuals who are part of this landmark study that is so important for all of our health.
On Monday 20 April, the UK Biobank charity informed the Government that it had identified that its data had been advertised for sale by several sellers on Alibaba’s e-commerce platforms in China. Biobank told us that three listings that appeared to sell UK Biobank participation data had been identified. At least one of the three datasets appeared to contain data from all 500,000 UK Biobank volunteers. Additional listings offered support for applying for legitimate access to UK Biobank data or analytical support for researchers who already have access to the data. I want to reassure the House up front, however, that Biobank has advised that this data did not contain participants’ names, addresses, contact details or telephone numbers. The Government have spoken to the vendor today and they do not believe that there were any purchases from the three listings before they were taken down.
Once the Government were made aware of the situation, we took immediate action to protect participants’ data. First, we worked with Biobank, the Chinese Government and the vendor to ensure that the three listings that UK Biobank informed us included participant data had been removed. I want to thank the Chinese Government for the speed and seriousness with which they worked with us to help remove the listings and the ongoing work to remove any further listings. Secondly, we ensured that the Biobank charity revoked access to the three research institutions identified as the source of the information. Thirdly, we have asked that the Biobank charity pauses further access to its data until it has put in place a technical solution to prevent data from its current platform from being downloaded in this way again. I can confirm to the House that this pause is now in place. UK Biobank has also referred itself to the Information Commissioner’s Office.
We are still working with Biobank to ascertain from it the specific detail of what has happened. We have asked it to investigate how this data ended up for sale online as a priority, but I wanted to ensure that the House was aware of the incident and the action that the Government are taking.
Officials have been in regular contact with UK Biobank since the Government were made aware of the issue on Monday. I personally spoke to the chief executive and chair last night, alongside the Minister of State for Science and the Minister for Health Innovation and Safety. We have received assurances that the charity will conduct a rapid board-level review of the safeguards in place for accessing its data.
As I mentioned, in the short term, Biobank will suspend downloads from its platform. That is until a new system is brought in to control analysis downloads to approved researchers and will significantly enhance data access controls and safeguards. We have advised the chair and chief executive of Biobank to write to all participants as soon as possible to ensure that they are aware of what has happened.
In summary, and to be clear to the House and to those people affected, the charity has assured us that the data did not contain anybody’s names, addresses or contact details. It includes only data of people who have explicitly opted in to be part of the Biobank. Those are people who have given their explicit consent that this data can be used, in the knowledge that it will be shared with researchers globally.
Participants have done a great service to the people of this country, and human health globally, through their participation. For example, valuable research is being carried out at McGill University in Canada into chronic pain, which afflicts millions of people here in the UK. We expect UK Biobank to remain one of the leading health research resources.
This has been an unacceptable abuse of the UK Biobank charity’s data, and an abuse of the trust that participants rightly expect when sharing their data for research purposes. The Government take the incident extremely seriously, which is why we have acted rapidly to support the UK Biobank charity in its response and why I wanted to update the House at the earliest opportunity.
The Government will soon be issuing new guidance on control of data from research studies. I take this opportunity once again to urge all businesses and charities to ensure that that their systems and data-sharing processes are as secure as possible. We wrote to businesses last week about the cyber-security tools available to them—for free—from the Government and the steps they should take to maximise security. Ensuring the safe use of UK data is a priority for the Government. I commend this statement to the House.