UK Biobank data for 500,000 volunteers listed for sale on Alibaba; Minister makes Commons statement, ICO referral made and platform access suspended

Summary. On 23 April 2026, the Rt Hon Ian Murray MP, Minister of State jointly at the Department for Culture, Media and Sport and the Department for Science, Innovation and Technology (DSIT), made an oral statement to the House of Commons disclosing that data relating to UK Biobank participants had been advertised for sale on Alibaba's e-commerce platforms in China. Three listings had been identified, at least one of which appeared to contain data from all 500,000 UK Biobank volunteers; the remaining two offered, respectively, support for applying for legitimate access to UK Biobank data and analytical support for researchers who already held access. A corresponding statement was made the same day in the House of Lords by Lord Vallance, Minister for Science, Research and Innovation. The Government confirmed that the three listings had been removed, that access had been revoked for the three research institutions identified as the source of the data, that downloads from the UK Biobank platform had been suspended, and that UK Biobank had referred itself to the Information Commissioner's Office (ICO).

Background. UK Biobank is an independent non-profit charity that holds health and genetic data voluntarily donated by approximately 500,000 participants. The dataset is made available to approved researchers globally under access controls and has been used to support research into conditions including heart disease, cancer, dementia, and COVID-19 immunity. Under its standard terms, access is granted to approved institutions that agree to prescribed data-handling obligations. The 23 April incident is not the first occasion on which UK Biobank data is reported to have appeared outside the platform: in March 2026, The Guardian reported that sensitive donated material had been posted online without donors' consent, and academic commentators have characterised the Alibaba listings as the latest in a sustained pattern of data exposures over the preceding twelve months. Lord Vallance, who delivered the Lords statement, was a non-executive director and board member of UK Biobank prior to taking up the role of Government Chief Scientific Adviser in 2018.

Development. UK Biobank informed the Government on Monday 20 April 2026 that three listings appearing to sell UK Biobank participant data had been identified on Alibaba. The Minister confirmed to the House that, on Biobank's advice, the data did not contain participants' names, addresses, contact details, or telephone numbers; UK Biobank's own statement to participants further confirms the absence of NHS numbers and dates of birth. The Government stated that, as of 23 April 2026, the vendor had told it that no purchases from the three listings had been made before they were removed. Three steps were taken: (i) the three listings were removed following engagement between the UK Government, the Chinese Government, the vendor, and Alibaba; (ii) UK Biobank revoked access for the three research institutions identified as the source of the data; and (iii) UK Biobank was asked to suspend further data access pending implementation of a technical solution to prevent bulk downloading. The Minister confirmed that the access suspension was in place as of 23 April 2026. UK Biobank self-referred to the ICO, which has confirmed in a statement carried by multiple outlets that it is making enquiries; the ICO has not yet indicated what, if any, formal steps it will take. A root cause analysis is ongoing. The Minister told the House that UK Biobank's working understanding is that the three institutions downloaded the bulk dataset to local storage in breach of their contractual obligations, although the precise mechanism by which the data subsequently came to be listed for sale has not been established. The Minister also stated that the Government would issue new guidance on the control of data from research studies.

Status. UK Biobank has implemented an interim measure limiting the size of files that can be exported from its platform. A more comprehensive automated checking system, intended to prevent de-identified participant data from being taken off the platform, is expected to be in place around the end of 2026, according to a statement issued by Sir Rory Collins, UK Biobank's Chief Executive and Principal Investigator. UK Biobank's board has been asked to conduct a rapid review of data access safeguards, and the charity has indicated it will write to all 500,000 participants. The position is not static: in his statement to the Lords on 23 April, Lord Vallance disclosed that further listings had appeared on Alibaba since the Government had been notified of the incident on 20 April, and that work with the Chinese Government to remove them was ongoing. The ICO referral is pending further enquiry. The Minister stated that new government guidance on research data controls would be issued shortly; no specific publication date was given.