UK Biobank Data

Baroness Ludford Excerpts

Tuesday 28th April 2026 Lords Chamber

[Lord Vallance of Balham (Lab)]

UK Biobank referred itself to the ICO, which was the entirely appropriate thing to do. The matter is now in the ICO’s hands.

[Baroness Ludford (LD)]

My Lords, my question to the Minister follows on from the previous question. How will we know that the necessary cultural revolution among stewards of medical data has taken place? What has happened—that UK Biobank allowed the download of the data—is frankly astonishing. I must admit, I have been worried about this sector since I was first involved in the drafting of the GDPR as an MEP nearly 15 years ago. I have also felt that the UK authorities were a little casual in the information given to patients. I do not know if anyone remembers care.data, with the obfuscation about opt-ins and opt-outs and moving the goalposts and so on. The chief executive of UK Biobank made the usual sort of statement:

“We take the protection of participants’ data extremely seriously and do not tolerate any form of data misuse”,


whereas other, more realistic commentators have used adjectives such as “supremely careless”, “irresponsible” and “cavalier”.

How will the Information Commissioner get proactive in this area? It is a betrayal of patients’ trust. Of course we want research. I have been tangentially involved in research for a cure for diabetes, because my late husband was type 1, and he was involved in this area. The fact is that this was re-identifiable data. Some press referred to it as “anonymised”; it was not anonymised. If it was anonymised, it would not be personal data. It is capable of being re-identified if you know some things about someone that are in the database. As Sam Smith of medConfidential said:

“If I knew that someone had a kidney removed on a particular week in June 2021 as Wes Streeting did, I would know everything else about them”.


I do not know whether that is true, but these guys know what they are talking about. As I said, how do we make sure that there really is a cultural revolution? Otherwise, we are not going to have patients’ trust in this essential area.

[Lord Vallance of Balham (Lab)]

That last point is fundamental: we must have trust. If we do not get trust, we lose the ability to use what is an extraordinary resource, so that has to be part of what is looked at here. It is absolutely part of what the board of UK Biobank is doing in its review, and it needs a very clear look.

When it started, UK Biobank was at the forefront of protection. It had very robust mechanisms to scrutinise researchers and institutions and make sure that this was properly looked after. What has happened is that things have overtaken UK Biobank and it has not kept up, whereas others have put in a secure data platform to try to deal with these issues, so there is a question there. Part of this is because of the sheer size of the database, but it is not excusable, and this needs to be sorted out.

Going back to the point made by the noble Lord, Lord Tarassenko, it is theoretically possible to re-identify people. It is not at all easy, and it is a low probability, but it is not zero probability. Therefore, I agree with the point that this is a real wake-up call for researchers. We need to make sure that we build the right trust in. We are putting together the Health Data Research Service, with this at the very heart of what it is going to do to make sure that there is trusted access to this type of data.