UK Biobank Data

Debate between Victoria Collins and Ian Murray

Thursday 23rd April 2026 Commons Chamber

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

I, too, thank the Minister for advance sight of his statement, and I join the Government in thanking the volunteers who have given researchers access to deeply personal medical records. A very close family member of mine has recently taken the decision to share medical data—although not with UK Biobank—in order to advance such research. It is not an easy decision, but this is such an important cause. Without the many people who have handed over their data, many of the transformational medical breakthroughs of recent years would not have been possible. That is precisely why what has happened is so serious.

This is not the first leak from UK Biobank. In March, The Guardian reported that sensitive medical data donated in good faith had been posted online without the consent of donors, and records have now been put up for sale on a Chinese e-commerce site. This is a profound betrayal of the people who trusted this institution with some of the most intimate details of their lives. UK Biobank has sought reassurances that no names, contact details, NHS numbers or phone numbers were leaked. That is reassuring, but the dismissal of privacy concerns shows a shocking lack of understanding of how easily individuals can be identified, especially in today’s world of artificial intelligence and social media. I urge the Government to hold UK Biobank accountable, and to ensure that protocols are followed and that confidential patient data is not shared online.

Although we are pleased to see a quick and full response from the UK Government in this instance, volunteers need more. Will the Secretary of State require UK Biobank to provide a full, step-by-step breakdown of how it will reform its data privacy once and for all? We need not just guidance or reassurance, but binding commitments that this will not happen again, and that includes some of the technical elements. We cannot just rely on people’s commitment not to download something; the technical barriers should be there. Will the Government ensure that any new guidance strikes the right balance between enabling vital research and guaranteeing watertight protections for patient data? Such data is vital for research, which is so important for the future.

Finally, has UK Biobank even offered an apology to its volunteers? We cannot find one, so we are calling on UK Biobank to issue a full apology without delay. People gave their data to save lives, and they at least deserve accountability.

[Ian Murray]

I thank the Liberal Democrat spokesperson for the way in which she has dealt with this issue. I echo her thanks to all the volunteers—not only those who give their sensitive data to UK Biobank for critical purposes, but all the volunteers who give data for all research purposes.

The Liberal Democrat spokesperson used the word “leak”, but this was not a leak; it was a legitimate download by a legitimately accredited organisation. We have identified a problem with the UK data bank system, in the sense that accredited users have used the system to analyse data sources and then download their results from that analysis, but the system has not prevented them from also downloading the source data. It is that downloaded source data that is against the terms of use for accredited organisations. The three Chinese organisations have been found to have done that, which is why they have been suspended from the site. This was not a leak as such. How that data has got from those institutions on to the Alibaba website is still to be concluded, but this was not a leak of data or a cyber-attack. This was a legitimate download of legitimate data by a legitimately accredited organisation, which is why we should not use the word “leak” for the purposes of reassuring the volunteers who put their data into the system.

Let me answer the hon. Lady’s question about what has been done and what the Government have asked Biobank to do. I reiterate that the whole system has been paused, and the board has taken actions to write to all participants; in fact, there is a statement on Biobank’s website. I cannot recall whether the statement includes an apology, but we will take that back to Biobank—I am sure it is watching this statement. The Information Commissioner’s Office will also be involved, because this issue relates to data. Biobank has referred this incident to the ICO, and we will work very closely with it. I emphasise that we take this matter extremely seriously. We came to the House at the first available opportunity this morning, before the release from Biobank had gone out, to make sure that Members could reassure the volunteers and also see how seriously we take this issue.

The hon. Lady referred to an article in The Guardian. It is because journals demand source data before publication in order to reduce fraud that the source data was included in some journal articles that linked directly to the source data on UK Biobank. Again, it was not a leak; it is about the way in which researchers used data incorrectly.

Online Safety Act 2023: Repeal

Debate between Victoria Collins and Ian Murray

Monday 15th December 2025 Westminster Hall

[Ian Murray]

My hon. Friend makes a good point; let me come back to him in detail on the VPN issue, as his question relates to what we are planning to do in our review of the Online Safety Act, including both what was written into the legislation and what was not.

My hon. Friend the Member for Darlington (Lola McEvoy), who is no longer in her place, highlighted the really important issue of chatbots, which has also been mentioned by a number of other Members. Generative AI services including chatbots that allow users to share content with one another or search live websites to provide search engines are already regulated under the Online Safety Act. Those services must protect users from illegal content and children from harmful and age-inappropriate content.

[Victoria Collins]

Ofcom has said, and my understanding is, that in certain circumstances AI chatbots are covered, but certain new harms—such as emotional dependence—are not. That is an area where the House and many people are asking for clarity.

[Ian Murray]

I do not disagree with the hon. Lady. There are a whole host of issues around porn bots and AI-generated bots that have now also sprung up. We know that we are committed to the Online Safety Act and its review as its being implemented. As technology moves on quickly, we have to keep pace with what the harms are and how we are able to deal with them. I thank the hon. Lady for raising those particular issues.

We will act on the evidence that comes forward. It is clear that if the evidence shows us that we have to act in various areas, including chatbots, we will do so. The Secretary of State announced plans to support a child safety summit in 2026, which will bring together tech companies, civil society and young people to shape how AI can benefit children and look at online harms and the movements on those.

--- Later in debate ---

[Ian Murray]

Sir John, you are indeed very kind. My hon. Friend gave two examples during his speech. First, he mentioned brakes that were available only for high-end and expensive cars, and are now on all cars. Secondly, he mentioned building regulations, and how we would not build a balcony without a barrier. Those examples seem fairly obvious and almost flippant, but it seems strange that we would regulate heavily to make sure that people are safe physically—nobody would ever argue that it would be a complete disregard of people’s freedom to have a barrier on an 18th-floor balcony—but not online. We do that to keep people safe, and particularly to keep children safe. As my hon. Friend said, if we are keeping adults safe, we are ultimately keeping children safe too.

We have to continue to monitor and evaluate. I was just about to come on to the post-implementation review of the Act, which I am sure my hon. Friend will be very keen to have an input into. The Secretary of State must complete a review of the online safety regime two to five years after part 3 of the Act, which is about duties of care, fully comes into force. The review will therefore be completed no sooner than 2029. These are long timescales, of course, and technology is moving, so I understand the point that he is making. I recall that in the Parliament from 2010 to 2015, we regulated for the telephone, so we move slowly, although we understand that we also have to be nimble to legislate.

The Lib Dem spokesperson, the hon. Member for Harpenden and Berkhamsted, asked whether the Act has gone far enough. Ofcom, the regulator, is taking an iterative approach and will strengthen codes of practice as online harms, technology and the evidence evolve. We are already making improvements, for example strengthening the law to tackle self-harm, cyber-flashing and strangulation. The hon. Lady also asked whether Ofcom has received an increase in resources. It has—Ofcom spending has increased by nearly 30% in the past year, in recognition of its increased responsibilities. She also asked about a digital age of consent. As I mentioned, we have signed a memorandum of understanding with Australia and will engage with Australia to understand its approach. Any action will be based, of course, on robust evidence.

[Victoria Collins]

I would just like to clarify that I made a call for an age of data consent. We put that forward earlier this year as an amendment to the Act. A very first step is to stop social media companies harvesting data and using it to power these addictive algorithms against young people. It is about data consent to 16. Then of course, there is the wider discussion about what is happening with social media in general, but it is that age of data consent that is our first call to action.

Mandatory Digital ID

Debate between Victoria Collins and Ian Murray

Tuesday 21st October 2025 Westminster Hall

[Ian Murray]

Of course it is a consultation. It is about how we get this right, what it looks like, how it is built, how federated data is secured, how we deal with digital inclusion and how we deal with the issues in Northern Ireland. That is what the consultation is about. It is about the Government learning from that. [Interruption.] Liberal Democrat Members are heckling from a sedentary position, but their own leader, the right hon. Member for Kingston and Surbiton (Ed Davey), said on 21 September that “times have changed”, and that he had been impressed by a visit to Estonia, where a liberal Government had brought in digital ID. He said that if a system was

“giving individuals power to access public services”,

he could be in favour. Four days later, he said that

“the Liberal Democrats will fight against it tooth and nail”.

It is the same hypocrisy as the Scottish National party; it was their policy five days before they came out against it.

[Victoria Collins]

I would just highlight that what was stated was about the system being voluntary and about choice. We are saying that a mandatory system is a problem. Do this Government want to grow this economy or not? Do they want to give people who want to work a real choice? I do not see that at all.

[Ian Murray]

This is about reconnecting citizens with Government. Everyone will have constituents coming to every one of their surgeries with a form they cannot fill out, a piece of maladministration in public services, something they cannot access or a difficulty in getting access to benefits. There are still people in this country who are entitled to huge parts of the benefit system but do not claim. There are people who will need this for verification of identity and their age in buying alcohol—all those things that are a big inconvenience for people. This is about reconnecting citizens with Government—modernising government, as we have heard from the Opposition spokesperson, the hon. Member for Runnymede and Weybridge (Dr Spencer). It is about making sure that the Government can be effective and can be in the digital age with a digital population. This happens in many other countries around the world. I do not have time to run through all of them now, but hon. Members can look them up.

Let me take on two issues before I finish. The first is data and security. This is a federated data system, so I say to the hon. Member for Dewsbury and Batley (Iqbal Mohamed) that his idea of bringing it all together in one database is the wrong option. The data does not move; it sits with the Government Department, and the digital ID system, or whatever system is used, goes into those datasets and brings out affirmative or otherwise—