UK Biobank Data

Viscount Stansgate Excerpts

Tuesday 28th April 2026 Lords Chamber

[Lord Vallance of Balham (Lab)]

Let me thank the noble Lord, Lord Tarassenko, and his wife for participating in UK Biobank, because the whole thing depends on that. He is quite right that, before 2024, the data was downloaded and people did their research on downloaded data. I have had this discussion with the chair of UK Biobank, which is going through a process of recontacting all the institutions—because this is an institutional agreement—to confirm that the data that was downloaded has been deleted. No further access will be granted until that is proven. That process is important, because that residual downloaded data is most vulnerable.

[Viscount Stansgate (Lab)]

My Lords, I am grateful to my noble friend for coming to the House about this very serious incident, and I welcome what the Government are doing to try to prevent it happening again. I echo what has been said about the vital importance of UK Biobank. Nevertheless, I have two quick questions for my noble friend. First, the Statement says that UK Biobank has revoked access to the research institutions that were identified as the source of the leak. Can my noble friend tell the House what those research institutions are? Secondly, in regard to the self-reference by UK Biobank to the Information Commissioner’s Office, what exactly does my noble friend hope will result from that self-reference to ensure that this does not happen again?

[Lord Vallance of Balham (Lab)]

I thank my noble friend for the question. UK Biobank has identified the sites that were responsible for the leak. There were three institutions: the Second Xiangya Hospital, China-Japan Union Hospital, and Beijing Chaoyang Hospital. Those institutions have been contacted, to be dealt with as discussed. Sorry, I have forgotten my noble friend’s second question.

[Viscount Stansgate (Lab)]

It was about the Information Commissioner’s Office.

[Lord Vallance of Balham (Lab)]

UK Biobank referred itself to the ICO, which was the entirely appropriate thing to do. The matter is now in the ICO’s hands.