Investigation: UK biomedical research database Biobank shared the sensitive health data of ~500K volunteers with insurance companies despite pledging not to

The Guardian 2023-11-13 Shanti Das

Context & Ripple Effects

This disclosure extends a UK health-data governance arc in which critics had already challenged whether data sold from NHS records could credibly be treated as anonymous concerns over the claimed anonymity of NHS patient data. It also follows plans to pool medical histories for third-party sharing England's proposed centralization of patient records.

Biobank matters because volunteer participation depends on a clear boundary between biomedical research access and commercial use by insurers. An apparent breach of that boundary puts the institution's data-access commitments at the center of the story, not merely the security of the records.

First-order effects

Insurance companies received sensitive information relating to roughly 500,000 Biobank volunteers, despite the reported pledge not to share it with them.
Biobank's assurances to participants face an immediate credibility problem, raising pressure to account for the disclosures and its access controls.

Second-order effects

Researchers and institutions relying on volunteer datasets may face greater participant skepticism, which can make consent, recruitment, and continued data contribution harder.
Other UK health-data custodians will face closer scrutiny over whether their commercial-access rules, anonymization claims, and participant communications match actual data-sharing practices.

Third-order effects

If repeated disclosures erode confidence, health-data programs may need more explicit consent boundaries and more auditable controls over downstream recipients, rather than relying on broad research-use assurances.
The episode highlights a structural tension in data-driven health research: expanding the value of large datasets can conflict with the trust required to assemble and sustain them.

The trend: UK health-data sharing is moving toward a trust-and-accountability test, where commercial access arrangements are judged against the consent commitments made to patients and volunteers.

Discussion

@JackTheCat@mastodon.scot @JackTheCat@mastodon.scot on mastodon
“My god, it's full of data.” — Private UK health data donated for medical research shared with insurance companies. — https://www.theguardian.com/ ...
@drstevetaylor Steve Taylor on x
And the NHS is about to award the whole of it's data contract to a US company called Palantir - it's not safe now & won't be in the future
@karamballes Karam Bales on x
And this is why giving Peter Thiel's Palantir access to our health data is incredibly worrying
@mikebutcher Mike Butcher on x
.@UK_Biobank said it “strictly guarded” access to its data, and made public commitments it would not share data with insurance companies. Turns out it did. https://www.theguardian.com/ ...
@jessrmorley Jess Morley on x
There's a LOT to say, but, briefly: - consent is pointless unless it's meaningful - “public good” is a problematic, ill-defined & over-used phrase - support for science & research is *conditional* - ethics is > privacy - privacy = a group level construct https://www.theguardian.c…
@winchwoodie @winchwoodie on x
Why Palantir should be fought tooth and nail
@sewsow1 @sewsow1 on x
@doctor_oxford I withdrew permission from Biobank after they wrote saying they would be collecting data direct from my GP. I already have a “caredata” refusal lodged, but now we're likely to have Palantir to contend with as well.
@_danibeck Dr. Dani Beck on x
The UK Biobank promised not to share participant data with insurance companies and now it seems like it has done exactly that. Participants give us our trust when taking part in research. This is a major breach of that trust. @AcademicChatter https://www.theguardian.com/ ...
@premnsikka Prem Sikka on x
Sensitive health information donated for medical research by UK citizens shared with insurance companies despite a pledge that it would not be. Can't trust corporations. Everything is commodified for profit. No regulator holding companies to account. https://www.theguardian.com/ …
@helenrsalisbury Dr Helen Salisbury on x
I think I will be contacting UK Biobank and asking them to delete all my data. It is question of trust, and they have lost mine.
@pwgtennant Peter Tennant, PhD on x
For 17 years, @uk_biobank promised that “insurance companies...will not be given any individual's information, samples or test results”. Now an investigation reveals they have repeatedly shared data with insurance companies. A shocking breech of trust. https://www.theguardian.com…
@paullewismoney Paul Lewis on x
Sensitive health information donated for medical research by half a million UK citizens has been shared with insurance companies despite a pledge that it would not be. UK Biobank let insurers use its database to assess risk and set premiums https://www.theguardian.com/ ... [image…
@shanti_das Shanti Das on x
Sensitive health data donated by half a million people for medical research was shared with insurance firms despite a pledge it would not be. @UK_Biobank previously said: “No insurance company will have access.” https://www.theguardian.com/ ...
@doctor_oxford Rachel Clarke on x
When the UK Biobank was set up in 2006, the public was promised their sensitive health data would never be sold to insurance companies. That was a lie. Volunteers' data is being sold to private health insurers for profit. A scandalous betrayal of trust. https://www.theguardian.co…
r/privacy r on reddit
Guardian article: Private UK health data donated for medical research shared with insurance companies
r/unitedkingdom r on reddit
Private UK health data donated for medical research shared with insurance companies

Chronicles