LONDON, April 23 (Reuters) - Britain is investigating how data from a health charity came to be advertised for sale on China's Alibaba, a government minister said on Thursday, including one dataset
UK investigates after big health dataset listed for sale on China's Alibaba
Government Response to UK Biobank Data Breach
By Sam Tabahriti
Discovery of the Data Breach
LONDON, April 23 (Reuters) - Britain is investigating how data from a health charity came to be advertised for sale on China's Alibaba, a government minister said on Thursday, including one dataset that appeared to contain information from 500,000 people.
Science minister Ian Murray told lawmakers that the charity, UK Biobank, had informed the government on Monday that its data appeared to have been advertised for sale in three different listings by several sellers on Alibaba's e-commerce platforms.
Details of the Data Involved
UK Biobank, a health research charity that provides anonymised data to accredited researchers, said the data from its 500,000 volunteers did not include their names, addresses, contact details or telephone numbers, Murray said.
Actions Taken by Authorities
"The government has spoken to the vendor today and they do not believe that there were any purchases from the three listings before they were taken down," Murray said.
He added that the government had worked with UK Biobank, the Chinese government and the vendor to have the listings removed, and that the charity had revoked access to three research institutions identified as the source of the data.
Breach Prompts Security Overhaul
BREACH PROMPTS SECURITY OVERHAUL
UK Biobank's Response
In a message published on its website, UK Biobank described the incident as a clear breach of contractual obligations and said it would carry out a comprehensive board-led investigation into the incident.
The charity said it had temporarily suspended all access to its research platform while additional security measures were put in place to limit the size of files that can be exported and to monitor downloads for suspicious activity.
Assurances on Data Privacy
UK Biobank confirmed the data involved did not contain personally identifying information and said that there was no evidence of participants being identified against their will.
Government's Position and Next Steps
Murray, who described the incident as an unacceptable abuse of UK Biobank's data and said the government took the matter "extremely seriously," said the charity had referred itself to the Information Commissioner's Office.
(Reporting by Sam Tabahriti; editing by Sarah Young)
