Should we be worried about 500,000 UK health records being shared with China?

Media reports today (16 April) revealed that Chinese researchers had accessed half a million British GP records through UK Biobank – one of the world’s largest health data research hubs that holds detailed medical information donated by half a million volunteers.

We asked our experts to explain if this data sharing should cause concern or instead be celebrated as international collaboration to pioneer healthcare solutions.

Rimesh Patel CEng, Former Chair of the Central London Network for the IET and Independent Cyber Security Specialist, said:

“The UKbiobank follows the current consent rules, where patients have provided consent for national and international sharing. Under the current law, as long as checks are made for valid research purposes with whom the data is being shared and how it is accessed, this is permitted and expected activity in the scientific community.

“As stated in the media coverage, UKbiobank uses a system where the data remains in the UK and data copies are not transferred. Therefore, while this is something to be aware of, this means the data controls are in place to stop data leaving the UK and prevent any misuse from occurring on the project end. For patients, this is their consented data that is being shared with the assumption that the data is sanitised so there is no personal impact on them.

“The protection of patient data is of utmost importance. In terms of public interest, the sharing of UK demographic data to support 'high value' research needs stronger oversight by the Government and health officials. COVID-19 was an eye-opener for the world; the same drug had different efficacy on different people, some due to genetics or perhaps to the individual's localised environment. During COVID-19, it was the scientific research community that came together, and their efforts for 'research diversification' contributed to vaccine development. In this spirit, all countries should engage for the common good.

“The UK public should be provided with assurances by the Government that all data sharing treaties are enhanced to automatically cater for national interests as part of the vetting processes used by research companies, whilst not limiting the advancement of scientific research. Like all countries, the UK's national interests in this data sharing exercise should consider what data is being shared and how it can affect any current or future national interests. Health officials should add safety measures for patient records and if these records are considered 'high value' for research, such as genome sequencing, provide an approved gateway method that assures national interests against state-actors, so that research for legitimate reasons can flourish.

“Projects like these are clearly important for humanity. In this digital globalised world, the Government and health officials have to think about implications beyond technical assurances before allowing data to be shared. The UK should now focus on balancing and optimising important aspects of data sharing outside the UK, especially if instances of data abuse are further identified that affect national interests.”

Dr Junade Ali, Fellow and cyber security expert at the IET Institution of Engineering and Technology said:

“NHS data is a key national asset which played an essential role in the UK taking a world-leading position in finding treatments and vaccines to COVID-19. UK Biobank has obtained the explicit consent of patients to have their data processed, and it has pledged to anonymise it – although it is unclear to what extent de-anonymisation is possible by those not subject to UK laws on this.

“However, the public should always have confidence that their data is protected and not shared in a way where they risk losing control over it. It is therefore essential that data protection law continues to develop to allow access for legitimate research whilst also implementing powerful measures to ensure it remains subject to domestic data protection laws when shared.”

Dr Prasanth Kamma, IET Fellow, Lead Architect (Center of Excellence) and Healthcare Technology Innovator, added:

“People have every right to ask questions when it comes to how their health data (PHI) is used. The data provided by UK Biobank is anonymised and does not include anything personally identifiable. That said, ongoing transparency around who accesses the data and why is important to maintain public trust.

“Using this data to support research is not an open-ended process. Researchers need to submit a formal application explaining their goals, methods, and data requirements. These go through review for scientific value and ethical standards. If approved, they get access to de-identified data so no names, addresses, or direct identifiers are shared. There are strict data governance policies on how the data can be used, and researchers are held accountable.

“It is important for other international researchers to be able to use this data. Healthcare research is a global effort. Scientists from all over the world, including China, contribute to advancements that benefit everyone. What’s important is that the approval process is followed, data usage is transparent, and appropriate checks are in place. The volume of Chinese applications likely reflects the scale of their research community.

“The UK has built a strong framework for managing research data. The Biobank is known for high ethical and data governance standards. Still, with the pace of change in AI, genomics, and global data-sharing, it's important to keep refining those safeguards. Regular audits and policy updates are necessary to keep the system resilient and secure.”

Nick Hunn, IET Fellow and Chief Technology Officer at WiFore Consultancy Ltd, commented:

"As with any data, it is only worth gathering if you use it. The holy grail is to use it to try and improve medical outcomes, which requires very large amounts to be accumulated over time, so that we can see what works and what doesn’t, to improve diagnostics, treatments and prevention. That means generating large databanks, such as the biobank, and then letting that data be used to see what inference can be generated.

"It is the collected data which is the valuable training resource, not the individual data elements.  An individual medical record is largely irrelevant, millions of them benefit society.  That societal value should be what drives this research, but it gets muddied by the personal ownership.  Certainly, individuals should never be harmed by the use of their data, but that’s a different strand of missing legislation."

ENDS

About the IET

• We inspire, inform and influence the global engineering community to engineer a better world.
• We are a diverse home for engineering and technology intelligence throughout the world. This breadth and depth means we are uniquely placed to help the sector progress society.
• We want to build the profile of engineering and technology to change outdated perceptions and tackle the skills gap. This includes encouraging more women to become engineers and growing the number of engineering apprentices.
• Interview opportunities are available with our spokespeople from a range of engineering and technology disciplines including cyber-security, energy, engineering skills, innovation, manufacturing, technology, transport and diversity in engineering.
• For more information, visit The IET.

Media enquiries to:

Rebecca Gillick
External Communications Manager
E: rgillick@theiet.org

Jack Tappin
Senior Communications Executive
E: JackTappin@theiet.org