I have just received an invitation to take part in the UK Biobank study. For those of you who are not familiar with it, it is an ambitious project to set up a prospective cohort that can be used for a wide range of epidemiological studies, and in the words of the UK Biobank website, "with the aim of improving the prevention, diagnosis and treatment of a wide range of serious and life-threatening illnesses – including cancer, heart diseases, diabetes, arthritis and forms of dementia". It aims to recruit 500,000 participants, and will collect data on a wide range biological variables (including taking samples for genetic analysis) and lifestyle factors.
Sounds like a worthy project.
However, I have some serious concerns, and I won't be participating. My first thought when I received the letter was "how the hell did they get my name and address?" Apparently they got it from the NHS, who obligingly sent them my date of birth as well. This is, so they claim, all done in accordance with the Data Protection Act.
I have my doubts about that, but if there is really a loophole in the Data Protection Act that somehow allows the NHS to pass on my personal details to third parties, then shame on the UK Biobank team for exploiting it. I allow the NHS access to some of my personal data in the expectation that they will treat it in the strictest confidence, and I am deeply shocked that they have not done so. I don't care how worthy a research project this is, I am now going to find it hard to trust them.
And if I were going to participate in the research, I would certainly need to trust them. They would hold a great deal of extremely sensitive data about me. As others have pointed out, there are some serious risks involved in that, both arising from the risk of a breach of internal data security in what is a very large project (ie with more opportunities for leaky data) and from the possibility that the government (which, as we all know, has a rather unhealthy desire to know about its citizens' DNA) will be able to access the data if it decides that it wants to.
The tone of the invitation letter was, IMHO, also very inappropriate. They have already made an appointment for me. Although they make it clear that I don't have to go to the appointment, the fact they made it in the first place is extremely presumptuous. If this had come before the research ethics committee of which I am a member, I expect we would have deemed that to be inappropriately coercive and would not have allowed it.
I also find it rather shocking that the ethics committee that approved the project thought it OK for the NHS to release personal data to a third party.
What was the ethics committee thinking?
Update 11:19 am:
And as if all that weren't bad enough, I've noticed something else deeply worrying on the UK Biobank website. They say on their "Confidentiality" page that data will be stored anonymously.
That is not true.
In my ethics committee, we are always extremely strict about ensuring that researchers distinguish between anonymised data (in which it is impossible to link data to an identifiable individual) and pseudonymised data (in which the data are stored separately from identifiable information, but the link is still maintained and so the data can be attributed to an identifiable invididual by anyone who has access to the linking codes). The UK Biobank data will be pseudonymised, not anonymised, and for such as well-resourced study to misuse such ethically important terms, and be allowed to get away with it by their ethics committee, is staggering.
Update 20 July 2010: