I haven't been paying attention to it but wasn't there some kerfuffle over some people threatening to leak it over not being allowed to publish controversial findings?
UK Biobank health data keeps ending up on GitHub
41–50 of 61 posts
Re: UK Biobank health data keeps ending up on GitHub
#42Re: UK Biobank health data keeps ending up on GitHub
#43I've opted in to Australia's version of the biobank knowing that it's inevitable that it will be leaked some day, I think the data is so valuable in perpetuity that it's worth it. I remember Ben Goldacre has been working on how to make data more accessible in a safer way to (in part) avoid this very thing, but I haven't heard much of it since [0] [0] https://www.bennett.ox.ac.uk/blog/2025/02/opensafely-in-brie...
I have huge problems with Goldacre's project because that project has never been disclosed to the general public let alone some form of opt-in/opt-out.
Re: UK Biobank health data keeps ending up on GitHub
#44Took me 5 minutes to find more: https://github.com/tanaylab/Mendelson_et_al_2023/blob/9c5a65... (Uses Date of Birth column). And some information on how they were distributing it to researchers: https://github.com/broadinstitute/ml4h/blob/master/ingest/uk... > The following steps require the ukbunpack and ukbconv utilities from the UK Biobank website. The file decrypt_all.sh will run through the following steps on on…
I don't think either of those links contain actual PII (or anonymised PII).
(The first is a GitHub repo for https://www.weizmann.ac.il/math/tanay/home )
Re: UK Biobank health data keeps ending up on GitHub
#45> It has given 20,000 researchers around the world access under strict agreements that prohibit sharing data further. To me it seems rather naive to have done that. After all, you can't un-leak medical data. So even if the "strict agreement" included huge punishments, there's no getting the toothpaste back in the tube. If you want to ensure compliance before a leak happens you have to (ugh) audit their compliance. An…
Not giving the data to researchers means not getting the scientific benefits from that data. Which was the point of collecting that data in the first place. Reckless harm prevention is the root of many evils.
That’s a false dichotomy.
Sensitive research systems thread that needle by giving remote access to researchers with the data in the control and supervision of the responsible organization. Strong internal data access controls and data siloing alongside strict verified extraction routines. Specifically: limited project-dedicated DB access, full logging of data interactions, and full lockouts/freezes if something feels off.
‘The five safes’ is a good presentation from the NHS(?) a decade ago covering the approaches.
Data publishing restrictions around health data aren’t reckless. Modern computing and digital permanence mean we have to be extra cautious.
Re: UK Biobank health data keeps ending up on GitHub
#46> It has given 20,000 researchers around the world access under strict agreements that prohibit sharing data further. To me it seems rather naive to have done that. After all, you can't un-leak medical data. So even if the "strict agreement" included huge punishments, there's no getting the toothpaste back in the tube. If you want to ensure compliance before a leak happens you have to (ugh) audit their compliance. An…
Not giving the data to researchers means not getting the scientific benefits from that data. Which was the point of collecting that data in the first place. Reckless harm prevention is the root of many evils.
It's not a zero-sum game, you can both protect people and reap the benefits of health data. Many countries have much safer approaches. UK Biobank typically leads with the scale of the data, but not with its infrastructure.
Re: UK Biobank health data keeps ending up on GitHub
#47the issue is with jupyter notebooks because they keep some of the data in the output (typically a few rows, but still). They should strongly recommend to use regular python scripts, and keep the jupyter books just for verification, which is a very sane thing to do also from a SW engineering perspective.
marimo notebooks give you the best of both worlds (https://marimo.io)
Re: UK Biobank health data keeps ending up on GitHub
#48That's the least of it: https://www.bbc.co.uk/news/articles/cpvxgl3n138o All 500,000 participants for sale on Alibaba... And official response: https://www.ukbiobank.ac.uk/news/a-message-to-our-participan...
BioBank claims (1) only de-identified data was available and (2) none of the data was actually sold before the datasets were taken down.
Re: UK Biobank health data keeps ending up on GitHub
#49Earlier quoted context omitted.
Not giving the data to researchers means not getting the scientific benefits from that data. Which was the point of collecting that data in the first place. Reckless harm prevention is the root of many evils.
That’s a false dichotomy. Sensitive research systems thread that needle by giving remote access to researchers with the data in the control and supervision of the responsible organization. Strong internal data access controls and data siloing alongside strict verified extraction routines. Specifically: limited project-dedicated DB access, full logging of data interactions, and full lockouts/freezes if something feels…
We have dozens of data / db startups - kinda odd that there isnt one (I have seen) that focuses on this problem.
Perhaps our future ai overlords will feel its important to compartmentalise, and log data access more agressively.
Re: UK Biobank health data keeps ending up on GitHub
#50Earlier quoted context omitted.
Not giving the data to researchers means not getting the scientific benefits from that data. Which was the point of collecting that data in the first place. Reckless harm prevention is the root of many evils.
That’s a false dichotomy. Sensitive research systems thread that needle by giving remote access to researchers with the data in the control and supervision of the responsible organization. Strong internal data access controls and data siloing alongside strict verified extraction routines. Specifically: limited project-dedicated DB access, full logging of data interactions, and full lockouts/freezes if something feels…
No, this is a real tradeoff.
Any friction you add to "access the data" process makes it harder for legitimate researchers to get access to, and get benefits from that data.
So, at what point do stricter data controls begin to choke you at the throat?