Ethics of Health Data Infrastructures: Toward Continuous Governance and Public Trust.

Abstract

In April 2026, reports of deidentified UK Biobank participant data being listed on overseas commercial online platforms highlighted concrete vulnerabilities in health data governance. In this viewpoint, we use the incident as an illustrative case to argue that traditional, trust-based, preaccess review models have ethical and operational limitations. The core concern is not data sharing, commercial involvement, or international collaboration per se, but unauthorized downstream movement of participant-contributed data beyond approved research governance into external commercial digital environments. We advance 3 key messages. First, governance should extend beyond initial access approval to continuous, proportionate stewardship across the data life cycle. Second, technical safeguards, including trusted research environments and audit logging, must be linked to institutional accountability for downstream data use. Third, public trust and social license require transparent communication, public-facing accountability, and governance mechanisms that remain responsive after access has been granted. As initiatives such as the European Health Data Space develop, legal alignment should be accompanied by operational accountability for downstream use. Continuous governance should complement, rather than replace, existing access review and research governance by maintaining proportionate oversight and accountability after access has been granted. This approach requires attention not only to technical safeguards but also to institutional responsibilities, implementation feasibility, and transparent communication with participants and publics. Health data infrastructures can sustain scientific value and public trust only when responsible data sharing is coupled with continuous, practical, and publicly accountable stewardship.