> In fairness, is this any worse than what Palantir will do with the whole countries NHS records?

I don’t get this trend of seeing bad thing happen and then commenting that other bad thing exists and therefore “in fairness” we should downplay it.

Bad things are bad. Comparing them to other things we don’t like doesn’t make them less bad. I don’t like Palantir either but they’re not intentionally leaking health details so this comparison doesn’t even make any sense.

Is allowing random malicious actors to buy health data worse than allowing NHS's own employees to interact with that data productively?

yes

Palantir develops database software.

Both are bad

“In fairness, this pot of water was already uncomfortably hot before [latest development] raised the temperature another few degrees closer to boiling.”

…says a happy frog who will be as cooked as everyone else.

Well, one is a thing that has happened, and one is a thing that hasn't happened.

> There isn't much difference between giving this data to 20,000 researchers all over the world and simply publishing the data on the web.

As a researcher who regularly deals with such data there is a MASSIVE difference. Yes, I have access to the data but I am restricted on how it can be stored (no cloud), what I can and can't do with it, and for some of it I'm even mandated to destroy it once the research project is over. I have the informed consent of every participant, some of which withdrew halfway throughout the collection without any penalty to them. I also don't need a new law because I'm already bound by existing ones, by the contract I signed when I joined, and by the confidentiality agreement I signed when the project started. While I don't know that the leaker(s) will be identified, the existence of the data itself already calls for legal action while giving a starting point for investigation.

Your suggestion, on the other hand, seems to be "let's put this data out there without people's consent and make companies pinky promise that they won't use it in their black boxes in a way that's virtually impossible to detect or prosecute". Those two things are definitely not equivalent.

> together with a law that says using the data to make personalized decisions affecting those individuals is punishable with life in prison.

This works well in theory but is basically unenforceable. It's barely possible, if possible at all, to audit how FB or google make ad targeting decisions - but once stuff gets into the fragmented ecosystem of data brokers and market intelligence consultancies all hope is lost.

To say nothing of state actors, like countries who might deny you a visa based on adverse medical info or otherwise use your information against you.

I can't wait for this to be used for assassination by peanut.

The web is global, UK law certainly isn't.

Which would be fine if that's what the people who gave their data over agreed to.

“We didn’t make a decision based on that.” Done and dusted?

well you just articulated the difference

licensing it to researchers allows you to create, monitor, and enforce policies like the one you describe

stealing it does not

Extremely related - my red string on the wall points to this being the source of the data leak rather the latest heist by Oceans Crew.

Given the whack-a-mole takedowns, its pretty clear everyone involved knew what was going on.

In the same way as the "UK Biobank" software accesses it.

Buy a desktop sequencer?

https://nanoporetech.com/products/sequence/minion

Similar to https://xcancel.com/SethSHowes ~10k budget based on minION sequencer. (Edit : his dedicated project page https://iwantosequencemygenomeathome.com/ )

But once your data has been digitized even if it is under your control the likelihood that it gets leaked is still high. Specially now with AI agents running everywhere, or people just asking AI services for medical advice.

Today the choice for advice is between low quality local AI advice or higher quality advice but lose your data control, the rational choice is probably losing your data control even if if will almost certainly comes back to bite you.

https://sequencing.com/our-difference/privacy-forever seems the best choice these days.

But it's nonconsensual, contrary to the laws and contract.

Should or shouldn't in general, but THIS one database shouldn't.

Yeah, as long as all 500,000 people in the data set agreed for it to be public then thats fine. But how do we verify that?

When i signed up as a volunteer they assured me it was not going to be public, only veted researchers allowed to access it.

The US has over 70 million on Medicare, why would they care about 500K brits?

I thought we pay them to have it via Palantir contracts or something?