UK Biobank is in receipt of public funds, and so the government should help it to ensure that failings are addressed as a matter of urgency. This incident underlines that contractual arrangements to protect citizens’ data must also be accompanied by robust technical protections. (Conclusion, Paragraph 47)