The Adolescent Health Study will ask teenagers about their mental health, their families and their sexual experiences, and link the answers to their school, health and tax records. It will make them promises. The people building it have already broken promises of exactly this kind – to Scottish schoolchildren, to Biobank volunteers, and to 55 million NHS patients – and consequences have never reached the shared culture behind all three projects. The children being asked about adolescence in 2027 are the ones the ONS will ask to fill in a census in 2031 and surveys for the rest of the century.

“A bit like UK Biobank” has long been the description, and “like UK Biobank, will be accessible to all bona fide researchers”, a promise that turned into a trainwreck after the HDRUK/Sudlow review and UK Biobank lobbied to repeal promises already made to patients. The other precedent from the same people is the “Scottish School Sex Survey” which tried to get away with ignoring promises to school children, using intrusive emergency capabilities to address an endemic issue.

The same people. The person now leading AHS came to it from UK Biobank via HDRUK, where she co-authored the preprint on a project that trained an AI on 55 million patients’ records shared for Covid purposes only. HDRUK told the Information Commissioner it made no decisions about that access. Its own preprint says otherwise. The signs are that AHS decisions will be a gamble, with all bets placed by those with a track record of not caring about the outcome, of doing whatever they want with the data, irrespective of promises made to the individuals who contributed their data (either voluntarily or otherwise) and with a track record of telling regulators who make inquiries whatever is convenient at the time assuming no one will check (and that’s why this piece is so long). 

As stated in the Goldacre Review, “The NHS must maintain trust and active enthusiasm from patients and the public”, and that applies to other studies too. There will be a promise that “Five Safes” will safeguard data – they can not protect against data owners’ deliberate actions. (but that’ll be a topic for a followup post to avoid this being even longer!)

Breaking the trust of children, teenagers (and everyone else)

A project that offers individuals a choice and then uses their data anyway poisons trust in every future research or administrative data project. One folly of the previous National Statistician was to throw his full weight behind using administrative data however he wished, on the basis that no one could say no — only to find he needed reliable answers that could be got only by asking people directly. That fundamental flaw runs throughout the HDRUK/Sudlow Review, and underpins the Adolescent Health Study designed by the same leadership who learnt nothing from the failures we cover below.

If teenagers and their families choose to join the Adolescent Health Study, they should be fully informed, and not deceived – consensual, safe, and transparent. The current AHS leadership has a track record of failing those tests, having come from UK Biobank via a scandal at HDRUK that they’ve recently chosen to write about. 

Without a full reset and new leadership, the AHS has no pathway to becoming seen as trustworthy. And when it comes to making promises to children about what it will collect and what it will do with it, being trustworthy is an absolute must. Leadership has deliberately broken promises like these before for temporary gain. (Andrew Morris giving notice of his resignation from HDRUK suggests all could change direction in 2027, but that will need a leadership clearout).

We note the AHS is going to change its name soon (and when the new name is public we’ll come back to this post and edit that in here).

AHS leadership has a track record of refusing to learn from recent scandals

Mistakes happen, but they must be learned from. Refusing to learn, and denying that it could happen again, is an active choice, and a choice participants should be aware of when those same people make the same mistakes again.

The Medical Research Council says they started in 2016 the process that led to the AHS, and then started the process for what is now the AHS in 2022, and it’ll finish the currently funded work in 2038. There are good reasons for a 16-year timeline, and it’ll be a research resource for the next 90 years (because presumably they’ll go back in future for more waves). But none of those things are remotely compatible with the timescales of addressing an epidemic, pandemic, or any form of emergency. There are good reasons to address health challenges, but they are different things, and promising to tear up all safeguards upon the next moral panic means people shouldn’t go near the AHS or any project by any of this cartel.

The same process that started the AHS also assisted with the Our Future Health data broker project, and the OFH Trustpilot reviews give some indication: 1.5 stars out of 5, rated “bad”. But OFH has now got enough data to care much less about what the cohort thinks (until they go back to get school records, employment records, or anything else they figure out a way to get their hands on). Business models of data brokers always degrade to just selling the data.

Speaking at the launch of the HDRUK/Sudlow Review, the Review author said her goal was applicants to get UK Biobank data in “days” and proclaimed that Biobank had  “one of the best systems” for giving data out rapidly. That was after it was public that UK Biobank had given data to eugenicists and shell companies, but before it turned out there were many copies leaked online and the “safe” analysis environment had a function to download all the data. The same approach will be applied by the same people to the Adolescent Health Study.

UK Biobank continues to insist “we follow the Five Safes framework” as they did when they had a download function for arbitrary data. They also encouraged their allies to claim that data downloads would cost the user “£1.5m” – clearly it didn’t as the data had already been downloaded without notice. The actual tabular data is ~20GB of data, which would cost a couple of pounds to download. Biobank claim “similar restrictions on download and data movement have also been applied by other data controllers”.

Even today, UK Biobank still says only that: “Safe settings: research is conducted on our platform” (but not all research?) and “Safe outputs: we review researchers’ publications” (but they can remove anything they like – including at the time of suspension – the full dataset). 

Biobank’s cheerleaders claim the Biobank scandal shouldn’t matter because of all the good work done by the UKRI funded longitudinal studies (of which AHS will become another). Those studies have led to world-improving discoveries, usually led by a team who are committed to the long-term confidence of the entire cohort. But leadership matters. It was Biobank’s leadership that made the decisions that led to this mess – and those former leaders now have new jobs.

Most UKRI cohort studies expect to go back to their cohort in future. UK Biobank promised it would not, and “a bit like UK Biobank”, AHS expects not to. HDRUK and UK Biobank share a culture, and that has spread via staffing choices to the AHS as well. In that culture, you can be dishonest without consequence.

Biobank tells its participants “no identifiable information about participants would be available to anyone outside of UK Biobank” … “All such information would be held in strict confidence” … “Participation involves a minimal risk in relation to the use of personal information. Great care will be taken to ensure the confidentiality of all data (see below) and the risk to participants of a breach of confidentiality is considered very low.” “Details that might identify you will be removed from any information and samples provided to researchers in order that they cannot be traced back to you.” 

Biobank didn’t keep those promises. They’re not unique.

The Scottish Schools Sex Survey

The Scottish government’s Health and Wellbeing Census asked more than 130,000 Scottish schoolchildren highly personal questions about their life, school, family, bullying, happiness, and sexual experiences. All important topics, but must be treated carefully, and promises about how the answers will be used must be kept.

Half of Scotland’s 32 councils pulled out following concerns about a lack of informed consent and worries over the pupils’ anonymity. For those who remained, “pupils answered the questions online in classrooms and were told on the survey form itself that the information would not be shared”.

The pupil information had “a section called “What Happens to My Answers?” saying “The local authority will not tell anyone your answers, not your teacher or your family”, yet “data from a controversial survey which asked school pupils as young as 14 about their sexual experiences has been advertised for use by external researchers, without the explicit consent of children or parents”. (BBC).

The Scottish government did have a section on a different website which said that “individual level data may be shared for research purposes”, and that line was used to justify whatever researchers wanted even when it contradicted what the teenagers were directly told. “However, the data is now being offered publicly to external researchers via the website of Research Data Scotland, a charity created by the Scottish government in 2021 with a stated aim of making it easier to access data around health and wellbeing.” 

After an inevitable outcry, “The Scottish government and researchers have deleted data from a controversial census which asked school pupils as young as 14 about their sexual experiences.” (BBC)

Before the data was deleted, Research Data Scotland insisted that the sex data should be shared despite what was said when it was collected. Research Data Scotland is “advised” by “Administrative Data Research UK” and by the CEO of HDRUK, where the current AHS lead was previously Chief Scientist and Deputy Director, after leaving her post at UK Biobank.

UK Biobank also has a sexual factors questionnaire for its respondents, and the ineptitude leaked all of that data too. The only thing more disturbing than being dishonest about reuse when asking children about their sexual habits may be losing control of the answers from male members of the House of Lords.

Promises have to be kept, especially when (flimsy) emergency is claimed

In her prepared remarks opening her evidence to a Parliamentary Committee, the AHS lead Professor Sudlow: (emphasis added) “through emergency legislation, there were improvements in access to linked data for crucial Covid-related analyses during the pandemic, with both legislative and regulatory changes that improved access. However, several of those have been withdrawn, despite clear demonstrations of benefit and the potential for similar data access mechanisms to similar datasets to actually provide benefits of equal, and indeed much greater, magnitude, to prevent, diagnose and treat many other conditions that one might also regard as global pandemics or UK-wide epidemics or pandemics—for example, heart disease, stroke, cancer, diabetes, arthritis, dementia, mental health conditions and more.”

Each of those topics may be a major health condition, and they are all worthy of more research, but to say they are “global pandemics or UK-wide epidemics” is a loss of perspective – none of those are actual emergencies on the scale of Covid. In April 2020 you could have asked any schoolchild why things were different and got an age-appropriate answer – including why they were doing things differently to help. Try asking a follow-up about obesity and see what happens – probably reaching for a cookie. (if it’s the emergencies claimed, then AHS should be asking some of those children exactly those questions).

There are many reasons to do a 12–16 year study of adolescent mental health – it’s a really good idea, and a really good use of public funds (like other UKRI longitudinal studies). Good TREs work when not actively undermined for short–term gain.

 
To argue that an epidemic of mental health problems justifies tearing up every data privacy question is fundamentally incompatible with the timescale of this study, and with the promises made to its participants. The AHS will recruit participants for over a decade, and will follow them up for life – that’s not an epidemic response, but an endemic response. Entirely worth measuring, if you had told that same child in April 2020 that they must take the same measures every winter for other conditions named, you would have lost all sense of perspective. (as HDRUK, UK Biobank, and AHS’s overlapping leadership have). 

Some high-profile advocates for UK Biobank argue that re-identification and disclosure don’t matter. Individuals are free to make that choice, but for it to be the institutional position, those who signed up should be clearly and explicitly told exactly that in advance. If they genuinely believed the epidemic argument, and genuinely accepted the risks, they’d make the case up front. It never is because respondents don’t agree. 

Instead, rules are broken in dark corners. 

The HDRUK Foresight project has published a preprint (saying how they ignored pandemic data rules)

In 2025 NHS England trumpeted a project which trained a “general AI” on 55 million patients’ data, that had been shared for Covid purposes only. The project erupted in scandal in much the same way as the Scottish school sex survey and UK Biobank before it. The page now says “This research project is currently paused”, and pages were quickly edited to insist the AI remained “Covid only”, a constraint that was barely mentioned in the original press briefing and coverage.

A year later in the August 2026 lull (while they hoped no one was watching?) the AHS lead and other HDRUK researchers, current and former, published an academically formatted preprint (our copy) about the project. A preprint can be little more than a blog post in PDF form, but all of the details show just how little oversight there was and is. That institutional failure explains why the 2025 press release barely mentioned Covid until the outcry – Covid was and remains a fig leaf for researchers doing whatever they wanted under the guise of a national emergency.

Most authors on the preprint name between 3 and 7 affiliations, often overlapping roles at the same institutions, yet some people omit the institutional auspices and affiliations under which their project decisions were made: HDRUK (affiliation numbered 7) and the HDRUK sockpuppet brand of the “Data Science Centre” (numbered 6) which are available only if you know what their second section (unusual!) in the “Contributor Statement” referred to.

Fisking the preprint paragraph by paragraph isn’t a good use of anyone’s time, but here are just some highlights.

Unsafe data – promises getting ripped up

During the Covid pandemic, there was a GP dataset in England which was collected under a “Covid only” promise. It was a novel pandemic and GP data was presumably useful, so it was collected.

In 2026 the promise was formally torn up. A new Direction authorised reuse of the data, after years of lobbying by UK Biobank and others, and the current AHS leadership and their friends gloated about it via the Science Media Centre.

SMC pages carry a declaration of interests statement at the end. Prof Sudlow’s is missing: the SMC states “For all other experts, no reply to our request for [Declarations Of Interests] was received”.

The Science Media Centre explains science and research to the media and the public – they’ll have a lot of work to do given the flaws in AHS structures, but SMC will happily manufacture support if researchers say it’s good for their research.

Everyone remembers who they went to school with – the special unique characteristics of each person from school are imprinted in your memory, and glows in the data no matter your age. All this data is deeply identifiable for life.

The AHS leadership has the experience of UK Biobank, then HDRUK, then foresight to understand re-identifiability and disclosure. Indeed, figure 3 of the preprint is a diagram which shows disclosure risk and identifiability of the data within, despite the claims HDRUK and others make entirely otherwise. All a person’s data is linked together, and if any one piece of it allows identification of a person via one special unique, then the link allows their entire history to be known:

The AHS will make promises to the children and parents they recruit – why should they be believed this time?

Unsafe data – discrepancies over which data was accessed

The point of “safe data” in “safe settings” is that you should be able to know exactly which users have accessed which data. The data is inherently unsafe (if it were safe, none of the other protections would be necessary), but the argument goes that the protections around it can make data use safe.

NHS England’s 2025 case study lists amongst its aims, “Ensuring inclusivity in predictive analytics by using data that represents the entire population”, which requires data on ethnicity to ensure it does match the entire population. 

The NHS ethnicity data before the pandemic was terrible (it mostly still is). To try to improve matters, NHS England put together the “Covid-19 ethnic category dataset”, which uses the best available estimate of a person’s ethnicity from across the NHS. The best way to find out is, of course, to just ask the patient.

HDRUK will have had a copy of the Covid ethnicity dataset, but the dataset is missing from the list of datasets the preprint states was used. We know from past investigations of the HDRUK “Data Science Centre” during the pandemic that they had no internal guardrails, so any data available to them in the safe environment was accessible to all projects, meaning whether they used it or not is impossible to know (NHS England could investigate). Due to the recklessness of HDRUK, no one knows what happened vs what is claimed. This is what safe settings for data are designed to avoid, and what cheaters try to exploit.

The preprint makes much of ethnicity, and about being representative of the population, but there seems to be a major discrepancy. It has not been peer reviewed; a reviewer with domain knowledge would likely have queried this.

What the preprint does show is that, for all its discussion of the importance of diversity and ethnicity, they make no mention of using the higher-quality category data. This discrepancy does nothing to inspire confidence in anything the authors did – either they cut corners for ease, or they didn’t disclose what they did. What else was left off the list?

Unsafe data – the failing that led to the resignation of the National Statistician

When the previous National Statistician “was allowed to act ‘without check or balance’” – using data he held however he wanted – confidence in the economic statistics collapsed and he resigned under scrutiny from Parliament.

What we deemed “Diamond’s data trading company”, decisions were made on the assumption that data held by government could be used however researchers wanted, and that underpinned the commissioning of the HDR/Sudlow Review. That culture continued when former health Secretary decided he could do whatever he chose with GP data now that he’s got the recipe data. This institutional ‘flexibility’ will now apply to all future data unless terminated through legislation. UK Biobank is trying to spend its way out of a failure of trustworthiness. It will not work. To be trustworthy you have to have a culture of integrity and honesty, which UK Biobank, HDRUK and now AHS, all do not.

Abusing the data of schoolchildren, or volunteers, or NHS patients appears to be an activity that attracts no sanction; crashing the economic statistics, apparently, was.

It remains to be seen whether breaking the decennial census, which underpins many of those economic statistics, will have any consequences.

Every decade the National Statistician makes promises to the public when it asks them to fill in a census form – and the ONS culture has, until now, always taken those promises very seriously. Should the public expect those promises to be kept in 2031? Should teenagers expect the same when filling in a ‘school census’? The AHS promises made to teenagers in 2027 will be remembered when they fill in their 2031 forms. What will children already have experienced when schools teach the census in 2031?

Breach of such credibility and trust will reverberate for decades, as the Truss mini-budget will in Treasury. 

Unsafe people – institutional astroturf and cronyism

The HDRUK/Sudlow Review recommended (page 123) that researchers should be able to do whatever they want with data from across government, and we expect that the AHS will request consent from respondents to do that in perpetuity. They can do this properly. Whether they will is a different matter for later, and whether the respondents will give permission for it when given full information is an entirely different matter.

On who should be listened to, the HDRUK/Sudlow Review (pg 163) recommended more HDRUK sockpuppets – other staff of the same legal entity who wear different badges. There was so little external input that no one noticed they were advocating only hearing from themselves – those that “would be well positioned to lead on SDE standards” are only “HDRUK [legal entity: HDRUK], ADR UK (partner with HDRUK but legally part of UKRI who fund HDRUK), the UK Health Data Research Alliance [legal entity: HDRUK], and UKRI’s Data and Analytics Research Environments UK (DARE UK) programme [legal entity: HDRUK]” and no one else. Most of the other groups the Review praises – PEDRI [legal entity: HDRUK], DAREUK [legal entity: HDRUK], etc., are again simply HDRUK leadership and hierarchy masquerading under another logo. The one line management exception (UseMyData) has staff funded by HDRUK and other staff paid by NHS England to do engagement work – entirely legitimate but difficult to be consider independent from HDRUK’s interests.

The UK Biobank leadership believes “more is more” and are incapable of objective assessment of people, settings, projects, data or outputs. Their definition of “safe” was whether the applicant had paid the fees. It appears what they wrote on the forms was never checked.

Unsafe people – an identifiable and catastrophic leadership failure 

Everyone wants researchers to go to the cutting edge of what is permitted and possible – that’s what good research is and what good researchers do. But research leadership has to know where the cutting edge stops and a breach of patient trust begins – and to recognise when something has gone from ambitious to unlawful or disturbingly creepy.

Having expert patients tell you their experience is vital for researchers to understand the context in which they work, but patients must trust that, even though every researcher in the room could find their full medical history in the data, they wouldn’t go looking (but it happens for direct care). That confidence comes from leadership and research culture, and senior staff of HDRUK or UK Biobank (and now AHS) do not engender that confidence.

Given the word “Cambridge” appears 14 times on page 1, and ‘ethics in academic writing’ is a topic of high general interest locally, it is clear that the researchers were entirely free to write whatever they chose. The secure data environment does not restrict what they publish, but when researchers and their institutions agreed to follow rules on processing personal data of 60 million people, they should not have been surprised when those rules were enforced by NHS England. HDRUK/DSC leadership seems to have cultivated ignorance, possibly having assumed that rules would not be applied to them (again). It’s unclear why a year later they’d co-author a preprint admitting breaking them.

Unsafe projects – what HDRUK told the Information Commissioner isn’t what it did

When medConfidential briefed the ICO and NHS England after they were already investigating a BMA complaint, HDRUK’s defence was that they were not a data controller, that they made no decisions, and everything was decided by NHS England. On that basis the ICO found that HDRUK was not acting as a data controller and NHS England was the data controller (and so the complaint basis fell away).

In the preprint, HDRUK writes “Those wishing to gain access to the data should contact bhfdsc@hdruk.ac.uk in the first instance” showing HDRUK was acting as a data controller and gatekeeper wanting access for whoever they chose (it was not an objective process).  There was no way to check until HDRUK wrote a preprint claiming the opposite.

Unsafe projects – decided by HDRUK, not NHS England

The preprint restates HDRUK’s cultural insistence and expectation that HDRUK will choose how patient data should be used, not use NHS processes. The approval process was internal, overseen by Prof Sudlow according to the preprint.

The preprint claims “CS … coordinated approvals for and access to data within the secure environment” – when in practice she was the one who approved it and there was no coordination or external approvals. Access was granted to all data that the HDRUK/DSC had for any Covid uses – there were no internal boundaries on what data was available. Someone had to pretend the internal and unchecked governance was real – every shortcut that could be taken, was.

Unsafe projects – Foresight never went for independent advice

HDRUK has never explained why they never went for independent advice. In early 2026 it seemed they’d dropped the project after the ICO findings were that they hadn’t followed NHS England’s rules (HDRUK firmly insisted in meetings that it was a covid project, NHS England accepted that HDRUK firmly insisted it was a covid project, and so the ICO accepted that NHS England had accepted that HDRUK had firmly insisted it was a covid project – after the project was paused at least). If it was fine, having the normal process confirm that should have been a formality – it never happened. 

HDRUK insisted to NHS England and in the ICO investigation that all their self-approved projects had gone through a proper approval process which the preprint says was led by Prof Sudlow, and HDRUK insisted that NHSE did not need to intervene.

The minutes of NHS England’s Advisory Group for Data for other projects show otherwise. 

After the scandal erupted, HDRUK’s pending self-approved projects went through the normal NHS processes. Most needed improvements after their initial case was insufficient to meet even the Covid-emergency low standard. Having had the time to rewrite their application to meet the standard that HDRUK insisted they had already met, the independent Advisory Group for Data wisely added a note of caution:

“However AGD suggested that any future amendments to any of the eight projects utilising this data, were carefully reviewed by NHS England to ensure that they remained fully aligned with the parameters of the COVID-19 Public Health Directions 2020” and “Noting AGD was only asked to advise on specific points reviewed”

AGD then noted “regarding all of the projects discussed, that any eventual published

outputs would need to flow from COVID-19 purposes.” … “The Group advised that the Data Controller should assure themselves that any creation of data models is transparent within the project specific applications” because AGD clearly wasn’t assured of that.

It is notable that HDRUK chose not to put the foresight project through the AGD process. Why? HDRUK has published the preprint complaining publicly that they have no access to the data or their work, but they never went to AGD to request that access.

We don’t know what AGD would have said, which is precisely why the application should have been made. The process would have given HDRUK the opportunity to disclose what they were doing, answer questions, and resolve what HDRUK claimed was simply a misunderstanding. 

If the project is as important as the press release and promotion claimed, why not seek approvals to carry on as the press release described? Or was it just PR spin that fell apart as soon as HDRUK’s cheating became evident?

The preprint shows AGD was right to treat HDRUK’s promises with scepticism, and any promises from the AHS should be treated with equivalent scepticism. 

Unsafe projects with unsafe outputs

The preprint confirms the project didn’t have “approvals for” testing the claims made in the press release as it ends with: 

“Realising this potential will require not only technical advances but also transparent governance, sustained public and professional engagement, and rigorous evaluation in real-world clinical settings to generate evidence for regulatory approval.”

None of the promise in the preprint is possible or demonstrated today – it’s all future hypothetical with promises of jam tomorrow not delivered findings, the same concern AGD recorded against every other project in the minutes.

Reading the press release raised fundamental questions about how the promises to patients and data agreements had been explicitly ignored by HDRUK. Data access was then suspended. The preprint suggests this suspension was the entirely correct decision, even if HDRUK opacity meant their own reasons didn’t become known until they chose to publish them. Without this choice, the public would still be in the dark over what HDRUK did with their covid-only permissions.

Unsafe outputs – the preprint says no results have been seen by anyone else

If the outputs had been seen by anyone else, they should have been output checked, but the preprint confirms they were not. 

Neither the SMC briefing summary nor roundup mentioned it was Covid-19 only (that vital caveat was hastily noted after the scandal erupted). Nor do they mention a new very novel claim that appears in the preprint that should have been disclosed at the time, and wasn’t.

In May 2025, the coordinated press release said: “Foresight is being trained on routinely collected, de-identified NHS data, like hospital admissions and rates of Covid-19 vaccination, to predict potential health outcomes for patient groups across England. This could be events such as hospitalisation, heart attacks or a new diagnosis. Predicting these events early could enable targeted intervention, shifting towards more preventative healthcare at scale” … “The researchers believe the model’s predictive power could pinpoint high-risk patient groups, opening up a window of opportunity to intervene to improve and save lives. Due to the diversity and completeness of the training data, the model could also help to highlight and address healthcare inequalities. And the ability to analyse healthcare risks and outcomes on a population level could offer critical support to the NHS when it comes to planning”.

What’s the basis for the organisations giving support in the press release? They appear not to have seen any outputs because here’s what the preprint says in section 2:

“At the point at which data access was paused, the researchers had trained several iterations of the Foresight-E model (including on the full training dataset), generated multiple sets of predictions for direct and indirect COVID-19 outcomes in the test set, and run initial quantitative evaluations on these predictions, producing aggregated performance metrics, as detailed in this manuscript. However these aggregate predictions had not yet been requested for export from the NHS England Secure Data Environment (SDE) via the approved Safe Output Service, subject to statistical disclosure control and review.”

We would take at face value the statement from all co-authors that they hadn’t ‘exported or disclosure-checked anything – ie they hadn’t got any results they could share for anyone to stand behind – except the official case study still says variously: “Foresight demonstrates significant potential benefits for healthcare delivery:” … “Supporting better planning and resource allocation through analysis of data from diverse demographics, locations, and medical conditions, helping clinicians and policymakers anticipate health risks and plan interventions” … “Ensuring inclusivity in predictive analytics by using data that represents the entire population” … and repeats the line from the press release “Foresight exemplifies how data-driven healthcare can predict and manage health risks proactively, supporting strategic healthcare shifts.”

If it “demonstrates” or “exemplifies” “inclusivity”, someone must have done that assessment, or simply made it up. If the researchers did the work and had it looked at by literally anyone else, it would have been output checked in order to be seen by others, but they deny any outputs were available and anything had gone through output checking. Or did the output checking requirement get ignored in a mirror of UK Biobank policy?

Ignoring requirements mirrors the outcome that neither the SMC briefing summary nor roundup mentioned the project was supposed to be for Covid-19 only (that vital caveat was hastily noted after the scandal erupted).

The preprint confirms that HDRUK’s press release was driven by hype and promise not validated delivery. “Ensuring inclusivity” was an unchecked promise, and the model helped zero clinicians or policymakers, or even researchers, because zero outputs were ever validated or seen by anyone outside the two(?) lead researchers working in the secure data environment.

The researchers claim they had a wonder model, but didn’t ever ask to show anyone any results before issuing a press release? And no one asked them for the results?

Like many things with HDRUK, UK Biobank, and now AHS, the facts of the press release and the preprint do not pass a smell test. However, the preprint repeats HDRUK calls to go even further.

Unsafe outputs – the preprint repeats HDRUK’s calls to treat patients recklessly

The preprint calls for a method of “real-time model deployment” – for a model that the preprint states can not have been assessed by anyone outside the two people who built it. The preprint argues for regulatory approval for a model their supervisor isn’t allowed to check – in 2025 the press release could blame ignorance and excitement, the 2026 preprint can’t, and reflects the HDRUK institutional culture.

HDRUK’s belief is that their researchers will suddenly start coming up with ideas so novel and so ground breaking that they must be able to interfere directly with treatments being given to patients across the NHS, without any burdens like regulatory oversight or even telling the doctors/hospitals. (HDRUK insist that it must be safe because they’ll be doing it).

Some researchers dream that they’ll write the analysis code and find a cure for cancer, they’ll knock out a preprint, and the Nobel committee will wake them up the next morning instead of their alarm. HDRUK leadership expects they’ll get the call, not the researchers who did the work.

The Adolescent Health Study design will encourage “Realtime feedback to schools and young people” (and undermine the quality of the data in the study).

Unsafe settings – culture vs leadership vs money

HDRUK’s leadership threw a tantrum when their Foresight access was paused by NHS England, and so applied to NHS England to move their processing of personal data to a smaller environment which it appears HDRUK believe they can bribe/bully into allowing whatever HDRUK wants. The Welsh Safe Setting has always been somewhat precarious, but leadership there seems to have accepted the infusion of cash from HDRUK in the hope that the Welsh culture is resilient enough. Leadership can rotate, but culture persists.

Reflecting their shared culture with HDRUK, UK Biobank leadership also threw a tantrum when they came under repeated scrutiny for their dash towards Chinese cash, selling access to anyone who’d pay – eugenicists, shell companies, insurers, etc.

Research Data Scotland, with the heavy crossover to HDRUK and on to AHS, argued that it was better to ignore promises made to children filling in sex surveys than it was to do what was promised with the data.

The long mess of the HDRUK cartel, the Biobank clique, and the self-congratulatory preprint shows the importance of the environment being rigorously independent. The Welsh Government will have to have an environment for the data of the people of Wales – they can’t rely on England. Just as the NHS in England requires its own environment, so does ONS for the rest of Government – they will meet standards eventually. The English Health Bill proposes that one area of the country should receive data on the entire UK and use it according to local rules. Scottish decisions (like the school sex survey) can apply to English patients, even if English patients were told something different.

No tyrant ever failed to justify their crimes. HDRUK, Biobank, and AHS will all claim some version of the ONS originated “five safes”, the future question will be how that is measured, or whether the new ICO draft guidance (now open for consultation) will allow cheats to cheat and mislead regulators (again).

Consequences for the Adolescent Health Study

While these issues may not concern everyone, the culture which led to them will collapse AHS in scandal. Because AHS deals with adolescent mental health, nobody involved should be carrying this many unresolved questions about their judgement. It’s not that so many mistakes were made, but that precisely zero positive change has resulted from them. Biobank cheating, HDRUK/Foresight cheating, for what benefit? 

Appearing in front of Parliament and asked about Foresight, Prof Sudlow pretended there was no controversy at all, and everything was wonderful. The project remains “paused”.

UKRI studies have a long history of leadership who expect to be with the study for decades. Leaders who make decisions to maximise the confidence of the cohort, at the expense of short term supposed benefits, because they expect to be around to see and handle the consequences, and some of them know they’ll be invited to birthday parties and receive christmas cards. Those advocating for using the pandemic-only data however politicians like do not expect to be in their jobs when the next pandemic comes; many cohort studies leads do.

Compared to other UKRI cohort studies, AHS seems different as encouraged by the HDR/Sudlow review, and signals that the attempt to make “Population Research UK” an independent entity has failed. A former sockpuppet of HDRUK that acquired external funding, “PRUK” has chosen to remain technically dependent on HDRUK suggesting HDRUK still has a large cultural influence. “Population Research” being the UKRI euphemism for “non-consented” datasets that process administrative data on people who have been given no choice (if you are a victim of crime, they insist on using your data for population research).

Confidence requires being able to believe what is said, and not simply believing whatever someone strongly insists upon. The AHS must make promises to children (and parents), and precedent shows that current leadership will make promises they expect to evade, simply based on the evidence of the current Director advocating for doing exactly that in several of her past jobs. Confidence in the AHS will entirely depend on trustworthiness, and current AHS leadership cannot deliver that given the track record of failures on exactly those specific topics covered at length above.

The lessons for the AHS are stark, and the preprint shows, completely unlearned. Claiming “Five Safes” and expecting no scrutiny is no longer enough. The Five Safes can help a project be consensual, safe, and transparent in data use, but the words can also be used to cover up a project is cheating (a topic we’ll return to in the next post, because this is already far too long – a link will appear here when it’s published)