Public backing for sharing health data to develop artificial intelligence in the UK is real—but only if citizens see clear public benefit, robust safeguards and meaningful consent. That is the central message from new focus groups with UK residents, published this week in BMJ Digital Health & AI. The findings arrive as the NHS expands secure data environments and national opt-out mechanisms, sharpening the policy question from “can we share?” to “under what conditions will people accept sharing at scale?” Against a backdrop of repeated debates over care.data, GP records and the use of hospital data for research, the study effectively turns public attitudes into a set of operational tests for health leaders.
What the focus groups revealed
- Design: eight online focus groups with 41 adults across the UK; participants discussed realistic scenarios for health data sharing for AI involving the NHS, universities and commercial partners.
- Overall sentiment: cautious, conditional support that strengthened with demonstrable public benefit and weakened when safeguards, accountability or routes to challenge decisions were unclear.
- Trust gradient: higher for the NHS and universities; markedly more scepticism for commercial actors unless benefits, oversight and limits on data reuse were explicit.
- Consent: strong preference for clear, specific, accessible information; opposition to consent sought during stressful clinical moments; support for opt-outs and the ability to withdraw without affecting care.
Lead author Rachel Kuo said, “AI is increasingly embedded in public consciousness, and there is rapid innovation in its use for health care. However, developing and testing AI requires access to large volumes of patient data, which raises concerns about confidentiality and security. Our aim was to understand how people think about sharing their data in the context of AI, and whether AI introduces particular fears or perceived benefits that shape those decisions.”
Patient and public contributors emphasised the practical trade-offs citizens make between privacy and progress:
“This is very important work that speaks directly with the public to understand the views that really matter. It is essential that we understand, in real time, how this area of technology and science is advancing. The themes developed in the study show the need for public engagement, to understand best practice and acceptability, in order to advance this important area.”
“The focus groups gave a fascinating insight into how people assess the risks and benefits of Artificial Intelligence in health care. You get a flavor of which organizations they would trust to access their data, and sometimes their reasoning. The comment one member made reflects how vital this research is, as the picture is complicated.
She said that with her ‘person-hat’ on, she had lots of reservations about giving up her data, especially to commercial companies, but with her ‘patient-hat’ on she would gladly share her data, with almost anyone, if it sped up new treatment for her long-term condition.”
The findings broadly echo wider UK tracking research, which shows that people are more comfortable with data use when it is clearly for health or scientific purposes, tightly governed and delivered through institutions they already trust rather than generic “tech” or commercial brands.
How public expectations map onto UK data governance
Crucially for policymakers, the focus group conditions for social licence line up with existing—though unevenly understood—governance tools. For officials in the Department of Health and Social Care and NHS England, the message is less about inventing new frameworks than about using current ones visibly and consistently.
| Condition for public support | What it means in practice | Current UK levers and mechanisms |
|---|---|---|
| Clear public benefit | Explicit articulation of patient/population gains; independent scrutiny of benefit claims | Health Research Authority ethics review; Confidentiality Advisory Group (s251) approvals where needed; publication of study protocols, lay summaries and realised impacts |
| Strong safeguards | Data stay in controlled environments; audited access; privacy-by-design; safe outputs | NHS “Five Safes” model and Secure Data Environment policy guidelines; trusted/secure research environments; Data Security and Protection Toolkit; alignment with the UK General Data Protection Regulation |
| Meaningful consent and choice | Layered, plain-language information; cooling‑off periods; ability to withdraw; clear routes to opt out | National Data Opt‑Out for uses beyond individual care; local Information Governance and Caldicott Guardian oversight; integration with complaints and redress routes |
| Transparency about commercial involvement | Disclosure of partners, data uses, and value flows; enforceable public‑benefit terms; independent oversight | NHS‑controlled SDEs for research access; data access committees; contractual public‑benefit clauses and audit rights; published registers of approved projects where available |
| Fairness and equity | Minimise re‑identification risks for rare conditions; monitor bias; include underserved groups in governance | Data Protection Impact Assessments; Equality Impact Assessments; model and dataset documentation; lay representation on advisory groups and ethics panels |
Key risk–benefit judgments voiced by participants
For health service leaders and AI developers, the focus groups read less like abstract attitudes and more like a checklist of “red lines” that can derail public trust if ignored.
- Risks flagged:
- Re‑identification, especially where rare diseases or multi‑source linkage increase uniqueness of records.
- Misuse of data outside stated purpose; uncertainty over breach response, sanctions and routes to redress.
- Benefits cited:
- Improved diagnostics and pathway efficiency; faster access to innovation.
- Contribution to the “greater good,” particularly among those with long‑term conditions who have experienced delays in treatment.
System implications for the NHS, regulators and partners
If taken seriously, the study implies a shift from treating public engagement as a communications exercise to embedding it in core governance for AI and data-driven research.
- Governance capacity
- Scale up data stewardship skills across SDEs, including audit, provable privacy controls and output checking.
- Strengthen Caldicott Guardian and Senior Information Risk Owner (SIRO) functions for AI‑relevant projects, with clear lines to board‑level accountability.
- Consent and communication
- Adopt layered consent and post‑event “cooling off” options for research recruitment outside acute care moments.
- Publish plain‑English project summaries, benefit cases and independent lay reviews in one public registry so citizens can see where and why their data are used.
- Commercial arrangements
- Route partner access through NHS‑controlled secure environments; avoid data export unless explicitly consented and technically justified.
- Use public‑benefit tests, cost‑recovery access charges and enforceable obligations on purpose limitation, non‑re‑identification and transparent value‑sharing.
- Assurance at model level
- Tie dataset governance to downstream AI assurance (validation, monitoring, incident reporting) to maintain trust through deployment, not just development.
Equity and inclusion: signals to watch
Participants also signalled that data‑driven AI could easily entrench existing inequalities if governance focuses only on averages, not on who is left out.
- Rare conditions and small subpopulations face higher identifiability risk; de‑identification must be stress‑tested on linked datasets.
- Trust differs by institution and life experience; governance should include diverse lay voices and report differential impacts across communities.
- Opt‑out rates and reasons should be monitored to avoid systematic exclusion that could bias AI performance and weaken benefits for already underserved groups.
Kuo added, “As systems increasingly rely on large-scale data to develop and evaluate AI, public trust can’t be taken for granted. Our research shows that people are willing to support data sharing, but only under clear conditions. These include transparency about how data are used, strong governance, meaningful consent and demonstrable public benefit. Understanding these expectations will be essential if we want data-driven innovation in health care to be both ethical and sustainable.”
Bottom line
- Conditional support is not a barrier—it is a blueprint. The UK’s move to secure data environments, explicit public‑benefit tests and stronger consent practices aligns closely with what people say they expect, and with the direction of formal data protection law.
- Delivery now hinges on visible safeguards, consistent transparency and equitable participation so that data‑driven AI improves care for everyone, not just those most represented in the data—and so that public consent becomes an asset for innovation rather than a recurring flashpoint.
