Gaps in data protection and regulatory oversight threaten to make research based on biobank data the fruit of a poisoned tree