In overturning Latham J's judgment in R v Department of Health, Ex Parte Source Informatics Ltd. that anonymisation does not obviate breaching a personal confidence, the Court of Appeal holds that where the duty of confidence arises in equity it does not prohibit the confidant using the confided information without the consent of the confider if this does not treat the confider unfairly (relative to the Court's view of the confider's legitimate interests). We argue that this principle – by bringing fairness to bear on the scope of the duty of confidence rather than on whether a breach of it may be lawful – has no authority in usable precedents; that the Court's interpretation of fairness in applying this principle is, in any event, incompatible with the Data Protection Act 1998 (in part because the Court has too narrow a conception of privacy); that the Court errs in holding that neither anonymisation of personal data nor use of anonymous data falls under the Data Protection Act; and that the Court's insensitivity to the vulnerability that leads patients to disclose information about themselves to health professionals for their treatment, leads it to misidentify the basis of the duty of confidence in such disclosures. The Court of Appeal's reasoning does not clarify the duty of confidence, but virtually abolishes it in the face of competing commercial and research interests.

This case commentary analyses a ruling that any use of information given in confidence for unconsented purposes is a breach of confidence capable of supporting a legal action (even if the information has previously been anonymised and aggregated).The ruling is being appealed. It is argued that, while it is reasonable to delineate a narrower duty of confidentiality (not to disclose personal information, against breach of which anonymisation protects), this must be within a broad duty of confidence (not to use private information, which using anonymous information can still breach). Thus, the ruling is fundamentally correct in holding that anonymisation does not permit information obtained in confidence to be used for unconsented purposes.This, however, implies that information obtained for a patient's treatment may not be used lawfully for medical research or NHS management purposes without consent, even if it is anonymised. Such a consequence is unacceptable as a matter of public policy. However, it is eq...

This case commentary analyses a ruling that any use of information given in confidence for unconsented purposes is a breach of confidence capable of supporting a legal action (even if the information has previously been anonymised and aggregated). The ruling is being appealed. It is argued that, while it is reasonable to delineate a narrower duty of confidentiality (not to disclose personal information, against breach of which anonymisation protects), this must be within a broad duty of confidence (not to use private information, which using anonymous information can still breach). Thus, the ruling is fundamentally correct in holding that anonymisation does not permit information obtained in confidence to be used for unconsented purposes. This, however, implies that information obtained for a patient's treatment may not be used lawfully for medical research or NHS management purposes without consent, even if it is anonymised. Such a consequence is unacceptable as a matter of public policy. However, it is equally unacceptable to seek an exemption through the idea that patients give "implied consent" for medical research and NHS management purposes. It is also unacceptable to maintain that the public interest in medical research (regardless of its aims) justifies unconsented use of information obtained in confidence, even if the information is anonymised. The way in which Section 33 of the Data Protection Act 1998 creates an exemption to its Second Data Protection Principle provides a ready-made model for a public interest based exemption for medical research and statistical NHS purposes.