> highly unlikely that anything they've done with the data could be linked to specific individuals, even though the original anonymisation was unlikely to have been sufficient

So even if we take a professional body which represents the interests of the insurance industry at their word, we still have to trust that private companies with little or no public oversight will somehow decide to do the right thing?

It's blatantly obvious that a postcode and age is enough to match a record to an individual. Why are we expected to trust private industry not to mess with our privacy?

We have no more but also no less reason to trust individuals who are not NHS employees from breaching data protection law than individuals who are NHS employees, and have access to much more sensitive data.

On a pedantic note, the data was split by postcode district and age, with the average postcode district being 20,000 people. I still agree that's not data you'd want on a private insurers' database because they could de-anonymise outliers like the only 97 year old man, and others with partial knowledge of their hospital visit history, but it would be a lot of work making it usable for granting or denying insurance to particular individuals. Especially when it's probably easier to gain illicit access to the non-anonymised records than gain and make sense of illicit access to the anonymised records.

As it stands, we have the NHS having access to our personal data. What the Government wants to do is expand the number of organisations that have access to that data to include private companies that we have no oversight over. At least if the NHS has shit policy, we can complain and have our complaints heard. If a private company that has nothing to do with you has shit policy? Tough luck.

Additionally, there's many things that an organisation can do with data that are not in breach of data protection law,, but which I do not want them doing anyway, especially without me explicitly opting in to giving them that data. Data protection law mostly just says that they can't share it with other companies without your permission, they must let you know what it is if you ask, and you have the right to have it corrected if it's wrong. And even then, there's plenty enough companies in the UK that don't even meet those rules all the time!

This is not about individuals. This is about organisations.

Yet the NHS themselves confirmed that everything was true.

http://www.telegraph.co.uk/health/nhs/10659147/Patient-recor...

The original Telegraph article headline was "Hospital records of all NHS patients sold to insurers" (aside from the flatly false headline, the actual content of the article is pretty accurate). The IFoA that actually bought the data and did the research pointed out that they were not an insurer, nor providing any recommendations to insurers beyond the now-publicly-available macro data I linked to. In other words, no private firms - in the insurance industry or otherwise - legally have access to any medical records as a result of this sale, other than the macro research document I linked to, which you might want to read for yourself if you're concerned about what's getting into the public domain.

The link you've just posted has the NHS-linked body in question admitting "greater scrutiny should have been applied" in this instance, but actually reasserts all the points made by IFoA: they're not an insurer, it's a general study on frequencies of illnesses amongst certain demographics and there's no personally-identifiable data accessible to insurers as a result of this. The HSCIC making a hand-wavy non-apology != the NHS confirming that this is an example of a private firm they sold your medical records to

You are right. Upon inspection the incident was far less threatening than reported. I was wrong.

As an example of potential abuses by public departments selling data I think it still stands though.