You're assuming that NHS is selling it without the consent of patients. More likely this is for things like patients on drug trials etc. who sign a waiver to allow sharing of their health information. The UK takes confidentiality of public records pretty seriously and has done for years - I seriously doubt you can just just pull any given person's health records without their agreement.
Clearly we have differing interpretations of that document. I don't think everyone can get the sec. 251 exemption, just for a start. It is certainly possible to de-anonymize individuals if you know enough details to get a correlation, but how many people do you know sufficiently well to work backwards through that process? If your goal is to sell more shampoo by working out who has dandruff, for example, the marginal cost of de-anonymizing your potential customers is likely to drastically exceed the marginal benefit of each additional sale. Fishing expeditions by Fleet street or private detectives targeted on a particular individual are likely to either raise red flags if too obvious or be wildly expensive if sufficiently stealthy (multiple pull requests followed by client-side correlation) - cheaper to go the traditional route of bribing the nanny or suchlike.
On the other hand, the increased risks of malicious de-anonymization (risk, not certainty) have to be weighed against the obvious benefit of having a portable health record and reducing duplication and administrative overhead if you are taken ill and have to visit a hospital or a doctor who's not your GP.
>On the other hand, the increased risks of malicious de-anonymization (risk, not certainty) have to be weighed against the obvious benefit of having a portable health record and reducing duplication and administrative overhead if you are taken ill and have to visit a hospital or a doctor who's not your GP.
That's not the system that's being discussed, though.
All other systems are pendant to that. If this data wasn't available in any way we'd have a story saying 'NHS won't release data, obstructing drug development which could save lives.'
