If you’ve ever played ‘twenty questions’, you will already know how easy it can be to identify an individual from a relatively small amount of information. Each question narrows down the field, and the more unusual the person’s attributes, the easier it becomes to guess who it is.The same principle applies to data. If we say that someone is male, that tells us only that he belongs to a group that represents one half of the population. By adding that he is aged 42 we reduce the size of that group, but we’re still not going to guess his identity.

Such general information isn’t likely to be of much use to researchers either. They are approaching their research from a different angle: they are likely to be investigating the unusual and are therefore looking for certain characteristics in their study subjects. The rarer those characteristics or the more of them in combination, the easier it becomes to identify individuals within the study. Consider, for example, a study examining the prevalence of skin disorders caused by exposure to the sun in red-headed males aged 40-45 who live in Devon and Cornwall.

The more data that can be linked together about an individual, the easier it becomes to find out who they are. Journalists and private investigators already know this – and so do large companies. There is a huge industry around data-matching aimed at identifying those who can be targeted with specific advertising and products.

Removing or obscuring pieces of information that most obviously identify a person doesn’t make data about them ‘anonymous’. And in any case, despite claims it will only ever share ‘anonymised’ data, NHS England has already applied for and been granted permission to pass around patient data in identifiable form. (We’ll explain more about that later)

So does it matter if you can be identified? Your answer might well depend on whether you suffer from a condition, or live in circumstances, that you would prefer to keep as a secret between you and your doctor. It might also depend on whether you are actually asked if you will participate in a research study. Probably most red-headed 42-year-olds would be happy to contribute to research that could conceivably help them, although even then they might want to draw some lines about what exactly is released.

The point is, people generally regard their medical records as private and want to keep control of access to them. They can talk to their doctors about highly sensitive and embarrassing things like sexual health problems, worries about their erratic moods or their alcohol intake precisely because they believe they are talking in confidence. If they are to continue talking to their doctors, they need to know that they will be asked for permission before that confidence is breached.