What is the ethical basis for regulating how personal/patient data are used?

Ethical questions in healthcare can be answered by applying the bioethical framework of principalism (autonomy, beneficence, nonmaleficence and justice).1 The perspective of each cardinal moral principle is examined, the relative merits of each argument decided, and a judgement reached. In this case, the moral question might be ‘why should personal/patient data be regulated?’ Most would argue that autonomy is the primary moral principle worthy of consideration here, with patients having the right to decide how their personal information is used. In England, medical notes are owned by the organisation employing the clinician who writes them2; under GDPR, however, the patient still has rights to view these data, request corrections, and determine what these data are used for and generally who else may view them. After all, this information is about the patient.

Therefore, it is considered unethical if a patient’s autonomy is not respected by breaching confidentiality …