Topic 1.8 — Data Ethics, Consent & Public Trust

In health and care, the law tells you what you can do with data, but public trust depends on whether you should — and once people believe their information is being used behind their backs, they withhold it, opt out, or avoid care, so ethics and honest engagement are not soft extras but the conditions under which data can be used at all.

Why this matters in health and care#

Topic 1.7 — Information Governance, Data Protection & Cyber Security covers the law and the technical controls: lawful bases, the UK General Data Protection Regulation (UK GDPR), the Data Security and Protection Toolkit, encryption, and access control. This topic is about everything that remains once you are legally compliant. You can satisfy every statute and still lose the public's trust, because trust is not granted by lawyers — it is granted by patients and citizens who decide, individually and collectively, whether they believe you are handling their information in a way they would recognize as fair.

That distinction matters more in health and care than almost anywhere else. People disclose things to clinicians — mental-health crises, substance use, sexual health, abuse, immigration-linked entitlements — on an unspoken understanding that the information exists to help them, not to be traded, published, or repurposed without their knowledge. When that understanding breaks, the harm is measurable: patients lie to clinicians, decline to share history, or stay away from services. Those are clinical-safety and equity failures, and they land hardest on the people who already trust institutions least.

The system also depends, genuinely, on using data beyond the single consultation — to plan services, run population health management, detect safety signals, and support the research that produces tomorrow's treatments. So you sit inside a permanent tension: withhold data and you starve care and research; use it carelessly and you forfeit the consent of the public whose data it is. This topic is about holding that tension honestly. The recent history of the health service contains at least one large, expensive lesson in what happens when an organization answers only the legal question and never the ethical one.

Core concepts#

The governing discipline here is data ethics — the systematic study of right and wrong conduct in the collection, use, and sharing of data, especially personal data. Its central move is to separate two questions that organizations routinely conflate: can we do this lawfully, and should we do this given what people reasonably expect and what harms might follow. A lawful basis answers the first. Only deliberate ethical reasoning, transparency, and engagement answer the second.

Consent is more layered than everyday usage suggests. Informed consent — a person agreeing to something with adequate understanding of what it involves — is the gold standard for direct care and most research. But at population scale, individual explicit consent is often impractical or would itself bias the data, so the system relies on other models: implied consent for direct care (you accept that the clinician treating you will read your record), and opt-out models for some secondary uses, where data is used unless a person actively objects. In England the principal instrument is the NHS national data opt-out, which lets a person prevent their confidential patient information being used for planning and research beyond their own care. Knowing which model applies, and being honest that opt-out is not the same as active consent, is a core competence.

Alongside data-protection law sits an older and separate obligation: the common law duty of confidentiality, under which information shared in confidence may not be disclosed without consent, a legal requirement, or an overriding public interest. From it flows the reasonable expectations or "no surprises" principle: you should not use someone's data in a way that would genuinely surprise them if they found out. This is a practical ethical test that often bites well before the law does.

Two health-specific institutions carry the ethical load. The Caldicott principles — upheld in each organization by a Caldicott Guardian — famously insist that the duty to share information can be as important as the duty to protect it, correcting the reflex that treats withholding as automatically safe. Nationally, the National Data Guardian for Health and Social Care (NDG) is the independent statutory voice on how patient data should be used and safeguarded. Around these sits the idea of a social licence: the ongoing, informal acceptance from the public that legitimizes how an institution uses data — earned through transparency and engagement, not granted by statute, and quickly withdrawn when trust is broken.

For secondary uses — analytics, planning, and research rather than direct care — the technical bridge between usefulness and privacy is de-identification: reducing the identifiability of data through pseudonymization (replacing identifiers with artificial tokens, reversible with separately held keys) or anonymization (removing identifiers so a person can no longer be identified). Both have limits: rich health data can often be re-identified by linking it with other datasets — the "mosaic effect" — so "anonymized" is a claim to be tested, not assumed. Finally, where data drives automated or model-based decisions, you inherit questions of algorithmic bias — systematic unfairness that disadvantages some groups — and algorithmic accountability, the allocation of responsibility for those outcomes. The deep governance of AI belongs to Topic 8.4 — AI & Emerging Technology Governance; here it matters only as one more use of data that must earn public trust.

Best practices#

1. Ask "should we?" as a distinct, minuted decision — not a footnote to "can we?". For any non-obvious use of data, run the ethical question separately from the legal one and record the answer. Name who benefits, who might be harmed, what people would reasonably expect, and whether you would be comfortable explaining the use on the front page of a newspaper. A use that is lawful but fails the reasonable-expectations test is a use to redesign or explain openly, not to proceed with quietly.

2. Match the consent model to the use, and be honest about which one you are using. Direct care runs on implied consent; most research needs explicit informed consent or an approved legal route; some planning uses rely on the opt-out. Do not dress an opt-out up as if it were active agreement, and do not lean on "consent" language when the real basis is a statutory power. Clarity here protects both the patient's autonomy and your own credibility when the arrangement is scrutinized.

3. Honour the national data opt-out reliably, and treat it as a floor, not a ceiling. Apply the NHS national data opt-out to every secondary-use flow it covers, and be able to demonstrate that you do. But recognize that legal compliance with the opt-out is the minimum; a use that technically respects opt-outs while blindsiding the public will still cost you trust. Where a use is novel or sensitive, consider going beyond the baseline with clearer notice or a more active choice.

4. Apply the reasonable-expectations test before every new data flow. Ask plainly: if the people whose data this is knew exactly what we were doing, would they be surprised, and would they feel misled? Surprise is an early-warning signal that arrives long before a legal breach. When the honest answer is "yes, they would be surprised", you have three choices — change the use, obtain meaningful consent, or explain it so thoroughly and so early that it stops being a surprise.

5. Remember that the duty to share can be as vital as the duty to protect. The Caldicott principles exist partly to counter defensive over-caution, which quietly harms patients when a clinician cannot see an allergy, a safeguarding concern falls between agencies, or a discharge fails for want of context. Ethical data handling is not the same as data hoarding. Weigh the harm of not sharing as deliberately as the harm of sharing, and connect this to the safe-sharing design in Topic 1.7 — Information Governance, Data Protection & Cyber Security and the safety consequences in Topic 1.6 — Clinical Safety & Risk Management.

6. Treat de-identification as risk reduction, not a magic eraser. Pseudonymize or anonymize secondary-use data, but assess re-identification risk realistically, especially for rare conditions, small populations, or richly linked datasets where the mosaic effect bites. Control the environment as well as the data: prefer accredited Secure Data Environments, where analysts work on data that never leaves a governed setting, over shipping "anonymized" extracts out of the building. Document the residual risk and who accepts it.

7. Run an ethics review for uses that law alone does not settle. Establish a route — a data ethics committee, an existing research ethics process, or a standing function — to scrutinize novel, sensitive, or commercially entangled uses before they proceed. Give it independent and lay membership so it is not merely the organization reassuring itself, and require it to consider fairness and differential impact on groups, not only privacy.

8. Make transparency proactive, specific, and human-readable. Publish, in plain language, what data you hold, what you use it for, who you share it with (including commercial partners), and what choices people have. A dense privacy notice written for regulators is not transparency; a clear public register of data uses is. Disclose new or commercial arrangements before they start, because a use that surfaces through a journalist's leak is read as a cover-up regardless of its merits.

9. Involve patients and communities in decisions about their data — early and for real. Public and patient engagement is not a communications exercise bolted on at launch; it shapes what you build and whether it earns a social licence. Bring patients, carers, and community representatives — especially from groups with good historical reason to distrust institutions — into design and governance, and show how their input changed decisions. This connects directly to Topic 3.0 — User Research & Service Design and to Topic 8.2 — Communications & Engagement.

10. Own fairness and accountability when data drives decisions. Where data feeds risk scores, prioritization tools, or models, ask whose data trained them, which groups may be under-represented, and who is answerable when the output is wrong or discriminatory. Keep a human in the loop for consequential decisions and monitor outcomes across demographic groups over time. Hand the detailed model governance to Topic 8.4 — AI & Emerging Technology Governance, but do not treat "the algorithm decided" as an escape from responsibility.

Questions to discuss with your team#

1. For our most sensitive or novel data use, what is the honest gap between what is legally permitted and what our patients would actually expect — and how would we close it? This is the core question of the topic, so make it concrete rather than abstract: pick a real use in your organization — a research partnership, a supplier arrangement, a population-health dashboard, a model. Walk through what the law permits, then ask separately what an ordinary, moderately sceptical patient would assume was happening, and name the gap between the two. The gap is where trust is won or lost, and it is invisible if you only ever ask the legal question. A good discussion surfaces at least one use where the team is relying on "it's lawful" to avoid a harder conversation, and produces a decision to either change the use, seek meaningful consent, or explain it far more openly. Watch for the tell-tale defence "but we're allowed to" — it usually means the ethical question has never been asked.

2. Where are we harming patients by not sharing data, and are we as honest about that harm as we are about the risk of a breach? Data ethics is routinely mistaken for data minimization, and defensive over-caution wears the costume of safety while doing real damage. Discuss concrete cases from your own setting: a missed allergy, a safeguarding concern that fell between agencies, a discharge that went wrong because community teams lacked context, a researcher blocked from data that could have found a safety signal. The Caldicott principle that the duty to share can be as important as the duty to protect exists precisely because organizations find withholding psychologically safer, even when it is not actually safer for the patient. A mature team can name failures in both directions and has a route to escalate each, rather than treating "no" as the risk-free default. Consider, too, whether your incentives reward the person who refuses to share far more than the one who shares appropriately.

3. If a national newspaper reported one of our data-sharing arrangements tomorrow — accurately but unsympathetically — would we survive it, and what does the answer tell us to fix now? The care.data programme was not brought down by illegality; it was brought down by the public feeling that something was being done to them without a real explanation or a real choice. Run the test against your own arrangements, especially any involving commercial partners, model training, or secondary uses that patients have not been told about clearly. Where does the story get uncomfortable — is it the partner, the lack of an opt-out, the vagueness of the public notice, the absence of any community involvement? That discomfort is a precise map of where your social licence is thin. A good answer is not "we'd manage the press"; it is a list of things you will make more transparent, more consented, or simply stop doing, and it connects to the engagement discipline in Topic 8.2 — Communications & Engagement.

4. When we call data "anonymized", how confident are we that it could not be re-linked to a person — and who has actually tested that claim? De-identification is treated as a finish line far more often than it deserves, and "anonymized" is frequently asserted rather than assessed. Pick a real secondary-use dataset and ask precisely what was done to it — pseudonymization with a separately held key, or genuine anonymization — and then ask how it would fare against the mosaic effect if someone linked it to other data, especially for rare conditions, small populations, or richly detailed records. Ask, too, where the data physically lives: is it analysed inside an accredited Secure Data Environment that never lets it leave, or shipped out as an extract on the assumption that the label makes it safe? An honest discussion names the residual re-identification risk explicitly, records who has accepted that risk, and distinguishes what has been tested from what has merely been hoped. If no one in the room can say who last stress-tested the claim, that absence is the finding.

5. Where data feeds a risk score, a prioritization tool, or a model, whose data trained it, who might it disadvantage, and who answers when it is wrong? Fairness is easy to endorse in principle and easy to neglect in practice, because bias hides in data that looks complete but under-represents exactly the groups who already fare worst. Take a concrete example — an admissions-risk model, a triage tool, a caseload-prioritization score — and ask which populations are thin in the training data, how a wrongly flagged or wrongly overlooked person would be affected, and whether anyone monitors outcomes across ethnicity and deprivation over time rather than only at launch. Press on accountability: when the output is challenged, is there a named human who owns the decision, or does "the algorithm decided" quietly absorb the responsibility? The deep model governance belongs to Topic 8.4 — AI & Emerging Technology Governance, but the ethical ownership sits here. A mature answer pairs a specific fairness-monitoring commitment with a clear line of accountability, not a reassurance that the maths is neutral.

6. How do we involve the people whose data this is — particularly the communities with the best reason to distrust us — and can we point to a decision their involvement actually changed? Engagement is the part most easily reduced to decoration: a consultation held after the design is fixed, or a panel drawn only from people who already trust the institution. The harder and more valuable question is whether patients, carers, and community representatives — especially from groups historically let down by the health service — are in the room early enough to alter what gets built, and whether you can name a concrete change that resulted. Discuss who you are not hearing from and why, and whether your engagement reaches the seldom-heard or simply reconfirms the comfortable. This connects to Topic 3.0 — User Research & Service Design and Topic 8.2 — Communications & Engagement. An honest answer distinguishes genuine co-design that shifted a decision from a communications exercise that merely announced one, and is candid about which of the two you are currently doing.

In practice: a health & care example#

Riverbourne Integrated Care System wants to use linked patient data to reduce emergency admissions among people with multiple long-term conditions. The analytics team has a strong case: bring hospital, GP, community, and social-care data together, build a risk model, and offer proactive support to the people most likely to deteriorate. Legally, the route is workable. The programme director, however, remembers care.data, and insists the ethical and trust questions are answered before a line of the model is built.

The team separates the two questions deliberately. Can we? is handled with the Data Protection Officer and Caldicott Guardian: a lawful basis, a Data Protection Impact Assessment, and confirmation that the national data opt-out applies to this secondary use. Should we? goes to a newly convened data ethics group with independent and lay members, including two patient representatives from communities with historically low trust in the health service. The group asks harder questions than the lawyers did: who might a risk score disadvantage, what happens to someone wrongly flagged, and would patients be surprised to learn their social-care data was feeding a hospital model?

Those questions change the design. The analysis runs inside an accredited Secure Data Environment, so analysts work only on pseudonymized records that never leave the governed setting. The model's outputs are reviewed by a clinician before anyone is contacted, not acted on automatically. The team commits to monitoring whether the model performs equally well across ethnic groups and deprivation levels, having found that under-representation in the training data could otherwise entrench inequity. And the ICS publishes a plain-language description — what data, what purpose, who benefits, what safeguards, and how to opt out — before the programme starts, rather than waiting to be asked.

When a local journalist does ask, months later, the story is uneventful: the arrangement is already public, the opt-out is honoured, patients helped shape it, and the safeguards are real. Opt-out rates barely move. The programme reduces admissions modestly in its first year, but the more durable win is that Riverbourne can now propose its next data initiative from a position of trust rather than suspicion. The trade-off was explicit: engagement and ethics review added three months and some awkward redesign, and bought a social licence that a faster, quieter launch would have gambled away.

Sector lenses#

Startup#

A health-tech startup usually has sharp technical instincts and a thin feel for the sector's trust dynamics, and its commercial model often depends on data uses — analytics, model training, partnerships — that patients would not expect. If you are a startup, your existential risk is not a regulator's fine but an NHS partner walking away when an under-explained data use surfaces. Bake the "should we?" question into product decisions from the start, be scrupulously honest about consent versus opt-out versus statutory basis, and never treat "anonymized" as a settled fact when your data is rich enough to re-identify. Earning trust while small is far cheaper than rebuilding it after a public misstep.

Small business#

An established small provider — a GP practice, a community pharmacy, a care home, a domiciliary-care agency, a single-site clinic, or a small health-tech supplier past the startup stage — carries the same duty of confidentiality and the same "no surprises" obligation as a large trust, but with real patients on the books, a handful of staff, and little or no dedicated IG or IT capability. The trust risks here are usually quieter than a headline data deal: a new appointment-reminder tool, an analytics feature switched on by a supplier, or patient data casually shared with a third party because no one had time to ask "should we?". Make the reasonable-expectations test a quick, routine habit rather than a formal committee, name the consent model honestly for each use, and lean on your Caldicott and Data Protection responsibilities even when they fall to a single part-time person. Choose suppliers whose default settings honour the national data opt-out and keep data in governed settings, since you are inheriting their ethics as well as their software. And remember the duty to share cuts both ways — refusing to pass on a safeguarding concern or a medication history because it feels safer can harm the patient more than sharing would.

Enterprise#

A large trust or ICS holds vast, deeply sensitive data and typically has mature legal governance but weaker ethical muscle — plenty of DPIAs, few genuine ethics conversations. Your challenge is to add the ethical layer without either paralysing legitimate sharing or letting commercial and research partnerships run ahead of public understanding. Stand up a real data ethics function with lay membership, publish your data uses and partnerships openly, and make sure the duty to share is honoured so that defensive over-caution does not quietly harm patients. Board-level ownership of public trust — not just compliance — is the differentiator, and it connects to Topic 6.4 — Governance & Assurance.

Government#

National bodies set the frameworks that everyone else inherits — the national data opt-out, the National Data Guardian's guidance, the Caldicott principles — and they carry public trust at population scale, where the consequences of getting it wrong are historic rather than local. The care.data programme is the cautionary monument: a lawful, well-intentioned national scheme that collapsed because the public felt uninformed and unconsulted, and it depressed trust for years. Lead with transparency, meaningful national engagement, and independent oversight before scaling, not after a backlash. Recognize the trade-off you own: over-cautious national policy starves care and research, while careless policy forfeits the public consent that the whole data system depends on, as explored further in Topic 4.5 — Data, Analytics & Population Health Management.

Common failure modes#

• Answering only the legal question. Treating a lawful basis as a complete justification, so no one ever asks whether a use is fair, expected, or wise. This is exactly how well-intentioned, fully compliant programmes lose public trust.
• Consent theatre. Presenting an opt-out, a buried privacy notice, or a statutory power as though it were meaningful informed consent, so people feel deceived when they discover what "agreeing" actually meant.
• Hidden or surprising uses. Extending data collected for care into analytics, commercial deals, or model training without clear, proactive notice — until a leak turns a defensible activity into a scandal.
• Anonymization as alibi. Labelling rich, linkable data "anonymized" and treating the ethical question as closed, ignoring re-identification risk and the mosaic effect.
• Engagement as decoration. Consulting the public after decisions are made, or only with the already-trusting, so the exercise legitimizes rather than informs — and misses the communities whose trust is most fragile.
• Defensive over-caution. Refusing legitimate sharing and calling it safety, while patients are harmed by clinicians who cannot see what they need.

Maturity model#

Checklist#

• Every non-obvious data use has a recorded "should we?" decision, separate from its lawful basis.
• The consent model (implied, explicit, or opt-out) is named honestly for each use.
• The national data opt-out is applied to all secondary uses it covers, and this can be demonstrated.
• Each new data flow passes a reasonable-expectations / "no surprises" test.
• Re-identification risk is assessed for de-identified data, using Secure Data Environments where practical.
• A data ethics review route with independent and lay membership exists for novel or sensitive uses.
• A plain-language public register of data uses, partners, and choices is published and kept current.
• New or commercial data arrangements are disclosed proactively, before they begin.
• Patients and communities — including low-trust groups — are involved in design and governance, with their influence recorded.
• Bias and differential impact are assessed where data drives decisions, with accountability clearly owned.
• The duty to share is weighed as deliberately as the duty to protect, so over-caution is not mistaken for safety.

Key sources#

• National Data Guardian for Health and Social Care — reviews, the Caldicott Principles, and guidance on trustworthy data use.
• NHS England — the national data opt-out: policy, operational guidance, and public information.
• Understanding Patient Data — plain-language explanations of how and why NHS data is used.
• Information Commissioner's Office (ICO) — Anonymisation, pseudonymisation, and data-sharing guidance.
• National Data Guardian & Department of Health — Review of Data Security, Consent and Opt-Outs (2016), which followed the care.data experience.
• Ada Lovelace Institute — research on data ethics, public attitudes, and trustworthy data practice in health.
• NHS Digital / NHS England — Secure Data Environment policy guidelines for health and social care data.

References#

1. Big data ethics — Wikipedia — https://en.wikipedia.org/wiki/Big_data_ethics
2. Informed consent — Wikipedia — https://en.wikipedia.org/wiki/Informed_consent
3. Duty of confidentiality — Wikipedia — https://en.wikipedia.org/wiki/Duty_of_confidentiality
4. care.data — Wikipedia — https://en.wikipedia.org/wiki/Care.data
5. Caldicott guardian — Wikipedia — https://en.wikipedia.org/wiki/Caldicott_guardian
6. National Data Guardian for Health and Social Care — Wikipedia — https://en.wikipedia.org/wiki/National_Data_Guardian_for_Health_and_Social_Care
7. De-identification — Wikipedia — https://en.wikipedia.org/wiki/De-identification
8. Pseudonymization — Wikipedia — https://en.wikipedia.org/wiki/Pseudonymization
9. Data anonymization — Wikipedia — https://en.wikipedia.org/wiki/Data_anonymization
10. Algorithmic bias — Wikipedia — https://en.wikipedia.org/wiki/Algorithmic_bias
11. Algorithmic accountability — Wikipedia — https://en.wikipedia.org/wiki/Algorithmic_accountability
12. National data opt-out — NHS England — https://digital.nhs.uk/services/national-data-opt-out
13. Review of Data Security, Consent and Opt-Outs — National Data Guardian — https://www.gov.uk/government/publications/review-of-data-security-consent-and-opt-outs
14. The Caldicott Principles — National Data Guardian — https://www.gov.uk/government/publications/the-caldicott-principles
15. How we use and protect data / Understanding Patient Data — Understanding Patient Data — https://understandingpatientdata.org.uk/
16. Anonymisation and pseudonymisation guidance — Information Commissioner's Office — https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/
17. Secure Data Environment for NHS health and social care data — policy guidelines — NHS England — https://www.gov.uk/government/publications/secure-data-environment-policy-guidelines