Doctors who follow new GMC confidentiality guidance could be breaking European law, experts have warned.
The draft guidance outlines conditions in which patient data may be disclosed 'in the public interest, without patients' consent, and in exceptional cases where patients have withheld consent'.
It lists medical research as a use that can meet its public interest criteria. If patient records cannot be anonymised, it says, consent should be sought.
But it says doctors should consider the difficulty of tracing patients, and the number of records required, when deciding if this was 'practicable'.
The panel that drew up the guidance includes Wellcome Trust director Sir Mark Walport who has campaigned for patient data to be more widely available to researchers.
But Professor Ross Anderson, a data security expert and chair of the Foundation for Information Policy Research thinktank, said that EU law gave patients 'a right to forbid their doctor to give their medical data to anyone not involved in their case'.
He cited the ruling in last year's I vs Finland, which found that the state can be held liable for not adequately protecting patient records.
'The GMC will be issuing guidelines to doctors to do certain things that are contrary to EU law,' Professor Anderson said. Sharing data for research will be 'ethical but illegal'. 'Medical ethics will lose its force,' he said.
A GMC spokesman said it had sought 'leading counsels' opinion' before drafting the guidance. It had considered common law, Article 8 and the Data Protection Act, she said.
Experts say a test case will be needed to establish the full implications of I vs Finland to UK law.
Comment below and tell us what you think