Information given in confidence may not be used or disclosed except for the purpose for which it was supplied unless the supplier consents, and this is not changed by removing the supplier's name. This is wrong. The Data Protection Act 1998 only applies to Personal Data, ie that relating to an identifiable living person. If the data are anonymised such that the person they relate to cannot be identified, the act does not apply. Interestingly, there is a wrinkle that the processes of anonymisation is processing under the meaning of the act, so it may only be undertaken if it complies with DPA. Medical research has some specific exemptions within the act, but they may or may not apply here. Of course, if managing health provision is one of the core purposes for which the data was collected, then it may be processed under DPA.