>If they have permission of government officials then what? //
They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.
To be fair, there are a few grey areas in the law as it currently stands in the UK that might be relevant if we're arguing about government permission. The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. I'm investigating whether those powers are a relevant factor in this case, but so far I've found no verifiable information either way.
>The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. //
Most laws seem to have these SoS exclusion clauses. In this particular case, S.251(1)¹ says
"The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient—
So it's by regulations², ie "rules". Whilst they don't need a new law to be passed they're still a statutory instrument, it's not like this section allows the SoS to just decide by himself.
See for example S.252(2); and S.251(7), quoted here:
"Regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c 29)."
They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.