The use and disclosure of patient information is subject to multiple legal and ethical obligations. Within European human rights law the differences relating to consent are reflected in the separate requirements of data protection law, the common law, and professional ethics. The GDPR requires explicit consent. This contrasts with the ethical and common law availability of reliance on implied consent for the use of patient information for that patient’s care and treatment. For any proposed use of patient information for healthcare purposes other than direct care, even where GDPR may be satisfied if the patient refuses to consent to disclosure, the information should not normally be disclosed. For any proposed use or disclosure outside healthcare the justification should normally be consent. However, consent is often not possible or appropriate and an overriding public interest can be relied upon to justify the use or disclosure, both legally and ethically.

患者信息的使用和披露须遵守多项法律和道德义务。在欧洲人权法中，与同意相关的差异反映在数据保护法、普通法和职业道德的单独要求中。GDPR需要明确同意。这与使用患者信息进行患者护理和治疗时依赖默示同意的伦理和普通法形成鲜明对比。对于将患者信息用于除直接护理之外的医疗保健目的的任何提议，即使如果患者拒绝同意披露可能会满足GDPR 的要求，通常也不应披露该信息。对于医疗保健之外的任何拟议使用或披露，其理由通常应是同意。然而，同意通常​​是不可能或不适当的，并且可以依靠压倒性的公共利益来证明使用或披露在法律上和道德上的合理性。