Across the world rapid changes in the law, technology, and society are reshaping the way identifiable information about patients is handled. In Britain, doctors' longstanding common law duty of confidentiality to their patients has been supplemented by restrictions on processing electronic and paper based records in the Data Protection Act 1998, which came into force on 1 March 2000. This month the United Kingdom's Medical Research Coun­ cil (MRC) is the latest of several professional organisa­ tions to respond to these developments by updating its guidance on confidentiality and the use of personal information (see table on BMJ 's website).1–4 The MRC has provided invaluable, balanced guidance but there is still a real risk that strict and selective application of the other directives could jeopardise audit, clinical govern­ ance, and observational epidemiological research. This would compromise patient care and the public interest.