Developments over the last decade in legislation and professional guidance on confidentiality and medical research in the UK are reviewed. Despite the General Medical Council's guidance, and recent changes to the common law on confidentiality in England and Wales, confusion remains about what is lawful and professionally acceptable in the handling of identifiable data. The GMC has contributed to this confusion. Professional bodies should jointly produce new guidance. The Health and Social Care Act 2001 is a temporary legislative solution. Public consensus is required on an acceptable balance between the citizen's right to privacy and the responsibility of society--to which all citizens belong--to protect the public health. The Government should survey public opinion, inform NHS patients better, initiate wide public debate, and legislate to protect both citizens' rights and medical research that is demonstrably in the public interest. Registration of cancer and communicable diseases should become statutory.