Ross Anderson writes: 

Each year we divide our masters of public policy students into teams and get them to write case studies of public policy failures. The winning team this year wrote a case study of the fiasco. The UK government collected personal health information on tens of millions of people who had had hospital treatment in England and then sold it off to researchers, drug companies and even marketing firms, with only a token gesture of anonymisation. In practice patients were easy to identify. Theresultingscandalstalled plans to centralise GP data as well, at least for awhile.

Paper here. [direct link to this aside]