It is not difficult to imagine a world where diseases can be prevented before it struck and cured decisively by harnessing the vast datasets of biomedical information. It may sound futuristic however the world of “data-rich medicine” or “personalised medicine” has made significant progress in last few years. Personalised medicine employs a more precise knowledge of the genomic, clinical and epidemiological characteristics of the patient's disease to inform treatment decision-making. Indeed, it seems inevitable that optimised and individualised health products will form one element of personal ‘whole-life management’ of health according to which genomic data acquired at the beginning of life will be supplemented throughout that life by findings from continuous supplies of additional data on the person as well as from aggregated data gleaned from the whole population. Obviously, both volume and variety stand to increase tremendously in the coming years.

It has long been an ideal in different forms and paradigms of medicine – to focus not only on the disease but also on the person. This approach is dependent on widespread data sharing, underpinned by multi-layered sets of data (and powered by big data analytics). It will radically accelerate “personalised medicine”, making discovery and treatment more efficient. However, what if insurance companies, government agencies, or even hackers gain access to the data? Further as more types of data from more varied sources become integrated, the possibilities for re-identification, that is, being able to link ‘pieces’ of information that could be highly sensitive back to the individual, becomes ever more conceivable. 

We argue that the future of personalised medicine will depend on how we address the relevant legal questions arising from the challenges and limitations concerning the use of big data. We must be mindful of the rights of patients to access their data and control its use and distribution, particularly respecting and enforcing these rights — including the right to privacy.  This article is concerned with the data privacy challenges involved with personalised medicine. Can the privacy concerns ever be fully resolved? We make two preliminary points. First, in this article, we argue that regulation should be premised on the basis that one breach of privacy is one too many. Second, regulation should not stifle scientific progress; personalised medicine is our “carrier of hope”. Hence the article seeks to find solutions to ensure the appropriate balance between emerging scientific discoveries with commercial gains and the rights of individuals within a system designed for the express purpose of exchanging critical personal information.