Every time you step inside a hospital, the chances are that someone, somewhere is watching you - though that someone is more benevolent than your average stalker, and it is your disease and your data that he or she is interested in, not you.

Epidemiologists, or medical statisticians, watch the figures for health across the country, spotting trends. They work by trawling through information from the records of millions of people. It is epidemiologists who assess the dangers of the contraceptive pill, whether ethnic minorities have equal access to health care and whether electricity pylons cause leukaemia. It is they who work out which treatment is best for breast cancer - and whether your GP might be quietly murdering old ladies in their homes.

Because they work with whole populations, epidemiologists can see what is dangerous and what isn't, whether particular illnesses are becoming more or less common, what treatment works and what doesn't, and - in the case of surgeons - who is dangerous and who isn't. Epidemiology has helped save more lives than any of the other more glamorous branches of medicine.

Every time a doctor advises you about your health or decides how best to treat you, he or she is using the evidence provided by epidemiologists. Universal clean water and sewage facilities, and advising people not to smoke, were among their most famous ideas.

But all of this may have to come to an end. The General Medical Council (GMC) has decided that this kind of purely observational work is an infringement of patients' rights - even though it reveals nobody's identity and does nothing to alter or withold anyone's treatment.

The GMC has declared that each study should go ahead only with every patients' expressed and informed consent, and that doctors should not provide data about their patients to any other doctors without that consent. It's a nice idea: patient autonomy and patient confidentiality are crucial, and it would be wrong to dismiss them out of hand. But because such consent is often unworkable - for a host of practical and scientific reasons - the change might stop epidemiology and clinical audit in their tracks and severely impede further advances in medicine.

Ironically, epidemiologists and other doctors who use records purely for research and statistical purposes are the people in medicine who have taken confidentiality and data encryption most seriously. Anyone worried about the confidentiality of material relating to their health should be more concerned about the underpaid temporary staff working on the front desk of their local GP surgery than about a group of medical statisticians cooing over a meta-analysis of 50,000 cases of cancer. There are no scandals in epidemiology.

The problem is that the data being shared must, at some stage, include the identity of the patient. Looking at how our world-renowned national net work of cancer registries works, you can see why. For decades, 11 cancer research centres around the country have collected morsels of data on patients afflicted with cancer in their region. From the type of cancer to how they were treated, from the details of their laboratory investigations to their death certificate, all the information is collated, stored and analysed in order to improve the care of the next generation of patients.

There is a good reason that it is not possible for this information to be filed entirely anonymously, without identification of the patients attached. The cancer registry system collates data from innumerable diverse and unrelated bodies: the registrar of deaths in the town hall, the GP, the hospital pathologist. And the patient's identity is the only thing that unifies these disparate pieces of information, allowing the registry to match up tissue diagnosis with symptoms with death certificate and trace the life of one person's cancer.

But it is not as if the information is being broadcast on the nine o'clock news. This is the confidential transfer of information between doctors, which is then held with obsessive security, with the doctors being accountable to the GMC if they treat the information irresponsibly.

It is the most comprehensive national cancer database ever constructed and is the envy of the world. Every doctor in the country is expected to file data to the cancer registries on their patients. But the GMC has given a deadline of October 2001 for the cancer registries to put mechanisms in place for seeking and recording the consent of everyone on their books. Without this consent, doctors will have to stop the flow of information to them. Because this is impractical, cancer registries may have to close.

But if the GMC wants us to, why can't we just ask people for consent? Can it really be so difficult? In some circumstances it may be, and not just for practical reasons. Insisting on consent can systematically skew the data, and give answers that are weaker, or simply wrong.

If you ask people to agree to having their data used in an observational study, some will refuse. That, of course, is the reason you are asking them in the first place. And when they refuse, particularly if certain types of people are consistently more likely to refuse, such as the demented, the psychotic, the homeless, or those embarrassed by their health problems, that skews your data.

This is what medical statisticians call "consent bias". It is important because it can turn your data on its head, render it useless and give the wrong conclusions. In medicine, that costs lives.

There are unscalable practical barriers to seeking consent from the whole population. It remains a Herculean task even if, instead of considering specific cases with patients, we assume that we only want to ask everyone in the country the rather uninformative and vacuous question: "Do you consent to your data being shared, on a confidential basis, for anything we can think of?" There are 60 milion of us, after all.

How quickly can you get informed consent, and explain why you want it? Will three minutes tacked on to the first consultation with a GP be enough? A tick-box? Who will keep a central record? What about the patient with Alzheimer's who can't give consent? What if you change your mind? What if you switch GPs? What if you never go to a GP, but just pitch up in A&E one day? It is a far bigger undertaking than the census, and it is hard to imagine it ever happening.

It would be far easier to legislate to protect the work of cancer registries and other organisations concerned with epidemiology and health services research, to ensure that the confidential data they need could never be used for non-medical purposes. That would protect the public and promote new medical knowledge.

As a doctor, I don't expect patients just to tolerate the kind of work that the cancer registries and epidemiologists do: I believe they would be astonished if it weren't done. Epidemiology is the foundation on which all preventative medicine is based. Without it, much would be just anecdote and small drug trials. This move to tie its legs together can only be motivated by some unthinking adherence to an abstract philosophical doctrine about privacy. The point of the principle of confidentiality was to protect the patient from untoward disclosure of information which could be used to his or her detriment. It should not be a moral absolute, at so great a cost.

Is our adherence to principles about privacy so important that we would sagely shave months or years off our life expectancies? I'd rather have another birthday, thanks.