What could possibly go wrong?

Imagine if one of the household-name social media networks or search engines was found to be planning to exploit their entire consumer data set in a new way, but it was not announced, was vague about the details, and the only way to opt-out was to print and sign a paper form (that no one knows about) and send it to a local office? I suspect there would be a dramatic regulatory intervention (more colourful language comes to mind). 

But, as reported in the FT article below, that appears to be what the UK's National Health Service is planning. And even if the reporting isn't fully accurate, that is because the plans are not transparent. This should be seen as a cautionary tale for any business with a large customer dataset. Planning your strategy to monetise data starts with privacy by design and building trust.