Earlier quoted context omitted.
The main page, http://www.hscic.gov.uk/dles , states > The data we supply is normally pseudonymised. We only provide identifiable data when there is a lawful basis to do so i.e. with patient consent, approval under section 251 of the NHS Act 2006 which enables The Health Service (Control of Patient Information) Regulations 2002, or where appropriate statutory regulation is in place. This "About Section 251" page, htt…
"... or where appropriate statutory regulation is in place" You do know that means civil servants have written a statutory order, it has been signed by the minister (might have to be Secretary of State) and it has been placed in Parliament for a week (no vote required). [Exact details may be wrong but that is the overall concept of statutory orders]. My comment is based on a general understanding of statutory orders/…
Reading on Wikipedia, "Statutary orders" and "statuatory instruments" seems to be particular ways of delegating law-making power from parliament. I don't think they are directly relevant here (since there has to be some enabling legislation)? But the section 251 thing already allows the Secretary of State for Health to disclose data, so if you are worried about ministers operating without parliamentary oversight, that is indeed possible....