The information isn't anonymised at source, it will be extracted with patient identifiers in order to link to HES data. This is done by the HSCIC. After linkage, all the identifiers are removed and replaced by one unique number which can only be traced back to a particular patient by the GP practice. Absolutely no-one else ever has access to the real identifiers. If they are stored (which, to be honest I have no idea about) then they will be stored by the HSCIC - which is an NHS body and works under the NHS code of confidentiality and all the other laws governing information security. All the employees of the HSCIC are also NHS staff - as are the majority of researchers who access this data.
Most of the data that is released will be anonymised and aggregated as this is what is needed for commissioning purposes. It's not in the commissioners interests to have patient level information as they are interested solely in population level.
The HSCIC do charge for the services that they provide. But then, if they didn't and if the money was coming out of the standard pot of money for the NHS, then people would complain about that.
NHS staff undergo rigorous information governance training with updates every year. All frontline, admin, managerial and auxillary staff have to have this training. Every single encounter with patient identifiable data is recorded and an audit trail kept. If it is found that someone is accessing data that they are not required/allowed to do then they lose their job. No second chances. NHS organisations who do not look after patient data properly are liable to 6-figure fines from the ICO.
In research, no patient information is ever given out to a researcher until or unless the patient has given informed consent. That is the fundamental rule of research. Also, each time the patient may present for an appointment or whatever as part of the trial, they are asked if they wish to continue being part of it. This is part of the GCP rules that everyone involved in clinical trials have to abide by. It is the law.
What I'm trying to say is that every single safeguard that can be made to protect a person's identifiable data is made every single day in the NHS. I understand why people don't trust the government (who would?) and I am also aware that there are breaches that make the national press - but what doesn't make the national press are all the times that data transfers, linkages, extractions are done and no patient data is lost/stolen/whatever. The latter is a much higher number than the former.
I admit that the communications about care.data have been useless and have failed to convey the message that they were supposed to have. They have also been misleading in that an organisation (CPRD - part of the MHRA and therefore DH) that has a long track record in safely handling data has been tarnished by inappropriate association with care.data. As an NHS researcher based both at a University and in a GP surgery, I have no control over the communications that DH make.