Private firms will soon be able to buy people's medical and genetic data without their consent and, in certain cases, acquire personal information that might enable them to identify individuals.

The revelation, which contradicts government claims that such material would be completely anonymous, has raised fears that pharmaceutical firms and insurance companies will be able to determine the identities of people susceptible to particular diseases. It has prompted claims that fundamental changes to the use of NHS patient data are being introduced without adequate public debate or regulatory oversight.

The government is keen for Britain to be at the forefront of the genetic revolution, a potential multibillion-pound industry. Last year David Cameron launched a £100m scheme to map the genomes of up to 100,000 people, saying it would help to save lives by delivering new treatments. The move was seen as the first step in the construction of a national human genome database.

Under the scheme, firms would be able to access the information at a cost, but ministers insist that all data will be strictly anonymous. However, material released under the Freedom of Information Act reveals that firms can invoke an appeal process to demand "patient-identifiable data", such as age and postcode.

"Without a semblance of transparency, a national genetic database, connected to personal medical records and made available to the private sector, has been set up. Privacy laws have been redefined and our own genomic information is being commercialised," said Edward Hockings, a bioethicist from the pressure group Ethics and Genetics, who made the FOI requests.

In a response to Hockings, the Department of Health confirmed: "While most researchers will only want access to effectively anonymised data, legal authority to access identifiable information may be provided through the consent of the citizens concerned or through legislation, such as section 251 of the NHS Act 2006."

The department explained that section 251 approval can be granted "where consent cannot be obtained". It said: "There are circumstances where it is very difficult to contact patients to seek their consent, or where it is vital that the data is identifiable."

The threshold for what is considered "vital" is likely to be crucial in determining how easy it will be for people to protect their genetic data from being shared with third parties. Section 251 applications are currently granted around once a week to private companies and other organisations seeking NHS data. But Hockings predicted they would become significantly more frequent once the database had been built. He warned that companies could easily establish identities from the information obtained.

"People should decide for themselves if there is a clear medical advantage, individual benefit or public good in handing over our entire genome for purposes far beyond our knowledge," he said.

People will be able to request that their genetic data is not shared. However, under proposals being studied by government they will be told only that they have the right to request that their confidential data is not used beyond their own care. The proposals explain that when their "wishes cannot be followed" they can expect to be told why.

Dr Helen Wallace, director of GeneWatch, which is critical of the plans to build the database, accused ministers of being "desperate". "Building a DNA database of the whole population is an enormous waste of money and will lead to commercial exploitation of the vulnerable," she said.

"Stealing genetic and medical information without consent is unethical and dangerous, allowing every individual to be tracked and their relatives to be identified."However, the chief medical officer, Professor Dame Sally Davies, said that understanding and harnessing genetic information offered "huge potential" to target effective treatments and develop cures. "The privacy and confidentiality of NHS patients will be paramount at every stage of fulfilling the government's commitment to sequence 100,000 whole genomes," she said.

A government-commissioned review looking into how best to balance people's desire for their information to remain confidential with the benefits of sharing it with third parties will report later this year.