A drug company will require patients, unless they pay the exorbitant full price, to give up confidentiality for their medical data.

This is an illustration of why "you must get the subject's permission" is not good enough to protect privacy.