Private firms will soon be able to buy people‘s medical and genetic data without their consent and, in certain cases, acquire personal information that might enable them to identify individuals