The investigation by the Information Commissioner's Office found that many patients did not know their data was being used as part of a test.