Re: GDPR
Depends on the grounds, they might be claiming "public task" etc
Health data is rarely covered by consent in the UK as it would open the door to people having the right to delete - resulting in millions of additional test each year as people request their medical record is erased (we still have people asking for this anyway).
NHS Digital only ruins, sorry runs NHS England though as far as I'm aware so guess NI, Wales and Scotland held data won't be included as a result.
I do wonder if people who have visited from abroad and had to use a GP will be included though.. probably shouldn't be