Re: Let's call it the "GPDPR"
My guess is - they don't care. If it did fall foul of GDPR, then worse-case, the NHS will be fined for leaking data, but that won't affect all the companies that hope to access the data... i.e the same companies that all the people concerned likely have shares in or are on the boards of.
Biting the hand that feeds IT
