Re: Let's call it the "GPDPR"
The NHS has a broad set of exemptions from the GDPR.
In any case, the GDPR doesn't always require consent to process your data. The NHS could easily claim legitimate interest to use the data for planning NHS services, or for research into cures for disease. In that case they don't need your permission, but you can object (i.e. opt out).
They might also claim it's in their "legitimate interest" to sell the data to third parties, because that would help fund the NHS, and obtaining funding is clearly in the NHS's interest. But such "legitimate interest" has to be balanced against the rights and interests of the data subject. Here, they are more likely to claim that anonymised data is not personal data.
Biting the hand that feeds IT
