Re: FFS!
There are quite a few other legal gateways to pass PII, and indeed to be required to do so. I suspect that the DHSC has used one of these. There is a lot of data passed to NHS Digital from both GPs and secondary care under these. You can opt out of some, but not all of this through the National Data Opt Out. NHS Digital then produces a register of further disseminations of this data.
https://digital.nhs.uk/services/data-access-request-service-dars/register-of-approved-data-releases
https://digital.nhs.uk/services/data-access-request-service-dars/how-the-national-data-opt-out-affects-data-released-by-nhs-digital