[L0stRegulator]

There are a lot of derogations in GDPR. These could easily cover the current case in point (and the sharing of data with the UK NHS etc)

"The GDPR provides several exemptions and derogations for the use of health data, e.g. in the context of research or public health purposes under certain conditions. Typical procedures in this context include the application of ethical standards for scientific research as mentioned in Recital 33 and the implementation of organisational and technical safeguards as mentioned in Article 89 including anonymisation, pseudonymisation and encryption [2]. Pseudonymisation is generally recommended as long as the research purposes can be fulfilled in this manner. With the condition of such safeguards, the GDPR creates exemptions for researchers to process sensitive health data even beyond the purposes for which they were collected. "

from https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5438318/