[ray991]

The opt-out form [0] asks only for the name, phone number, DOB, address, email, etc. How do they ensure that someone else did not opt-out or opt-in on someone else’s behalf without their permission? And how are they deduplicating people with the same name and DOB? By a fuzzy match against their address? How do these things usually work in UK?

[0]: https://www.organdonation.nhs.uk/register-your-decision/refu...?

[SXX]

It's just a guess for this exact case, but UK government do have some access to credit history and this usually mean name plus dob plus address. And it's can use electoral roll databases for actual citizens.