[motohagiography]

Depends on what jurisdiction, and if you are familiar with privacy law in different regions, the exceptions to that are often sweeping, with the additional issue in some systems that regulations can be made by lower level authorities without the same level of public scrutiny or debate.

It's the wild west for data, and privacy people have done what they could over the last 20 years, but the tech has accelerated so much in the last 10 that those prior assurances aren't what we think they are.

[antxxxx]

All health and social care organizations in England must comply with this by September 2021 (delayed from original date due to the pandemic). This was based on a recommendation from the previous National Data Guardian.

Scotland, Wales and Northern Ireland have different policies.

[motohagiography]

Massive data sets were mobilized for covid-19, and I advise anyone politically exposed that it would be unwise to consider their health records a secure secret, and to challenge the security controls on any private electronic information.

If you really have a privacy risk, you already know how to avoid these issues, but everyone should understand and always assert their privacy rights, because there are a lot of parties interested in taking them.