Re: "Opt Out"?
"Not legally required, not necessarily in legitimate interests, the vast majority is not vital interests, not public task (because this isn't a public task) and not necessary to fulfil contract."
Just because you say so doesn't make it so. In NHS land, this class of data processing is generally called "secondary purposes". This class of data processing is facilitated in two ways. One is explicit authorisation through an act of parliament. A good example of this is handing over your records to the Care Quality Commission on demand.
The second way, which this is, is generally called "Section 251", after the relevant bit of the NHS Act. Which says:
"The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient"
Now there is a later clause preventing this from being used to trump the DPA (presumably implicitly amended to include GDPR), but what this means in practise is the Health Secretary has the effective power to define what constitutes legitimate interests and public tasks. You have a right to object, but the NHS has a right to ignore your objection. In the case of these programs, your right to object is manifested as the "national data opt-out". You might not like that (I certainly don't), but that's the actual law.
You will struggle to find anyone to take you seriously if you're going to argue that national programmes of cancer research are not in the public interest.
Biting the hand that feeds IT
