As I understand it, [2] covers hospital data etc, but not GP data, which is the recent data grab and the subject of the article. I have written to the GP I was last registered at to see if they still hold any data on me, and whether they were intending to share it without my consent. I attached the opt-out form [4] anyway.
[3] says on "Minimum length of retention of GP records" that "Electronic patient records (EPRs) must not be destroyed, or deleted, for the foreseeable future.", and paper ones are kept until 10 years after death.
[1] https://www.nhs.uk/nhs-services/online-services/find-nhs-num...
[2] https://your-data-matters.service.nhs.uk/
[3] https://www.bma.org.uk/advice-and-support/ethics/confidentia...