Yes, that is probably the relevant national law for NHS Digital itself. Then presumably they're relying on GDPR points 9(2)(h) and 9(2)(i) with reference to th

Yes, that is probably the relevant national law for NHS Digital itself. Then presumably they're relying on GDPR points 9(2)(h) and 9(2)(i) with reference to that national law to argue that the default prohibition on processing health data in paragraph 9(1) doesn't apply. And then they've got public interest/official authority under 6(1)(e), or perhaps compliance with a legal obligation under 6(1)(c), as a lawful basis. But all of that just means the processing wasn't automatically prohibited under the GDPR. All the normal rules including the principles set out in Article 5 still apply as well, and those principles include purpose limitation, data minimisation, storage limitation, and integrity and confidentiality. There are also some specific obligations around professional secrecy under Article 9 because it's health data. Given the extremely broad scope of the intended data lake here, the ambiguity about who might end up with access to it, and the extremely sensitive nature of the data, I don't think I'd want to be the one defending NHS Digital when the seemingly inevitable ICO investigation comes.