Is consent needed?

2. If the patients record has 3rd party data in it, for example a midwifes notes, this data is not owned by the GP, but could be relevant to the SAR, under GDPR is consent needed by the 3rd party to release the data?

Answers:

1. The consent is not needed if the third party which asks for the information acts to preserve public interest or the vital interest of the data subject. I don`t think that using the data in conferences qualifies. However, if the data is anonymized so it cannot be traced back to a patient then consent is not needed.
2. The data in the SAR need to be date which concerns the patient, if the midwifes notes are related to that patient the information must be provided.