My issue with it is central data repositories create a kind of secret surveillance para-bureaucracy with no individual accountability.
What is frustrating is efforts like this are trying to squeeze the toothpaste out of the tube, and I suspect before current techs we have today like differntial privacy and tokenization make anonymous sharing and analysis viable. Medical researchers are people like anyone, they aren't some kind of preisthood, and they are going to leak and share the data and use it for political purposes as their opportunities and incentives change.
The technical controls researchers actively resist are basic corporate controls as simple as identifying everyone who logs in to view the datasets with their real names, background checks on people with admin credentials on personal health databases, probabilistic watermarking and dating cuts of datasets shared with researchers so that any leaks can be traced back to a specific accountable people to contain it, and requiring a public record and accounting of the research and projects they were using the data for, using synthesized data in technical test environments and not real health information. These are basic corporate controls that aren't part of the research culture. Some places may have them, but I wouldn't be surprised if the organizations conspire to neglect their processes.
The benefits they say are for using ML for research and it will cure all manner of diseases and detect others early. This sounds great, but what is missing are legal consequences for exploiting people via their data. People aren't managed livestock, so the prestige of a few researchers needs to be balanced with the quality of the society these new data powers create. If your worst political enemy is an exception to the principle of the confidentiality of this data, then you aren't suited to access it, and to be allowed to do so compromises the whole system for everyone.
A test people could use for privacy is whether you would be ok with the activist groups operating in universities, communist party of china, and their federal police force having secret legal access to health records, and if they aren't, what rules do we need to compensate?
Inadmissability of data in any of these data sets in legal proceedings seems like one useful control. Personal penalties for abuse and leaking of this data would be another. Licensing and professional regulation of individuals who administer systems that process personal information that has been obtained without explicit consent of individual data subjects seems complex, but I could see some version of it happening in the next 20 years.
Without these additional controls, it's just a data grab, and these GP's are right and in fact brave to resist it.