GDPR does not change the information that can be given to union health and safety representatives. Both the SRSCR and the Data Protection Act 1998 already restricted personal information being given out, which is why employers had to anonymise it or get the permission of the individual. The 1998 Act has since been replaced by the Data Protection Act 2018, which implements the UK GDPR. The TUC also pointed out that the official accident report form published by The Stationery Office has a box asking the person to consent to the information going to the safety representative.