I think the opt out process is the same as the one that came to prominence in the care.data days. It is not a very good process since it is opt out not opt in, and reliant on motivated people searching for a form.

On the other hand I like opensafely's approach to security: no individual data is ever shared with researchers.