It is not the UK version of the GDPR, the UK version of the GDPR is the GDPR and it will be at least until after Brexit.is correct though, although probably only applicable in the UK, that MFC would've had an obligation to disclose under the UK version of GDPR, but also something known as a Norwich Pharmacal Order, which is basically a court order requiring an innocent 3rd party to disclose information. Despite the criticisms here, I would've gone through with this.
If any model gets threatened with the GDPR know that it can not be used to obtain personal information in this manner and anyone claiming that it can be is either knowingly lying or doesn't know what they are talking about.