What is a 'GP report' (Subject Access Report) in the context of insurance underwriting, and under which legislation is consent required?