Campaigners invoke UK GDPR to challenge NHS Palantir platform

Campaign group 38 Degrees has coordinated legal objections from more than 44,000 people asking NHS England to stop the Federated Data Platform (FDP), which runs on Palantir software, from sharing, storing or using their health records, the Guardian has reported.

The filings argue that Palantir's involvement undermines trust in the confidentiality of NHS data. The objectors have also asked the NHS to pause processing of their data while it considers the requests.

The objections rely on Article 21 of the UK GDPR, the right to object. Under Article 21(1), an individual may object, on grounds relating to their particular situation, to processing carried out under Article 6(1)(e) (public task) or Article 6(1)(f) (legitimate interests).

The controller must then stop processing unless it can demonstrate compelling legitimate grounds that override the individual's interests, rights and freedoms, or the processing is needed for legal claims. Article 18(1)(d) gives a right to restrict processing while the controller verifies whether its grounds override those of the data subject.

The right to object does not extend to processing carried out under Article 6(1)(c) (legal obligation). Under Article 12(3), controllers must respond within one month, extendable by two further months where requests are complex or numerous.

NHS England told the Guardian that it would respond to the objections in line with data protection law. It said NHS organisations remain in control of their data within the FDP and that suppliers cannot access it for their own purposes. Palantir said it processes patient data only on the NHS's instructions and that the data remains in the UK.

Palantir won the lead role on the £330m, seven-year contract in November 2023. The first term ends early next year, at which point the government can use a break clause or extend the deal. Campaign groups say 30 September was the contractual deadline for Palantir to provide NHS England with an exit plan. Two House of Commons select committees have urged the government to use the break clause.

The Chief Data and Analytics Officers Network, which represents senior NHS data staff, has also written to the government urging it to consider the break clause, saying the platform had not shown the evidence and realised value expected after sustained investment. A health minister warned in September that mistrust of Palantir is leading patients to opt out of NHS data sharing.