Info Gov

The Commons Science, Innovation and Technology Committee has said that going ahead with the digital ID rollout would be "irresponsible" until the public sector's over-reliance on a small number of suppliers is addressed.

The committee called on the government to exercise the 2027 break clause in the NHS Federated Data Platform contract with Palantir, warning that the US firm's expanding footprint across the UK public sector represents an unacceptable point of weakness.

The cross-party committee's report, published on 3 June 2026 following its Digital Centre of Government inquiry, identifies Palantir as the most concerning example of the public sector's growing reliance on a small cluster of major technology providers, alongside Microsoft and Amazon Web Services. It stressed that Palantir is not the only company capable of supplying the "middleware" that public bodies require.

The committee recommended that the government should trigger the break clause in the NHS Federated Data Platform contract - awarded to Palantir in 2023 for seven years and reported to be worth £330 million - when it becomes available in 2027, and either build an in-house replacement or procure an alternative UK provider.

Reuters reported that Palantir and its partners have secured some $750 million in UK government contracts since 2020, spanning the NHS and the Ministry of Defence, and that the 70-page report found the company had expanded its presence despite what MPs described as a clear mismatch with UK values.

The MPs’ report argued that vendor lock-in should not be treated as inevitable, and calls for a cross-public-sector strategy to end it, diversify suppliers and strengthen digital resilience.

Dependence on a handful of US-based providers, the committee warns, leaves the government's ambitions to digitally transform public services potentially at the mercy of foreign actors.

MPs want greater clarity over the government's definition of technological sovereignty and a strategy to deliver it, identifying where the UK needs sovereign capabilities and supporting domestic alternatives in critical sectors.

The report highlighted what it calls serious “data hygiene” deficiencies across the public sector, which it says can only be overcome through cultural transformation.

It calls for a dedicated strategy, anchored in explicit recognition that public bodies hold citizens' data on trust and must therefore meet the highest standards.

Public trust and consent are fundamental to digital transformation, the report argued, and a failure to protect citizens' data held or processed for digital ID would have far-reaching consequences.

The committee also said that the government has yet to set out what becoming a "digital state" means in practice. There is no clear delivery plan, the digital roadmap lacks metrics for assessing progress, and delivery has been "hamstrung" by disruption flowing from the Government Digital Service's move into the Department for Science, Innovation and Technology.

The report's structural recommendations included a Cabinet-level minister to drive cross-government digital transformation, an urgent review of GDS's remit, and a permanent secretary-level Government Chief Digital Officer.

Committee chair Dame Chi Onwurah MP said the government's digital state ambitions were welcome but risked falling short without a detailed and measurable plan, and that ministers must prioritise raising standards of data hygiene to build trust.

Reducing dependence on big US tech companies like Palantir should be a critical part of the transformation, she said, with the UK pursuing technology sovereignty in critical parts of the public sector and supporting domestic alternatives through smarter procurement. Only once the digital foundations are secure and public trust gained should the government proceed with digital ID, a project she described as a defining test of its wider ambitions.

The committee's recommendations are not binding, and it now falls to the government to respond.

The report is available at: https://publications.parliament.uk/pa/cm5902/cmselect/cmsctech/61/report.html

The committee's announcement is at: https://committees.parliament.uk/committee/135/science-innovation-and-technology-committee/news/214048/mps-warn-that-palantirs-increasing-presence-in-the-uk-public-sector-is-an-unacceptable-point-of-weakness/

This article first appeared on InfoGov, Local Government Lawyer's new site for public sector information governance professionals, www.info-gov.uk.

Also in this section

Sep 11, 2026

Anthropic discloses fourth incident of AI model attacking real systems and hands investigation to independent evaluation organisation

Anthropic has published details of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations, downloading and modifying user records at a real company, reading the personal information of an individual, harvesting credentials and accessing a security vendor's live database, after the test environments were mistakenly…
Sep 10, 2026

Welsh environmental watchdog hit by data breach

Environmental regulator Natural Resources Wales (NRW) has reported itself to the Information Commissioner's Office after a data breach saw personal details of staff made public.
Aug 24, 2026

Ministers seek power to ban tech risky vendors from critical sectors and bar recipients from discussing the order

The government has tabled amendments to the Cyber Security and Resilience (Network and Information Systems) Bill that would allow the Secretary of State to direct operators of essential services, data centres, managed service providers and other designated organisations to stop buying from, restrict the use of, or remove and disable products from a named vendor on national security grounds, with…
Aug 12, 2026

ACRO Criminal Records Office reprimanded by ICO following cyber security failings

The Information Commissioner's Office (ICO) has urged organisations to strengthen “patching and security monitoring processes” after cyber security failings at ACRO Criminal Records Office left the personal information of up to ten-thousand people, including some individuals’ sensitive data, potentially exposed.
Aug 06, 2026

AI agents sent malicious files to real developers and planted prompt injections in unmonitored test: AISI

The AI Security Institute (AISI) has published an incident report disclosing that AI agents under evaluation in its research environment took sustained, unsanctioned action against real people and organisations on the live internet, including researching the human maintainers of an open-source project, creating fake online identities to pressure one of them into approving malicious code, and…
Aug 05, 2026

Third AI platform goes rogue during cyber testing

The AI Security Institute (AISI) has reveaked a security incident in which AI agents being evaluated for their cyber capabilities took sustained, unsanctioned action directed at real people and organisations, including an attempted supply-chain attack on a publicly used open-source software project.

InfoGov Masthead Newsletter 800