Eerke Boiten, De Montfort University

Palantir, a US data analytics company backed in its early years by In-Q-Tel, now plays a central role in the NHS’s £330 million Federated Data Platform. Supporters say it could improve planning and efficiency, while critics have raised questions about governance, transparency and trust. Here’s what you need to know.

1. What is Palantir and what does it do?

Palantir is a large American technology company, specialising in storing large data collections and providing tools to manage the data, in particular artificial intelligence (AI) to ask questions of it. It provides decision-making platforms, such as Foundry, which government organisations and businesses use to uncover patterns, manage operations, and support planning and decision-making.

The company’s chairman, Peter Thiel, is known for his controversial views. At the Oxford Union in 2023, he said that the NHS makes people ill and should be privatised.

2. Why is a private American company involved in managing NHS medical records?

That’s not how Palantir views it. It sees itself as providing a platform on which the NHS can store and analyse NHS medical records. And that wouldn’t be exceptional. A large amount of data from across society is stored on cloud platforms provided by American companies.

Some of the discussion is about whether Palantir is really less trustworthy than, say, Microsoft, Google or Amazon.

3. Who gave Palantir this contract, and was it put out to open tender?

The governments of Boris Johnson (2020) and Rishi Sunak (2023) awarded Palantir the contracts.

Palantir had been lobbying to get access to NHS data for a while when it offered to build a COVID data store for £1 in early 2020; there was no open competition under emergency COVID procurement rules. The data store combined patient-level data from many sources, as well as operational data from hospitals and other sources.

The initial three-month contract was only made public under legal pressure, and the deal was then renewed for £23 million, again without evidence of competition.

The latest version of this deal, the Federated Data Platform, was awarded competitively in December 2023 to a Palantir-led consortium. Having had the deal previously will have been a big advantage for Palantir – a phenomenon known as “vendor lock-in”.

4. Can Palantir use my data for its own commercial purposes or share it with the US government?

Palantir’s role is as a “data processor”, which means it is not legally allowed to make its own decisions about what to do with the data – only the “data controllers” (NHS organisations) can.

There is some grey area on what Palantir is allowed to do with the data that is “necessary to provide products or services … under the Agreement”. It has been claimed that this includes using NHS data for AI models, but the original contract does not really suggest this. Unhelpfully, in the publicly available version of the latest contract, nearly all the data protection text (three pages) is redacted.

So it is not legally allowed to use NHS data for their own purposes. And although UK regulators, such as the Information Commissioner’s Office, have oversight powers, some critics question how effectively large multinational technology providers can be audited in practice.

Trust plays an important role, particularly at a time when we have seen US government appropriating databases relating, for example, to health, mobile phone location and car number plates, for immigration enforcement. Under the US Cloud Act, American authorities can, under certain legal conditions, request data from US-based companies, which has raised concerns among privacy advocates about potential cross-border access.

5. What is the Federated Data Platform, and what is it supposed to do for the NHS?

There has long been an NHS England ambition to have a central place to store “all” NHS data. The core of this was effectively realised quickly during COVID, under special legislation, in two forms with slightly different targets.

The first was the NHS COVID-19 Data Store, which has grown into the Federated Data Platform, and is targeted more towards planning. The second is OpenSafely, which provides research access to unified NHS datasets using strong privacy protections.

6. Has the system improved NHS care, and is the taxpayer getting value for money?

The UK government has already made claims of significant improvements due to Palantir. But researchers have raised doubts both about the research methods used to quantify such successes and about the personal connections of the people involved in these.

7. What is Palantir’s track record — who else does it work for, and should that concern me?

Palantir was initially funded by In-Q-Tel, the non-profit venture capital arm of the CIA, and has been working with US Immigration and Customs Enforcement (ICE), which has been criticised by civil liberties groups.

It works with several other UK government organisations, including the army. The Israeli army reportedly used Palantir for AI-based targeting in the war in Gaza, which is a main reason Amnesty International campaigned against Palantir within the NHS.

8. Can I opt my data out? If so, how?

You can opt out of your GP practice sharing your health data, or separately out of NHS England and others sharing it for research and planning.

Unfortunately, this would affect beneficial uses of your health data too, including by making the overall dataset less comprehensive and representative. This is part of why the medical community worries about the Palantir effect.

9. Why are so many doctors, nurses and campaigners opposed to this — and should I be worried too?

There is a wide range of concerns. Palantir’s political positioning, including opposing the NHS in its current form, as well as the more controversial political views expressed by some of its leaders, means many people don’t trust it with their health data.

There is a technological concern over concentrating NHS data processing with a single supplier, possibly replacing working solutions with inferior ones. For some people, Palantir’s activity with ICE and allegedly in Gaza makes them morally unacceptable.

10. Could the government cancel the contract, and what would happen to the data Palantir already holds if it did?

There is a break clause in the current contract coming up, so yes, it can. The contract says Palantir needs to lose all access to the data when the contract ends.

Responding to Conservative MP Wendy Morton’s call for more scrutiny of Palantir’s ability to protect data, Louis Mosley, Palantir UK’s executive vice-chair, told the BBC that he welcomed scrutiny and was confident the firm was delivering value for money for NHS patients.

Mosley went on to say that Palantir has no interest in patient data in the UK. “It’s not our business model,” he said. “It’s not the legal basis on which we operate, in the same way that Microsoft Excel or Microsoft Word or email is used in the NHS and again that is NHS data, Microsoft doesn’t have access to it, nor do we to NHS data.”

Eerke Boiten, Professor of Cybersecurity, Head of School of Computer Science and Informatics, De Montfort University

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Being Assassinated in Your Home by a Killer Robot Sent by a Fascist State Is No Longer Science Fiction