The United Kingdom is granting Palantir Technologies expansive access to National Health Service patient records under a new data-sharing agreement that privacy advocates warn creates unprecedented surveillance risks over the medical information of millions of Britons.
According to Digital Health, the arrangement provides the U.S. defense contractor—known primarily for intelligence and military applications—with what sources describe as "unlimited access" to patient data across NHS trusts. The deal, finalized after months of negotiation, represents one of the most expansive public-private health data partnerships in European history.
The timing is striking. As Brussels moves this week to restrict American technology companies from handling sensitive European government data, London is doing precisely the opposite—embracing a Silicon Valley firm with deep ties to U.S. intelligence agencies and granting it access to the health records of a population roughly equivalent to France's.
This divergence illustrates the widening gulf between post-Brexit Britain and continental Europe on fundamental questions of data governance, sovereignty, and the role of American technology in critical national infrastructure. Where EU member states increasingly view U.S. tech access as a security liability, Britain sees an innovation opportunity.
Government officials justify the Palantir arrangement in terms of efficiency and modernization. The NHS, chronically underfunded and administratively fragmented, generates vast quantities of patient data across disparate systems that don't communicate effectively. Palantir's platform, officials argue, can integrate these siloed datasets, enabling better resource allocation, treatment outcomes, and operational efficiency.
"The NHS needs modern data infrastructure," a Department of Health spokesperson said in a statement. "This partnership will help us deliver better care for patients while maintaining strict privacy protections."
Yet privacy advocates question whether any safeguards can adequately protect patient information once aggregated in a centralized system controlled by a foreign corporation subject to U.S. jurisdiction. Under American law, including the CLOUD Act and various national security authorities, U.S. companies can be compelled to provide data to American intelligence agencies—even when that data concerns non-U.S. citizens stored on foreign servers.
"This isn't about improving healthcare," said Silkie Carlo, director of Big Brother Watch, a British privacy advocacy group. "This is about handing the most intimate details of British citizens' lives to a company built for surveillance. Once this data is in Palantir's systems, we have no meaningful control over who accesses it or how it's used."
The controversy extends beyond abstract privacy concerns to concrete questions about Palantir's track record. The company, founded by Peter Thiel and named after the all-seeing orbs in The Lord of the Rings, built its business model on contracts with the U.S. Department of Defense, immigration enforcement agencies, and intelligence services. Its software has been used to track undocumented immigrants, analyze intelligence data, and support military targeting operations.
Critics argue that a company designed to serve surveillance and enforcement functions is fundamentally unsuited to managing healthcare data, where trust and confidentiality form the foundation of the doctor-patient relationship. They note that NHS patients were not consulted about the arrangement and have no meaningful ability to opt out.
The deal also raises questions about the long-term trajectory of NHS data governance. To understand today's headlines, we must look at yesterday's decisions. Britain has experimented with various public-private health data partnerships over the past decade, including the now-defunct care.data program that collapsed amid privacy concerns in 2016. The current Palantir arrangement represents a far more expansive version of that earlier initiative.
Once patient records are integrated into Palantir's platform and clinical decisions begin depending on its analytical outputs, extricating the NHS from this dependency becomes progressively more difficult. This dynamic—sometimes called "lock-in"—gives the private contractor increasing leverage over future contract negotiations and system design decisions.
For Palantir, the NHS contract represents both commercial value and strategic validation. If the company can demonstrate success managing health data for one of the world's most recognized public healthcare systems, it positions itself for similar contracts with other governments seeking to modernize health infrastructure.
The United States government, meanwhile, gains indirect access to population-level health data from a close ally—information potentially valuable for everything from epidemiological research to intelligence analysis. While no evidence suggests such access is explicitly part of the arrangement, the structural vulnerability exists.
The British government insists robust safeguards will protect patient privacy, including contractual limitations on data use, access controls, and oversight mechanisms. Whether these paper protections prove meaningful in practice—particularly when tested against U.S. national security demands or Palantir's corporate interests—remains to be seen.
As Europe and Britain pursue divergent paths on digital sovereignty, the NHS-Palantir arrangement serves as a natural experiment in the risks and benefits of embracing versus restricting American technology access to sensitive government functions. The results will likely influence similar debates in capitals worldwide.
