Sunita Somvanshi
NHS patients in England have a specific legal right to object to their medical records being processed through the Palantir-operated Federated Data Platform — but it requires a different action than the standard NHS data opt-out most people know about. The standard opt-out does not apply here. What does apply is a formal statutory objection under GDPR Article 21, and health privacy campaigners have made filing one as straightforward as sending an email.
The NHS Federated Data Platform (FDP), operated by Palantir Technologies, is a federated platform designed to link patient records across NHS England for operational and planning purposes. 38 Degrees, the British citizen-led campaigning organisation, is running a mass legal objection campaign urging patients in England to submit formal GDPR Article 21 objections directly to NHS England. Unlike the standard National Data Opt-Out — which restricts secondary research and commercial use of patient data but does not apply to operational platforms — a statutory Article 21 objection requires NHS England to respond individually to every patient who files one and to assess individual grounds; processing must halt unless the controller can demonstrate compelling legitimate grounds that override the individual’s interests.
NHS patients who do not formally submit a statutory objection will continue to have their records processed through the Palantir-run Federated Data Platform. While the standard NHS opt-out does not cover operational platform data-sharing, filing an explicit GDPR Article 21 objection legally requires NHS England to assess individual objections and halt processing unless compelling legitimate grounds apply. This statutory route is one legal avenue available to patients seeking to limit their records’ inclusion in the platform.
What GDPR Article 21 Does That the Standard Opt-Out Cannot
A 38 Degrees campaigner explained the legal gap: “All of us have a legal right to object to how NHS England and the government use our health data. We’re launching a mass legal objection to our data being included in Palantir’s NHS database. By law, NHS England must reply to every objection, so our message will be unavoidable. But we need as many people as possible to take this action for it to work. We’ve prepped the legal wording in an email already, so all you have to do is add a quick personal note about why you object to Palantir getting its hands on your private patient data and hit send. Together, we’re going to get Palantir’s hands off our data, once and for all.”
The legal distinction matters. The standard NHS National Data Opt-Out was designed to restrict how anonymized patient data is shared for research and commercial purposes. It explicitly does not cover operational platforms — meaning a patient who opted out years ago may still have their records processed through the FDP. 38 Degrees is bypassing the opt-out portal entirely and going directly to GDPR’s objection mechanism, which applies to processing of personal data and creates an administrative obligation on the data controller to respond and justify the processing.
To exercise this right, patients need to contact NHS England directly with a written objection citing GDPR Article 21 and their personal grounds for objecting to Palantir processing their records. 38 Degrees has pre-drafted legal language to make the process accessible, requiring patients only to add a personal note explaining their objection before sending. The standard NHS opt-out portal does not accomplish the same result.
For anyone tracking UK health data privacy rights and patient data legislation, this is not a petition or awareness drive — it is a statutory mechanism that creates binding obligations on NHS England the moment a valid objection is filed.
NHS England is legally required to respond to every valid Article 21 objection received. The campaign is ongoing. No government announcement reversing the Palantir FDP contract has been made. Check back for updates as NHS England’s response timeline becomes clearer and any new developments in the campaign or the contract emerge.
