NHS threatened with legal action over £480m patient data platform

Campaigners ask if Palantir's 'must-win' contract could see tech giants build products on NHS data

Updated Campaign groups acting on behalf of doctors and patients have threatened legal action over NHS England’s procurement of a £480 million ($582 million) “federated data platform”, as questions about patient consultation and compliance with data protection law remain unanswered.

Lawyers acting on behalf of The Doctors’ Association UK, National Pensioners’ Convention, and Just Treatment have also questioned whether plans for the platform — as currently described in tender documents — could lead to tech giants such as Amazon and Google creating fitness apps to sell back to the NHS for “the public good.”

In a separate development, news outlet openDemocracy has revealed hundreds of NHS hospitals have been ordered to share patients’ confidential medical records with Palantir — the US spy-tech company which considers the FDP a “must-win” contract — under the scheme for “Faster Data Flows.”

The formal procurement for the FDP began in January. Since then, campaign groups have suggested they could take legal action over the extension of Palantir’s work on the Covid-19 data store and Faster Data Flows.

In a pre-action legal letter seen by The Register this week, lawyers acting on behalf of the campaign groups have given NHS England — the non-departmental public body which operates under the Department of Health and Social Care — two weeks to respond before they apply for a judicial review.

The campaigners challenge NHS England’s failure to publish a data protection impact assessment over the “transformational” plans for the FDP. Pointing out that health data is a “special category” of personal data recognised in the European Convention of Human Rights, the lawyers ask the government body to confirm it will publish the DPIA within two weeks.

Also challenged is the public’s right to opt out of their data being shared on the system. NHS England has said data would be anonymized or pseudonymized — a process which removes personal identifiers from the data but leaves open the possibility of re-identifying the individual at a later date via specific markers.

The legal challenge points out that the UK’s Information Commissioner’s Office has already said that pseudonymized data still counts as personal data, requiring consent before sharing. It then questions whether the current NHS data opt-out schemes are fit for the FDP since they were designed before the data platform was planned.

The letter — supported by tech justice campaigners Foxglove — also challenges how FDP “owners” will be able to approve “research projects” for the “public good,” quoting NHS England’s own documents, and allege this sidesteps the need for approval from an independent review committee.

“By way of a worked example: under the FDP, would Google or Amazon be allowed to gain access to data ‘owned’ by NHS England for the purposes of developing a fitness watch which the corporation argues is for the ‘public good’, as they believe it will improve the public’s fitness, or, at least, the fitness of the public who can afford to purchase said fitness watch,” the letter said.

The Register has contacted NHS England to offer it the opportunity to respond.

In a statement, Dr David Nicholl, consultant neurologist and representative of the Doctors Association UK, said: “The history of the NHS is littered with costly IT disasters and now, during the worst workforce crisis we have ever faced, we cannot afford another. There is far too much we don’t know about the NHS Federated Data Platform for doctors to have confidence that it will help patients – or that it will work in the ways being promised.”

He said £480 million was a very expensive gamble for a project the public and medical profession knows little about. “We’re putting these urgent questions to the government now and, with regret, we’re prepared to sue for answers if they continue to stonewall us.” ®

Updated at 16.49 UTC on March 17 2023 to add:

An NHS spokesperson sent us a statement and pointed us toward information it has published about the FDP: “NHS England has always acted in accordance with its legal responsibilities and will respond to the referenced letter in due course. This will set out our position in detail therefore it would not be appropriate to provide comment before this is issued.”