Category: Cyber Security | Published: 2026-10-13
NHS Health records contain some of the most personal information we share with any organisation. When a new system brings that information together, people understandably want to know who controls it, what it will be used for and whether they have a choice.
More than 44,000 people have submitted legal objections asking NHS England to stop its Federated Data Platform handling their personal information. The action, coordinated by the not-for-profit campaign organisation 38 Degrees, puts patient rights and confidence in technology suppliers under scrutiny.
There is an important distinction here. These are objections to how information is processed, not evidence of a confirmed leak of medical records. Nor does submitting a request mean that the person's information has already been removed from the platform.
The campaign asks NHS England to stop sharing, storing or using participants' personal information through the Federated Data Platform. People have also requested restrictions on processing while their objections are assessed.
Much of the concern centres on Palantir, the US software company co-founded by Peter Thiel. Palantir leads the consortium supplying the platform, and campaigners oppose its involvement because of its work with the Israeli military and US immigration enforcement.
For those taking part, the supplier's wider relationships affect whether they feel comfortable with its role in handling sensitive health information. That is a question about trust and supplier choice, even where contractual safeguards exist.
However, those concerns do not establish that NHS records have been shared with the Israeli military or US immigration authorities. It is important not to turn objections about a supplier's activities into an unsupported claim about where patient data has gone.
The Federated Data Platform, usually shortened to FDP, connects information held in separate NHS systems. Its purpose is to help staff coordinate practical tasks such as operation schedules, waiting lists and hospital discharges.
Consider a patient who is medically ready to leave hospital but still needs follow-up arrangements. A joined-up view could help staff understand what is outstanding without repeatedly calling different teams or comparing separate spreadsheets.
That is the operational case for the platform: give NHS staff a clearer picture so they can organise services more effectively. It does not remove the need to explain how the information is protected or why each use is justified.
There are national and local versions of the FDP. Participating NHS organisations are responsible for the information they process, which becomes especially important when considering the scope of an individual objection.
NHS England says suppliers work under NHS instructions and cannot use the information for their own purposes. That includes developing their own AI models.
Its published explanation of the contract also says data must be stored, processed and accessed within the UK.
These are meaningful safeguards. They address concerns about control, location and uses outside the agreed service. They should not, however, be confused with a guarantee that everyone will accept the supplier or feel satisfied by the arrangements.
When information is as sensitive as medical records, people may want to understand both the security measures and the decision to appoint a particular company. Answering one question does not automatically resolve the other.
The campaign relies on Article 21 of the UK General Data Protection Regulation. This gives people a right to object to certain uses of their personal information, including processing based on public tasks or legitimate interests.
In these circumstances, the right is not unconditional. An individual must give reasons relating to their particular situation. An organisation may continue processing if it can demonstrate compelling legitimate grounds that override the individual's interests, rights and freedoms.
The ICO's guidance on the right to object explains that organisations normally have one calendar month to respond. Where a request is refused, they should explain the decision and the person's complaint rights. Extensions can apply in certain circumstances.
People can also request a restriction on processing while the organisation checks whether its grounds override their objection.
The practical point is that a submitted objection needs consideration. It is not proof that the requested restriction has already been applied, that the objection will succeed or that all copies of someone's medical history will be deleted.
38 Degrees acknowledges that NHS England may reject the requests. The campaign sees value in demonstrating the strength of opposition even if participants do not obtain the outcome they want.
There is also a limit to what the action covers. It targets NHS England's national version of the FDP. Even if a request is accepted, local NHS organisations could still process the person's information in their own versions.
This means a national objection should not be presented as a switch that prevents every NHS organisation from using a patient's information. The organisation receiving the request and the processing being challenged both matter.
The National Data Opt-Out is a separate choice concerning certain uses of confidential patient information beyond someone's own care, such as research and planning.
Taking part in the 38 Degrees campaign does not register that opt-out. Equally, the two processes should not be treated as interchangeable ways of achieving exactly the same result.
Anyone considering their choices should check the current official guidance and the scope of each route. Neither should be described as a universal instruction to stop all use of NHS health records, including information needed for care.
The objections arrive ahead of a 2027 break point in the FDP contract. The agreement was awarded in November 2023 and provides for up to £330 million of investment over seven years. That figure is a provision for investment, not a claim that the full amount has already been spent.
Two parliamentary committees have urged the government to seek an alternative. Decisions about the platform therefore involve more than its technical features: cost, public confidence, performance and the practical implications of changing supplier all matter.
Participating NHS trusts have reported improvements, but NHS England acknowledges that its figures do not establish how much improvement came from the FDP rather than other changes.
An improvement after new software is introduced can be encouraging. It is not, on its own, proof that the software caused it. Stronger evidence helps decision-makers judge whether a system offers value and whether a replacement would be worthwhile.
Most businesses do not manage information on the scale of the NHS, but many hold sensitive customer, employee or client details. The same basic questions can arise when a new cloud service or technology supplier is introduced.
Start with a clear account of responsibility. Who decides how the information is used? Which suppliers can access it? Where is it processed, and what secondary uses are prohibited? Explain this before concerns become complaints.
Supplier assessment should also consider trust. Security controls and contractual terms are essential, but customers may question a supplier's wider activities. A business needs a reasoned answer, not an assumption that nobody will ask.
Make data protection requests manageable in practice. Staff should recognise an objection and know where to send it. The responsible team needs an accurate understanding of systems and suppliers so it can assess the request and implement an appropriate restriction when required.
Finally, measure the benefits of technology honestly. Define what success looks like, review the evidence and retain credible options if the service no longer meets the organisation's needs. A system should not become impossible to question simply because it is already in use.
The debate about NHS Health records brings together several separate issues: useful service coordination, patient rights, supplier confidence and evidence of value. None can be settled simply by pointing to a security feature or a campaign's headline number.
For patients, understanding the scope of an objection is just as important as knowing that the right exists. For organisations, responsible handling of sensitive information means explaining decisions, responding properly to requests and demonstrating that safeguards work in practice.
If your business needs help protecting confidential information across devices, cloud systems and technology suppliers, our Cyber Security Services page explains how we can help.