44,000 people, one legal right, the same few weeks
How a coordinated wave of data protection objections turned public unease about the NHS's Palantir contract into something NHS England is legally obliged to answer — one person at a time.
What happened
The NHS in England runs a Federated Data Platform: a system that joins up hospital data on everything from operating theatre schedules to discharge planning. It is built on technology from the US company Palantir, under a seven-year contract worth around £330m.
Opposition to the contract had been building for a while, much of it about Palantir's work for the Israeli military and for US immigration enforcement. Hundreds of thousands of people had signed petitions asking the government to cancel the deal, and two Commons select committees had called on ministers to use the contract's break clause, which becomes available in February 2027.
Petitions can be noted and set aside. So the campaign group 38 Degrees organised something that could not be: more than 44,000 people each filed a formal objection, under Article 21 of the UK GDPR, to their own health data being stored in, shared with or used by the platform. Each asked, too, for processing of their data to be paused while the objection was considered.
On the same day the numbers were reported, Amnesty International and the patient group Just Treatment parked a van outside Palantir's London office, dressed as a damaged Palestinian ambulance. Different audience, same week.
Reported by the Guardian, 30 September 2026 ↗. Figures are as reported on that date.
Why it works
Set aside what you think of Palantir. The method is the lesson, and it would work just as well for a cause you oppose — which is exactly why it is worth understanding.
It creates a duty, not a signal
A petition asks. An Article 21 objection obliges. Once someone objects, the organisation must stop processing their data unless it can show compelling legitimate grounds that override that person's interests — and it has to reply to each objection, individually, within a month. A petition of 44,000 names is one document. 44,000 objections are 44,000 cases, each with a legal clock attached.
Concentration beats volume
The same 44,000 objections trickled in over five years would be absorbed as routine correspondence. Arriving together, they are an operational event that someone senior has to plan for. That is the first argument on our power page, playing out at scale.
It withdraws the raw material
A data platform's value is its coverage. Every successful objection is a hole in it, and enough holes change the case for the platform itself. This is the second argument on the power page: you have leverage over anything that depends on something you supply — money, attention, or in this case, your records.
It is aimed at a decision with a date
The break clause gives the government a concrete way out, at a known moment. Pressure applied before a decision can change it; the same pressure applied afterwards produces a justification. The timing does as much work as the numbers.
Every lever pulls at once
| Lever | Who it reaches | What it costs them |
|---|---|---|
| Legal objections | NHS England's data protection team | Work: each one must be assessed and answered |
| Petitions | Ministers and the press | Proof of scale |
| Select committee reports | Parliament | Institutional cover for changing course |
| The ambulance stunt | Everyone who saw the photograph | Attention, and a story that keeps running |
The coordination was the product. 38 Degrees did the legwork — the legal basis, the wording, the timing. Each person still filed their own objection, about their own data, in their own name. That is precisely the line this site is built on: do every piece of the work up to the point of acting, and leave the acting to the person whose name is on it.
The other side
Palantir says the platform is cutting waiting lists: trusts using it, the company says, recorded 117,000 additional operations, a 14.3% fall in discharge delays for long-stay patients, and a 5.6% improvement in how many people learn within 28 days whether they have cancer. It says patient data is handled only on the NHS's instructions and stays in the UK.
NHS England says every NHS organisation stays in control of its own data on the platform, that suppliers cannot use it for their own purposes, and that it will answer the objections as data protection law requires. Its chief executive has acknowledged concerns that the benefits may be smaller than claimed.
38 Degrees' campaigns director called the response
a huge wake-up call for the government
.
What the right can and cannot do
Worth knowing before you use it, because overstating it is how campaigns lose credibility.
- It applies to some processing, not all. Article 21(1) covers processing an organisation justifies as a public task or as being in its legitimate interests. Where it is processing because the law requires it, the right does not apply — and one useful effect of objecting is that the organisation has to say which basis it is relying on.
- It is not a veto. An organisation that can demonstrate compelling legitimate grounds may carry on. What it cannot do is ignore you.
- You have to give a reason of your own. The objection must rest on grounds relating to your particular situation. A sentence in your own words is enough; a form letter with that part left blank is not.
- It has deadlines. One month to respond, extendable by up to two more for complex or numerous requests — which, at 44,000, is likely here.
- There is somewhere to go next. If the response is unsatisfactory you can complain to the Information Commissioner's Office, free.
Using it yourself
The same right works against any organisation processing your data on those grounds — a council, a data broker, a company profiling you for marketing. Adapt the wording below. Send it to the organisation's Data Protection Officer; the address is in its privacy notice. Keep a copy and note the date.
This is guidance, not legal advice. It works best the way it worked here: alongside other people doing the same thing in the same few weeks.
What happens next
NHS England has to answer the objections, and ministers face the break clause decision in February 2027. We will update this page with the outcome — including if it turns out the objections changed nothing, because that would be worth knowing too.
Read the argument behind this