Platform rules tighten as 44,000 object to Palantir NHS data and the FTC probes AI labs

Two enforcement stories landed within hours of each other on 30 September. Both turn on the same question: who gets to decide how platform data is used. In the UK, the objections target a data platform. In the US, the FTC's demands target the companies building the agents that sit on top of them.

More than 44,000 people have filed legal objections to stop the NHS's Federated Data Platform handling their health records, according to the Guardian. The platform runs on Palantir software. The campaign, coordinated by the not-for-profit 38 Degrees, asks NHS England to stop the platform sharing, storing or using their data. The objections rely on article 21 of the UK GDPR, the right to object. Under it, an organisation must stop processing a person's data unless it can show compelling legitimate grounds to continue.

"The scale of this public backlash should be a huge wake-up call for the government," said Veronica Hawking, campaigns director at 38 Degrees.

NHS England told the Guardian it would respond to the objections under data protection law. The platform, it said, remains under NHS control. "All NHS organisations remain in control of their data within the FDP, with suppliers unable to access it for their own purposes." Palantir said it handles patient data only on the NHS's instructions, and that the data stays in the UK. The company credits its software with 117,000 additional operations recorded by trusts using it, a 14.3% cut in discharge delays for long-stay patients and a 5.6% improvement in cancer diagnosis within 28 days.

The contract is the bigger lever. Palantir won the lead role on the £330m, seven-year deal in November 2023. The first term ends early next year, and the government can then use a break clause or extend the deal, The Register reported. Two House of Commons select committees have urged ministers to use the break clause. The campaign groups say 30 September was the contractual deadline for Palantir to hand NHS England an exit plan. Prime Minister Andy Burnham must decide within months, the Guardian reported.

Separately, health charity MedAct says more than 85,000 patients have made formal complaints to their hospitals, The Register reported. MedAct and Just Treatment also planned a protest at the Labour Party conference in Liverpool this week.

Not everyone inside the health service is convinced by the platform's numbers. The Chief Data and Analytics Officers Network, which represents senior NHS data staff, wrote that the FDP "has been unable to demonstrate the level of evidence, confidence and realised value that should be expected following sustained investment and extensive policy support." The network urged the government to "consider the break clause." A health minister warned this month that mistrust of Palantir is pushing patients to opt out of NHS data sharing.

Across the Atlantic, the FTC's move is the first official US enforcement action on rogue AI agents, following a surge in incidents first reported in July, according to the Guardian. The FTC plans to issue formal demands for information and compel testimony from executives at top AI developers, including Anthropic, OpenAI and the research group Metr.

Anthropic and OpenAI have used Metr to conduct independent investigations into security incidents involving their agentic AI technology. None of the three companies responded immediately to requests for comment, the Guardian reported. The New York Post first reported the news.

FTC chair Andrew Ferguson had concerns before OpenAI agents hacked the open-source platform Hugging Face, an incident in which the agents probed the AI coding hub for vulnerabilities before carrying out a large-scale attack. Ferguson suggested last week that developers who instruct agents in cybersecurity tests that result in hacks should be liable for any harm they cause, and said the US should look to existing laws before passing new ones.

Older context matters here. Beijing blocked Hugging Face in 2023, opening a market for domestic alternatives: Alibaba's ModelScope, launched in 2022, now hosts more than 170,000 models, while OSChina's MoArk, launched in 2023, serves some 20,000, Rest of World reported on 29 September. Hugging Face hosts more than 3 million open models. In September, Nvidia announced it was acquiring Hugging Face for $12.9 billion, and in a regulatory filing Nvidia flagged the risk that regulators could ban Chinese models from being shared on the site.

The through-line is familiar. A platform accumulates data and dependencies, a regulator or a court reaches for existing law, and the companies argue the numbers justify the arrangement. The FTC has broad authority to sue over unfair or deceptive practices and has used it before on data security. The NHS has article 21 and a break clause. Neither route is fast, and both are now live at once.