The New Dark Age

Palantir policy guy Tom Watson has a substack, and he’s posted a long defence of his new employer, Palantir:

Good technology can improve control. Access can be restricted by role, activity logged and information shared without endless copying. NHS England says access and use within FDP instances are logged, allowing organisations to review who accessed what information.

That can help organisations detect and investigate inappropriate access, including access driven by curiosity about a patient in the news.

An audit trail does not make data voyeurism impossible. Permissions must be properly configured, suspicious activity reviewed and breaches acted on. Nor does an FDP audit trail cover every action in every separate NHS system.

But it gives the NHS a means of accountability: a record against which questions can be asked and investigations conducted. That is one of the advantages of well-governed, integrated data management. Yvette Cooper’s distinction is therefore the right starting point. Staff need information to provide care. Access without a legitimate purpose must be challenged. Better-connected information and stronger accountability should support each other.

Tom is right that audit trails only matter when they can be seen. Of course, no patient can see the Palantir audit trail. Palantir can see it, NHS England can see it, but patients can’t. So is it actually meaningful? If Palantir lost the contract, how would a patient’s knowledge be decreased?

Tom also pretends that only Palantir has audit trails in the NHS. He is wrong.

NHS England says that “Personal Demographics Service keeps a full audit of all record access”, and the Spine Secure Proxy performs “auditing of requests… and transaction logging” with “users, including role,” and “ organisation”… “is retained for audit purposes”.

That audit trail is held by NHS England, it is controlled by NHS England, it should be visible to patients in the NHS App, because NHS England already logs every access that crosses the boundary of the grey box, including demographic data in PDS and clinical data in GP Connect. NHS England only intermittently discloses the contents of those logs when the patient makes a Subject Access Request for the data held by NHSE. NHS England even did a nice graphic showing where everything is logged as it crosses the boundary of the grey box:

Source: NHS England Digital

NHSE has spent hundreds of millions on FDP to process data.

Tom is right that FDP / Foundry could show patients a statement of accesses to their data from the logs NHS England already holds. He’s entirely silent on the fact that it does not – the continued refusal is a political choice not a technical limit.

NHSE’s claims echo this paragraph from Max Chafkin’s book on Peter Thiel and Palantir (page 95):

Some things never change.

Tom is entirely right that Palantir could show patients an audit trail, but they don’t. The next time he pops up in public with his argument, the follow-up question is simple: Tom, where can a patient go to see their audit trail demonstrating Palantir’s capabilities?

His answer will show that the supplier, whether Palantir or anyone else, is entirely irrelevant given the blanket and absolute refusal by NHS England’s “Privacy, Transparency and Trust” team to show you how your records are creeped on by NHS staff, by DHSC staff, and potentially by Palantir staff.

Because it seems, with NHS England, as with Palantir, you have no privacy, there is no transparency, and so there can be no trust.

===

medConfidential publishes information for free on our website. If you wish to support our work, you can do so at medconfidential.org, in addition to the other ways substack promotes.