Investigation into Palantir's activities in Europe amid COVID raises concerns over Palantir's work with public agencies and whether it can operate under EU laws
Daniel Howden, Apostolis Fotiadis, Ludek Stavinoha, Ben Holst — The 24 March, 2020 will be remembered by some for the news … Tweets: @guyverhofstadt , @stefsimanowitz , @marietjeschaake , and @katymfallon Tweets: Guy Verhofstadt / @guyverhofstadt : Weekend reading & thinking: Tackling the Covid crisis should not come at the cost of our fundamental rights & freedoms. Data can only be used if there are safeguards to protect them. We can only beat fake news around Covid if we face the real risks head-on. https://twitter.com/... Stefan Simanowitz / @stefsimanowitz : 2/. Ystdy, @guardian & @derspiegel revealed how Greece, UK, Netherlands & “at least 4 other EU countries” have given #Palantir vast amounts of population-wide personal data in secretive agreements which “might violate privacy laws” What an understatement! https://www.theguardian.com/ ... Marietje Schaake / @marietjeschaake : Palentir: 'We are not a data company'also Palentir: ‘We build software that lets organizations integrate their data (...) Our software empowers entire organizations to answer complex questions quickly by bringing the right data to the people who need it’↘️ https://www.theguardian.com/ ... Katy Fallon / @katymfallon : Any LOTR fan knows palantirs are bad news & not all accounted for. What happened when a tech company named after these nefarious stones, made inroads into Europe under cover of Covid? Disturbing trip down rabbit hole by @LHreports, @guardian, @derspiegel https://www.theguardian.com/ ...
Context & Ripple Effects
The arc here runs back through Palantir's pandemic entry into Europe: after its deal with the UK's NHS in early 2020, it was reported to be in talks with France, Germany, Austria, and Switzerland about deploying its tools against COVID-19 (in talks with France, Germany, Austria, and Switzerland). The new investigation by The Guardian and Der Spiegel asks whether those hastily struck data-sharing arrangements with public agencies can actually operate under EU privacy law at all.
That question lands on an established playbook. A 2017 investigation documented how Palantir built an opaque surveillance network for police departments and government agencies, locking clients in while resisting transparency — and CEO Alex Karp's public defense of the company's trustworthiness (Karp's progressivism pitched against Thiel's ties to Trump) has done little to quiet that critique.
First-order effects
- Public health agencies in France, Germany, Austria, and Switzerland weighing Palantir deployments now face political and legal pressure to justify data-sharing terms negotiated during the emergency.
- Palantir's European expansion pipeline — built on crisis-speed contracts — is stalled until each agreement's compliance with EU privacy law is established.
Second-order effects
- Vendors marketing GDPR-compliant health-data platforms gain a procurement opening as agencies reassess whether a US firm's tools fit European legal requirements.
- Scrutiny spills onto flagship projects beyond the pandemic: privacy campaigners and doctors already contesting the NHS's federated data platform and its potential £480M award to Palantir gain fresh ammunition from the investigation's findings.
Third-order effects
- If the pattern holds — crisis-era data deals hardening into permanent infrastructure, later challenged on legal grounds — European governments will face structural pressure to write privacy safeguards into emergency procurement up front rather than retrofit them afterward.
- The deeper risk for Palantir is the lock-in model itself: internal documents later showed a strategy of deepening NHS ties partly by acquiring smaller rivals to reduce scrutiny (buying up smaller rivals to deepen NHS ties), suggesting the EU-law question will keep recurring as long as consolidation outpaces transparency.
The trend: Government data platforms are being procured faster than the legal frameworks meant to govern them, forcing post-hoc reckonings over who may hold public-sector data and under whose laws.