In 2022 the NHS began implementation of a project, the Federated Data Platform (FDP), with a £1.04bn lifetime spend planned, with systems provided by US firm Palantir. Since then, there’s been questionable procurement and heavily redacted contracts.
But dodgy procurement isn’t even the biggest problem. Instead, we should ask what happens when our health data sits on infrastructure controlled by companies that answer to Washington, not Westminster. When our appointment booking, our prescription records, our test results are on a platform where a foreign government has more legal access than we do.
And NHS procurement is just the visible tip of a loss of digital sovereignty. Calderdale schools are buying Microsoft services through ‘convenient’ procurement. West Yorkshire councils are buying cloud services through the UK government’s G-Cloud framework, which was designed to help small businesses but became an express lane for Amazon, Microsoft and Google into the public sector.
FDP: unwanted and less functional
By September 2025, 150 NHS trusts were ‘onboarded’ to the FDP, but only 77 were using it – a 51% failure rate for our glorious £1.04bn spend. Leeds Teaching Hospitals Trust said it would make them “lose functionality rather than gain it”. Greater Manchester’s Integrated Care Board refused outright for its trusts because its “assessment is that our local capability exceeds anything the FDP currently offers”. NHS England has mandated platform adoption anyway, contradicting its own policy that said trusts with working systems could opt out.
More will be spent on FDP than Calderdale Council’s entire annual budget for the next four years, on a system that many NHS trusts don’t want and that doesn’t work as well as what they already have.
Digital sovereignty matters
The Palantir contract isn’t even an aberration. We sold our train and bus companies to Germany, France and others. We sold our electricity grid to China and America. And for a particularly grim case in point, we need only look at the results of the privatisation of our water industry.
Wessex Water is owned entirely by a Malaysian corporation. Northumbrian Water is 80% owned by a Hong Kong billionaire through a Cayman Islands company. Thames Water has investors from Kuwait, the UAE, China and Australia. Yorkshire Water is majority-owned by Hong Kong investment firms, with the Singapore government holding a significant stake.
We privatised water in 1989 promising ‘shareholding democracy’. Move on 35 years, it’s 70% foreign owned, there’s sewage in the rivers, £72bn has been paid out in dividends, and the companies have accumulated £60bn in debt. Scottish Water – publicly owned – has cleaner rivers and no hosepipe bans despite similar weather. In the meantime, Yorkshire Water imposed a hosepipe ban in July 2025 after the driest spring in 132 years, even while losing 240–260 million litres per day through leaks. Our local reservoirs have been refilling for weeks with autumn rain, but the ban remains in place.
It turns out sovereignty matters.
The Cloud Act problem
Physical infrastructure was sold through explicit privatisation – controversial, debated, resisted. Now we’re handing over our digital sovereignty through procurement frameworks that make it look like choice.
The Cloud Act – a US law passed in 2018 – demands that US companies hand over data to the US government regardless of where it’s stored: UK servers, EU servers, anywhere. If a US company controls it, the US government can access it. There’s no notification to you, and often no notification to your government.
In May 2025, the US sanctioned Karim Khan after he issued arrest warrants for Benjamin Netanyahu. Khan is the chief prosecutor of the International Criminal Court – a British lawyer representing global justice. Microsoft cut off his email account, and an international lawyer was locked out of his correspondence. He switched to Proton Mail, a Swiss provider. Although this is not specifically a Cloud Act issue, the similarities in exercise of powers bear closer scrutiny. Note that Microsoft denies having done this, but is now adding binding clauses to contracts with European governments allowing it to go to court if ordered to suspend services by other governments (i.e. the US government).
Sorry, it’s not your data now
In June 2025, a Microsoft representative testified under oath to the French Senate. When asked if the company could guarantee French government data privacy from US requests – even data on French servers, for French citizens – it could not.
The G-Cloud framework enables similar issues for us, with the creation of a ‘convenient’ procurement path that resulted in £6bn in public sector cloud spending in 2024 alone, with most of it going to US companies. Locally, West Yorkshire councils, NHS trusts and Calderdale schools all use it.
Your GP records are stored on NHS servers run by a US cloud company, and the US government has more legal right to access them than you do. That’s how the Cloud Act works.
Moving digital life off US platforms
I’ve been watching this develop for years. The latter part of my career was as a data engineer, so I’m not a technophobe despite what follows.
Understanding systems means understanding vulnerabilities. I’ve spent years reading about digital sovereignty – Paris Marx, Bruce Schneier, Cory Doctorow, John Naughton among others – and I started moving my digital life off US platforms over the past five or six years: Runbox instead of Gmail, UK hosting instead of AWS, LibreOffice where I’d used Office 365, Vivaldi rather than Chrome. It wasn’t dramatic – just steady migration.
I can’t fully escape. Social media remains the hardest to replace, while my UK web host may use US infrastructure somewhere in the stack. But, even so, these moves create market pressure for alternatives, prove viability, and reduce single points of failure.
And I’ve reduced my dependence enough to sleep better when I read about ICC prosecutors losing email access, or NHS trusts being forced onto Palantir, or Microsoft telling France it can’t guarantee data privacy.
Structural change requires structural solutions
Sadly, consumer choice alone won’t fix structural dependence. Individual action is necessary but insufficient. Our structural dependence requires structural solutions. We can’t ‘personal-choice’ our way out of institutional capture.
Governments must act. The G-Cloud framework needs fixing – sovereignty should be a procurement factor, not an afterthought. European and UK alternatives exist, so we should be using them. The Cloud Act vulnerability isn’t a bug, it’s a feature. We need data sovereignty protections that stop US firms evading UK law through jurisdictional games. GDPR tried to ensure this, but it needs proper enforcement and expansion.
We need to invest in alternatives. European public infrastructure models exist. Scottish Water proves public ownership works. We don’t need to reinvent everything. We need to fund what works, e.g. open-source options that reduce vendor lock-in – software products that allow users to use, modify and redistribute the software as they see fit.
This isn’t anti-technology or anti-America. It’s about not repeating the water privatisation disaster in digital form. We sold physical infrastructure and got sewage in rivers, debt mountains and foreign profits. We should be smarter than that.
Yorkshire: we’re cussed
When government services go digital-by-default, citizens have no choice. They’re forced onto US-controlled platforms for Universal Credit, NHS appointments and council services. That’s not digital inclusion – that’s digital colonisation.
But Yorkshire has always been independent-minded; we don’t take well to being told what’s good for us. The Industrial Revolution was built here on Yorkshire terms and the digital realm should be no different. Calderdale schools shouldn’t be locked into Microsoft just because procurement is convenient. Leeds NHS trusts shouldn’t lose functionality because Whitehall mandates an inferior system. West Yorkshire councils shouldn’t surrender data sovereignty for the ease of G-Cloud ordering.
We sold the electricity grid, the water system, and the railways. We learned nothing. Digital infrastructure is going the same way, dressed up as ‘procurement efficiency’. Alternatives exist. They work. Often, they’re better than what they should be replacing. The question was never whether we could choose sovereignty. It was whether we’d bother to, before the choice was made for us.
Yorkshire built mills, canals and railways on our own terms. Digital infrastructure, both here and across the rest of the UK, should be no different.
