The Planned Use of Palantir: A Risk to Data Protection and Digital Sovereignty?

Introduction: Palantir Under Scrutiny — Efficiency Gain or Data Protection Risk?

The debate over a possible nationwide rollout of the data analytics software Palantir is picking up pace. Following deployments in Hesse and North Rhine-Westphalia, authorities are now examining whether the tool could also be used at the federal level. While supporters point to efficiency gains and improved security structures, critics highlight the risks to data protection and informational self-determination. This article aims to present the legal foundations, technical background, and practical implications in an objective manner.

What Is Palantir?

Palantir Technologies was founded in Silicon Valley in 2003 and today ranks among the best-known providers of data analytics software. Originally established with financial backing from In-Q-Tel, a firm with ties to the CIA, Palantir initially developed software for intelligence agencies and the military. Its client base now also includes public institutions and large corporations.

Palantir's best-known products are "Gotham" (for governments and security agencies) and "Foundry" (for businesses). Both platforms make it possible to link the most diverse data sources together, visualize them, and search specifically for patterns or risks. The technologies used draw on artificial intelligence, machine learning, and graph-based data analysis.

In Germany, Palantir is already used by police authorities in Hesse and North Rhine-Westphalia. The goal is faster, interconnected analysis of information relevant to investigations. For example, communication data, movement profiles, or social connections can be merged and analyzed within a single system. This capability promises greater efficiency but also raises significant data protection challenges.

What's being debated isn't just the technical performance, but also whether there is sufficient transparency regarding data processing and system decisions. Critics argue that proprietary software solutions like Palantir's often operate like a "black box," making their inner workings difficult to trace. This is seen as particularly problematic in the public sector.

Palantir Technologies is a US company that develops data integration and analytics software. Its products are used by security agencies, intelligence services, and businesses worldwide, among others, to analyze large volumes of data and make connections visible.

In Germany, Palantir's software is already used by certain police authorities to merge data sources such as telecommunications and movement data, for example. The goal is faster, interconnected analysis during investigations. Support for the tool rests on the hope of better understanding complex situations and responding more quickly.

Legal Foundations: GDPR and Swiss nFADP

GDPR

The General Data Protection Regulation (GDPR) applies across the entire EU and sets out the conditions under which personal data may be processed. Relevant principles include:

• Purpose limitation
• Data minimization
• Transparency
• Proportionality
• Security of processing
• Data subject rights (e.g., access, erasure, objection)

Particularly relevant in the Palantir case: the GDPR imposes strict requirements on transfers of personal data to third countries outside the EU, such as the United States. Such transfers are only permitted if an adequate level of data protection is guaranteed.

Swiss nFADP

Since September 2023, Switzerland's revised Federal Act on Data Protection (nFADP) has been in force, and it aligns closely with the GDPR in many respects. Here, too, principles such as purpose limitation, transparency, and data security apply. For internationally active companies in particular, it's important to ensure compliance with both the GDPR and the nFADP.

Opportunities and Concerns From a Data Protection Perspective

Opportunities Through Data-Driven Analysis

Data analytics software like Palantir can help law enforcement and security agencies process large, heterogeneous datasets more quickly and identify relevant information early on. This can lead to more efficient use of resources and improve operational decision-making.

Particularly in combating organized crime, terrorism, or cybercrime, automated pattern recognition can help identify potential threats earlier and build risk profiles for targeted intervention. Merging previously isolated data sources can also create operational synergies and open up new investigative approaches.

There's also potential for such systems to be used in other areas of public administration, such as crisis management, pandemic response, or hazard analysis in disaster protection, provided data protection requirements are met.

Data Protection Challenges

Using data analytics systems like Palantir raises a range of potential data protection challenges, particularly with regard to sensitive personal information.

• Processing especially sensitive data: This can include health data, political opinions, or data on ethnic origin, whose protection is especially strictly regulated under the GDPR and the nFADP.
• Potential purpose creep: If data collected for a specific purpose is used in new contexts, this risks violating the principle of purpose limitation. This risk is especially heightened when previously separate data sources are linked together after the fact.
• Uncontrolled data sharing or linking: Complex systems can lead to data being combined to an extent that was neither originally intended nor transparently communicated.
• Access by US authorities under the CLOUD Act or FISA 702: US-based providers may be required to access or hand over data even if servers are physically located in the EU. This creates legal uncertainty.
• Ensuring technical and organizational protective measures (TOMs): To meet legal requirements, mechanisms such as access controls, encryption, logging, and role separation must be demonstrably and effectively implemented.

These challenges call for an early and comprehensive Data Protection Impact Assessment, and, where necessary, consultation with the responsible supervisory authority.

The Role of Supervisory Authorities

Data protection supervisory authorities assess whether systems like Palantir are compatible with applicable data protection law. Ulrich Kelber (Germany's Federal Commissioner for Data Protection, BfDI) emphasizes the importance of clear legal foundations and points to the risks of automated data linking. State data protection authorities likewise call for strict purpose limitation and transparent oversight mechanisms. For companies, these assessments provide guidance for designing their own data-processing systems in a legally compliant way and identifying data protection risks early.

Recommendations for Companies

• Create transparency: document data flows, storage locations, and access
• Review DPAs & TOMs: document contracts and security measures with service providers
• Analyze data transfers: critically assess third-country transfers and add technical safeguards where needed
• Strengthen internal processes: involve data protection officers in IT projects from an early stage
• Conduct regular audits: identify and document risks

Outlook: Data Protection Between Innovation and Responsibility

Technological developments in big data and AI offer major opportunities, but they also raise the bar for data protection, security, and transparency. Whether it's Palantir or another provider, what matters is how carefully selection, integration, and oversight are carried out.

Policymakers and businesses alike should recognize that data protection isn't just a legal obligation — it's an ethical responsibility too.

Conclusion

The potential deployment of Palantir at the federal level illustrates the challenges of modern data processing at the intersection of security, innovation, and data protection. What matters isn't where a tool comes from, but how responsibly it's used.

Companies should take this discussion as an opportunity to reflect on their own data protection practices and strengthen their digital sovereignty.