Let us opt out — now.

Subject

Open Letter: Concerns regarding the classification of NHS Federated Data Platform use cases and the application of the national data opt-out

Dear Dr Byrne,

We write in response to your statement of 3 June 2026 on the NHS Federated Data Platform, published in reply to the Not With My NHS Data campaign. We are grateful for your intervention on external contractor access to identifiable patient data, and for your commitment to seeking clarification from NHS England. This letter concerns a separate passage of the same statement, and a single concrete ask that follows from it.

The passage we are asking you to revisit

We agree with the first two sentences. We respectfully submit that the third sentence — that the FDP is "currently used solely to support care delivery", and that the opt-out therefore does not apply to any data within the programme — is, on the face of NHS England's own published use cases, potentially incorrect.

Why we believe the statement is potentially incorrect

Your statement defines the scope of the opt-out by reference to secondary purposes, giving "research and planning" as examples. Two of NHS England's five published FDP use cases appear, on their own descriptions, to fall squarely within that definition:

If either use case is properly classified as secondary, the premise of the third sentence above does not hold, and patients who have registered a national data opt-out should, in principle, have that opt-out respected in relation to those uses. A blanket assurance to the contrary risks misleading the public about the scope of their existing rights — the opposite of what Principle 8 of the Caldicott framework requires.

We note in passing that the National Data Opt-Out operational policy engages the opt-out at the point identifiable confidential patient information is disclosed or repurposed — not only at the point an aggregate output is produced. "The output is aggregated" is not, on its own, sufficient to disapply the opt-out where the underlying processing involves identifiable data for a purpose beyond individual care.

Our ask: an immediate, individual right to opt out

We are not asking for the FDP to be paused. We are asking that, while the classification of each use case is clarified, any patient who asks should be able to have their identifiable data excluded from the NHS Federated Data Platform and the National Data Integration Tool, with immediate effect. The national data opt-out as currently scoped does not provide this — which is precisely the problem.

We therefore respectfully ask that your office:

1. Publicly call on NHS England and DHSC to establish an immediate, interim individual opt-out from the FDP/NDIT — a clearly published route by which any patient who asks can have their identifiable data excluded from the platform while the questions below are resolved — and confirm that, in the meantime, Article 21 UK GDPR objections to this processing will be considered on their merits rather than refused by default.
2. Publish the basis on which each of the five FDP use cases has been classified as direct care delivery rather than secondary use, assessed against the National Data Opt-Out Directions.
3. Publish, for each use case, what category of data (identifiable, pseudonymised or anonymised) is actually processed, since this bears directly on whether the opt-out is engaged.
4. Update the 3 June statement to reflect the position of use cases 4 and 5, so that patients are not given a blanket reassurance that their opt-out does not apply to any FDP processing when that question is, at the very least, open.

Public trust in the FDP depends not only on robust governance of who can access data, but on accurate communication about what rights patients retain. Your office's independence is its value. We hope you will apply that independence to this question with the same rigour you have brought to the contractor access issue.

Yours sincerely,

The signatories of the Not With My NHS Data open letter