A modern military, artificial intelligence and the constitutional limits of privacy protection
Cooperation between Poland’s Ministry of National Defence and the US company Palantir Technologies has attracted the attention of the Commissioner for Human Rights. The issue concerns not only the use of advanced technology in the Polish military, but also a fundamental question: how far may the state go in collecting and analysing data in the name of national security?
In a letter dated 8 October 2026, published on 26 October, Commissioner for Human Rights Sylwia Gregorczyk-Abram asked Minister of National Defence Władysław Kosiniak-Kamysz for detailed explanations concerning the scope of cooperation with Palantir, the legal grounds for processing data and the mechanisms protecting citizens’ privacy.
Palantir — technology that knows more
Palantir Technologies is a US company developing advanced IT systems that integrate, process and analyse vast datasets. Its solutions are used by defence institutions, security services and businesses, among others.
The strength of these technologies lies in bringing together information from different, apparently unrelated sources. A system can detect connections, identify patterns and support decision-making. These capabilities are highly significant for military operations, logistics and cybersecurity.
At the same time, using similar tools to analyse personal data raises questions about excessive profiling and the construction of detailed pictures of individuals’ activities and relationships. However, the use of such technology does not, by itself, mean that mass surveillance is taking place.
The Ministry’s agreement with Palantir: what was actually signed?
Cooperation between the Ministry and Palantir formally began on 23 December 2024, with the signing of a memorandum on cybersecurity and information technology. On 27 October 2025, the parties then signed a letter of intent concerning the use of artificial intelligence and the development of the Polish military’s technological capabilities.
On 22 October 2026, RMF FM reported that a previously undisclosed confidentiality agreement had also been signed alongside the memorandum. The document provides for the possible exchange of confidential information in connection with technological cooperation, testing and training.
The Ministry maintains that no classified information has been provided to Palantir and that the workshops used only fictional test data and publicly available information.
Confidential information within the meaning of a civil-law agreement must be distinguished from classified information protected by separate legislation. Signing a confidentiality agreement does not prove that citizens’ data or classified information has been transferred. Nor does it provide an independent legal basis for disclosing such information.
The Commissioner asks about citizens’ data and the limits of surveillance
The intervention followed a submission by representatives of the “Nasze dane” (“Our Data”) initiative, who drew attention to the risks associated with the processing of information by a foreign technology provider.
The Commissioner asked the Ministry whether privacy risks had been assessed, whether an implementing agreement governing data processing had been concluded, and whether cooperation could include detecting crime and threats to public security. It is particularly important to establish whether Palantir will be authorised to independently obtain and combine personal data, or only to analyse datasets supplied by authorised Polish bodies.
The Commissioner also wishes to know whether automated and generalised processing of information is envisaged. The letter does not establish that the law has been breached. It identifies areas where the actual scope of cooperation and responsibility for the data being processed need to be clarified.
The Polish Constitution sets the limits
Articles 47 and 51 of the Polish Constitution, which guarantee protection of private life and individual informational autonomy, remain the key points of reference. Article 51(2) is particularly important: public authorities may not acquire, collect or disclose information about citizens beyond what is necessary in a democratic state governed by the rule of law.
Even where the state acts to protect national security, interference with privacy must comply with the principle of proportionality under Article 31(3) of the Constitution. Restrictions on rights and freedoms require an appropriate statutory basis and must not go beyond what is necessary to achieve a legitimate objective.
In this context, the Commissioner referred to the Constitutional Tribunal’s judgments of 20 November 2002 (K 41/02) and 30 July 2014 (K 23/11). They reflect an important principle: state powers to obtain information about individuals cannot be justified solely by administrative convenience.
Do the GDPR and the AI Act apply to the military?
Data protection in defence is more complex than in ordinary relationships between businesses and individuals. Under Article 2(2)(a) GDPR, the Regulation does not apply to processing in the course of an activity outside the scope of EU law, which includes national security. This does not mean, however, that every data operation performed by the Ministry is automatically excluded from the GDPR. The actual nature and purpose of processing are decisive.
The EU AI Act makes a similar distinction. Article 2(3) of Regulation 2024/1689 excludes AI systems used exclusively for military, defence or national security purposes. If the technology were also used for civilian purposes, crime detection or public security, its use would require a separate legal assessment.
This is why the Commissioner’s question about the possible use of Palantir for crime detection is particularly significant. Such use may require the application of rules other than those governing defence alone.
A foreign provider and control over information
Further concerns arise from Palantir’s status as a US company, which means that it is also subject to certain provisions of US law. Public debate has referred, among other things, to the CLOUD Act, which enables US authorities, in legally specified circumstances, to seek disclosure of certain data from service providers.
This does not mean that US agencies have automatic access to Polish military data, nor does it establish that Palantir holds such information. It nevertheless raises legitimate questions about data storage, the provider’s access rights, contractual and technical safeguards, and the possibility of independent audits.
From a legal perspective, it is equally important to determine who exercises actual control over datasets, who decides how they are used, and whether the provider may use them for other purposes, particularly to develop its own systems.
From Pegasus to Palantir — one question about privacy
Palantir and Pegasus are fundamentally different technologies, but both can be used to interfere extensively with citizens’ privacy. The main difference concerns how information is obtained and subsequently used.
Pegasus is used to take control of a device and extract information from it. Palantir, by contrast, enables vast amounts of data from many different sources to be combined, analysed and interpreted.
1. Palantir and Pegasus: the key differences
| Criterion | Pegasus | Palantir |
|---|---|---|
| Nature of the technology | Spyware | Data integration and analysis platforms, including AI-based tools |
| Main use | Device surveillance | Information analysis; identifying connections and patterns |
| Obtaining information | Can infect a phone without the user’s knowledge | Generally analyses data supplied or connected to the system |
| Scope of information | Messages, calls, photographs, location, microphone and camera | Registers, databases, documents, operational information and relationships between individuals |
| Scale | Targets specific devices | Potentially analyses millions of records concerning many people |
| Main risk | Secretly extracting information from a private device | Building detailed profiles of individuals and mapping their relationships |
Palantir develops platforms including Gotham, Foundry and AIP. Their functions include analysing data and supporting decision-making. Pegasus, developed by NSO Group, is an offensive digital surveillance tool.
2. Could Palantir be more dangerous than Pegasus?
In certain respects, yes — although not because it operates like spyware. Imagine that an institution has lawful access to information about a citizen’s vehicles, properties, business activities, travel or relationships with other people. Palantir may technically enable that information to be brought together, connections to be discovered and an analytical profile to be produced, provided the relevant data has been made available to the system.
The greatest risk therefore need not lie in unlawfully obtaining a single piece of information, but in combining thousands of pieces into a detailed picture of a person’s life.
Each item, considered separately, may have a lawful source. That does not automatically make bulk combination, profiling citizens and drawing new inferences lawful. This is a fundamental difference from Pegasus: the central concern there is intrusion into a device; here, it is the possibility of extensive informational control over an individual.
3. Why is the comparison particularly relevant now?
On 12 October 2026, Poland’s National Public Prosecutor’s Office published findings by experts from the Internal Security Agency concerning the operation and security of Pegasus. These findings indicate, among other things, that the Central Anti-Corruption Bureau did not have full control over the system, that data transmitted by the software left Poland, and that the manufacturer had the technical ability to access material obtained through covert surveillance.
The experts did not, however, determine whether the manufacturer actually accessed material from particular surveillance operations.
This makes the questions concerning Palantir particularly significant. The issue is not only what data a system will analyse, but also who will exercise actual control over its processing, storage and disclosure.
4. Could Pegasus and Palantir work together?
Technically, yes. Data obtained using one tool could be transferred to a separate analytical system and combined with other information. For example, information obtained through Pegasus could be analysed using Palantir technology to identify connections between individuals, events and other data. Such a combination could produce a far more detailed picture of a particular person’s activities than the data from their phone alone.
This does not mean that Pegasus and Palantir are integrated or that such a solution has been used in Poland. There is no confirmed information demonstrating this kind of cooperation between the two technologies.
The experience with Pegasus shows that, in a democratic state governed by the rule of law, knowing what technology can do is not enough. Above all, we need to know who controls it and what safeguards prevent it from being used against citizens.
National security does not exclude privacy protection
Advanced data analytics and artificial intelligence can significantly strengthen a state’s defence capabilities. Modern systems help identify threats more quickly, analyse operational information and improve military logistics. Cooperation with a foreign technology company cannot therefore, by itself, be equated with a violation of civil rights.
However, the effectiveness of technology cannot replace a legal basis for its use, and national security is not an unlimited authorisation to interfere with privacy.
As at 26 October 2026, publicly available information does not establish that Palantir has gained access to actual datasets of citizens’ personal information through its cooperation with the Ministry. Nor does it answer all the questions concerning the future use of the technology.
The Ministry’s response to the Commissioner will therefore be crucial. It should clarify whether data may be processed, which data would be involved, what safeguards are envisaged and whether effective oversight mechanisms exist.
The state needs modern tools of defence. It must also ensure that technology intended to protect security does not become an instrument of uncontrolled interference with individual rights.
Advocate Barbara Kardynia
Sources
Commissioner for Human Rights — cooperation between the Ministry and Palantir, 26 October 2026 (letter of 8 October 2026, ref. VII.501.141.2026);
Ministry of National Defence — letter of intent with Palantir Technologies, 27 October 2025;
RMF FM — reporting on the confidentiality agreement, 22 October 2026;
National Public Prosecutor’s Office — Internal Security Agency experts’ opinions on Pegasus, 12 October 2026;
The Constitution of the Republic of Poland; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2024/1689 (AI Act).