Comment by jacquesm

The government is not one entity and it is perfectly possible for one sub-entity to have certain data and for another not to be able to have that same data, in fact from being prohibited to have access (let alone use) that same data. Palantir is used as a way to gain access to data that should otherwise not be accessible and the fact that it isn't the health data itself is immaterial: it was collected in the process of providing healthcare and as such should be protected. That's the legal base, not to enforce immigration law. Unfortunately the USA does not have the equivalent of a GDPR (and even if it did it would have probably been killed by now).