Key facts
- The UK's Financial Conduct Authority (FCA) is conducting a 12-week trial with Palantir's AI platform, Foundry.
- The trial involves analyzing sensitive FCA data, including case intelligence files, fraud reports, and consumer complaints.
- Concerns have been raised by MPs and legal experts regarding potential access to this data by US authorities under the US Cloud Act.
- The FCA maintains that the US Cloud Act does not apply and that it remains the data controller.
- Palantir also supplies software to US immigration enforcement and the Israeli military.
The UK's Financial Conduct Authority (FCA) is currently engaged in a 12-week trial utilizing Palantir's AI platform, Foundry, to analyze a wide array of sensitive regulatory data. This includes case intelligence files, reports on proven and suspected frauds, consumer complaints, and trawls of social media posts. The arrangement has sparked significant concern among MPs and privacy advocates, who fear it could lead to sensitive UK financial and personal data being accessed by US authorities, potentially under the US Cloud Act.
Martin Wrigley MP, a member of the House of Commons science and technology select committee, has warned that a US law could compel Palantir, a US-controlled company, to disclose data to American authorities. He expressed concern that the FCA might be inadvertently providing the Trump administration with backdoor access to troves of sensitive information. Wrigley has written to the FCA demanding clarification on the legal basis for their belief that the US Cloud Act would not apply.
The FCA, however, has stated that the US Cloud Act does not apply to this arrangement and that it will remain the data controller at all times, asserting that Palantir acts as a data processor and will not control the data. They also noted that intelligence would not be shared. Palantir has reportedly cited three reasons why Wrigley's fears could not materialize.
Legal experts have countered that the distinction between data controller and processor might be misleading, as data processors do not automatically fall outside the scope of the US law. The Open Rights Group stated that the US Cloud Act gives US authorities the right to access data held by US-based businesses like Palantir. They argue that by handing data to Palantir, the FCA is exposing UK residents' data to potential access by the US government, which is not bound by UK legal frameworks. Concerns have also been raised about potential access under the USA Patriot Act and the Foreign Intelligence Surveillance Act.
This trial adds to Palantir's growing presence in the UK public sector, which includes substantial contracts with NHS England and the Ministry of Defence. The deal has become politically sensitive, especially after the Mayor of London, Sadiq Khan, blocked a similar AI deal with the Metropolitan police over procurement rule breaches and concerns about sharing city values.