Key facts
- The FCA has contracted Palantir to use its AI systems on two years of internal data to help combat financial crime.
- MPs from multiple parties have raised concerns about data sovereignty and potential US government access to sensitive UK financial data.
- The FCA asserts Palantir will act as a data processor with data stored in the UK and under FCA control.
- Palantir staff will access sensitive FCA data during a 12-week trial period.
The UK's Financial Conduct Authority (FCA) is facing scrutiny from Members of Parliament over its decision to contract with Palantir, a US data analytics company, to enhance its fight against financial crime. The deal, currently in a 12-week trial phase, involves Palantir applying its AI systems to a significant amount of the FCA's internal intelligence data.
Concerns have been voiced by MPs across several parties, including Labour, the Liberal Democrats, and the Green party. A primary worry revolves around data sovereignty and the potential for sensitive UK financial data to be accessed by US authorities, particularly in light of the US Cloud Act. This law could compel US-based companies like Palantir to disclose data to the US government. Liberal Democrat MP Martin Wrigley has specifically questioned the FCA's assertion that the US Cloud Act would not apply to this contract, demanding further legal clarification.
Further objections stem from Palantir's controversial background, including its work with the US military, ICE, and its association with Donald Trump. Critics argue that awarding a contract for sensitive financial data to a company with such ties represents a significant misjudgment and could lead to an overreliance on foreign technology. Some MPs have called for the contract to be halted or blocked entirely, advocating for the development of domestic capabilities instead.
The FCA has defended the contract, emphasizing that Palantir will operate as a "data processor" under strict instructions, not a "data controller." The regulator asserts that it will maintain exclusive control over encryption keys, all data will be hosted and stored within the UK, and Palantir will be required to destroy the data upon completion of the contract. The FCA also stated that no intelligence would be shared with US authorities. However, legal experts and digital rights groups have suggested that the distinction between data processor and controller may not fully shield the data from US legal obligations under the Cloud Act.