The UK's financial watchdog is facing calls to prove that its partnership with US tech company Palantir will not grant the Trump administration backdoor access to sensitive citizen and commercial data.
Concerns Over US Law
Martin Wrigley MP, a member of the House of Commons science and technology select committee, has warned that a US law known as the Cloud Act could compel Palantir to disclose information to American authorities. The $375 billion company, co-founded by Trump-supporting billionaire Peter Thiel, is set to apply its AI systems to a wide range of Financial Conduct Authority (FCA) data, including case intelligence files, fraud reports, consumer complaints, and social media posts. The arrangement is currently in a 12-week trial phase.
Wrigley, the Liberal Democrat MP for Newton Abbot, stated: "My concern is the FCA is doing very significant investigations into sensitive data using a foreign-controlled company that could be advised to pass data across to the US government."
Previous Controversies
The deal, first reported by the Guardian in March, has already drawn criticism. Palantir also supplies software to ICE, the Israeli military, and has contracts worth over £500 million with NHS England and the Ministry of Defence. In May, London Mayor Sadiq Khan blocked a £50 million deal between Palantir and the Metropolitan Police, citing a "serious breach" of procurement rules.
The FCA regulates approximately 42,000 businesses, with responsibilities ranging from consumer protection to preventing financial crime and market abuse.
FCA's Position
The FCA told the Commons Treasury select committee in March that the US Cloud Act does not apply, and the regulator will remain the data controller at all times. Jessica Rusu, the FCA's chief data officer, said: "There will not be any intelligence shared." The FCA maintains that Palantir is a "data processor" and does not "control" the data.
However, Wrigley countered: "In the days of Donald Trump, control means whatever Trump thinks it means." He has written to the FCA demanding clarification on the legal basis for its belief that the Cloud Act would not apply.
Legal Expert Views
One legal expert in data handling noted that the distinction between controller and processor is misleading, as data processors do not automatically fall outside the scope of the US law. The surest way for Palantir to avoid disclosure obligations is to ensure it does not have access to any intelligible data.
Open Rights Group, a UK digital rights campaign, stated that the law "gives US authorities the right to access data held by businesses based in the US, such as Palantir." Mariano delli Santi, its legal and policy officer, warned: "By handing over data to Palantir, the FCA is pushing UK residents' data into the meat grinder of the Trump administration." He added that the data could also be subject to the USA Patriot Act and the Foreign Intelligence Surveillance Act.
Palantir's Response
Palantir cited three reasons why Wrigley's fears "could never happen." A spokesperson said: "The Cloud Act does not give US law enforcement agencies unfettered access to data. It requires a serious criminal investigation and a judicial warrant. US government guidance is clear that requests should go to data controllers, not processors. Because FCA data is encrypted with keys under the FCA's exclusive control, it is not technically possible for Palantir to respond without the FCA's direct involvement."
An FCA spokesperson added: "This 12-week trial will test whether we can improve how we collate information to tackle financial crime. Criminals use technology to cause harm, and we need to stay ahead. The data used in the trial will be fully encrypted and under our control. No one can access the unencrypted data without our authorisation."
