UK watchdog urged to prove Palantir deal won't give Trump backdoor data access

The UK’s financial watchdog is being urged to prove its relationship with the US tech company Palantir will not provide the Trump administration with backdoor access to troves of sensitive citizen and commercial data.

A US law that can oblige tech companies to disclose information to American authorities may apply to Palantir’s deal to help the Financial Conduct Authority detect crime, Martin Wrigley MP, a member of the House of Commons science and technology select committee, has warned.

The $375bn tech company, co-founded by the Trump-supporting billionaire Peter Thiel, is expected to apply its AI systems to a wide range of the FCA’s information including case intelligence files, reports from lenders about proven and suspected frauds, consumer complaints and trawls of social media posts. The arrangement is now at a 12-week trial stage.

Wrigley, the Liberal Democrat MP for Newton Abbot, said: “My concern is the FCA is doing very significant investigations into sensitive data using a foreign-controlled company that could be advised to pass data across to the US government.”

The deal, first reported by the Guardian in March, has already drawn concern from MPs and campaigners. Palantir also supplies software to ICE, which is carrying out Trump’s immigration crackdown, and the Israeli military and has more than £500m in contracts with NHS England and the Ministry of Defence. On 21 May the London mayor, Sadiq Khan, blocked a £50m two-year deal between Palantir and the Metropolitan police to apply its AI to criminal intelligence data, citing a “serious breach” of procurement rules. He said Londoners only wanted to see public money spent with companies that “share the values of our city”.

The FCA, meanwhile, regulates the conduct of about 42,000 businesses and its responsibilities range from consumer protection to preventing financial crime and market abuse.

Concern about the sovereignty of UK public data is rising as authorities turn to US tech companies to apply AI to increase productivity and meet their aims.

Questioned over the Palantir deal, the FCA told the Commons Treasury select committee in March the US law in question – the US Cloud Act – does not apply and the regulator will remain the data controller at all times.

“There will not be any intelligence shared,” said Jessica Rusu, the FCA’s chief data, information and intelligence officer. Palantir does not “control” the data but is a “data processor”, the FCA has said.

But Wrigley said that “in the days of Donald Trump, control means whatever Trump thinks it means”. He has written to the finance watchdog demanding to “better understand on what legal basis the FCA believes that the US Cloud Act would not apply in these circumstances”.

One legal expert in data handling said the distinction between a controller and processor was misleading as data processors do not automatically fall out of scope of the US law. Instead, the surest way for a US company like Palantir to avoid having to provide information in response to a court order granted under the act is for the company to ensure it does not have access to any intelligible data.

Open Rights Group, a UK digital rights campaign, said the law “gives US authorities the right to access data held by businesses based in the US, such as Palantir”.

Mariano delli Santi, its legal and policy officer, said the US was not bound by UK legal frameworks which define the right of “data controllers” to decide how and why personal data is processed.

“By handing over data to Palantir, the FCA is pushing UK residents’ data into the meat grinder of the Trump administration,” he said, adding the data could also be subject to the USA Patriot Act, which explicitly covers financial data, and part of the Foreign Intelligence Surveillance Act, a US intelligence law allowing monitoring of non-citizens’ digital communications outside the US without a search warrant.

But Palantir cited three “glaring” reasons why what Wrigley fears “could never happen”.

“The Cloud Act does not give US law enforcement agencies unfettered access to data,” a spokesperson said. “It requires a serious criminal investigation and a judicial warrant before a request can even be made. In the event of such a request, US government guidance is clear that it should go to the organisations that control the data, not processors like Palantir. Because FCA data is encrypted with keys within the exclusive control of the FCA, it is not technically possible for Palantir to respond to such a request without the FCA’s direct involvement.”

An FCA spokesperson said: “This 12-week trial will test whether we can improve how we collate information so we’re better able to tackle financial crime and the distress it causes. Criminals aren’t slow to use technology to cause harm. We need to stay ahead of them. The data used in the trial will be fully encrypted and under our control. No one is able to access the unencrypted data without our authorisation.”