The UK's financial watchdog, the Financial Conduct Authority (FCA), is facing increasing pressure to provide assurances that its partnership with US tech company Palantir will not inadvertently expose sensitive UK financial data to American authorities. This concern stems from the potential application of US disclosure laws, particularly the CLOUD Act, which could compel US-based companies to provide data to American agencies.
Critics, including a Member of Parliament and privacy campaigners, have voiced fears that such a scenario could lead to a future US administration, potentially led by Donald Trump, gaining access to confidential information belonging to UK citizens and businesses. The CLOUD Act allows US law enforcement to demand data stored by US tech companies, regardless of where that data is physically located, provided certain conditions are met.
The FCA has stated that the data it processes with Palantir will remain subject to UK law and will be stored within the United Kingdom. However, campaigners argue that the legal framework surrounding cross-border data access, especially with a US company, presents a grey area that needs clearer definition and robust protection for UK data subjects. They highlight the precedent set by previous US requests for data held by UK entities under similar circumstances.
The deal between the FCA and Palantir, which involves the use of Palantir's data analytics platforms, is intended to enhance the regulator's ability to detect market abuse and financial crime. While the FCA emphasises the operational benefits, the debate has shifted to the broader implications for data sovereignty and privacy, particularly given the political landscape in the United States and the potential for increased data demands from foreign governments.
Transparency is a key demand from those scrutinising the deal. There are calls for the FCA to publish more details about the contractual agreements with Palantir, specifically outlining the safeguards in place against foreign government access. This would include clarifying the legal mechanisms that would be invoked should a US authority attempt to exercise powers under the CLOUD Act concerning UK financial data.