Palantir agreements and data protection

Dear Home Office,

To whom this may concern,

I am writing to you on behalf of Privacy International, under the Freedom of Information Act 2000, I am seeking access to the following information:

1. Have you currently or in the past tested, piloted, or used any products or services developed by Palantir? If yes, could you list which ones and when.

2. Are any of these products or services used – or have been used – in contexts of immigration enforcement, border control, or policing/prevention or detection of crime? If yes, please specify which contexts and since when.

3. Specifically, do any of these products process (including collecting, retaining, sharing, storing or otherwise making available) personal data? If so,
a) What are the categories of personal data, including any metadata, processed by the Palantir products being tested, piloted or used? Please list the specific categories.
b) Can you list the exact categories of special-category personal data processed by Palantir products, such as personal data revealing among others nationality, information contained in asylum applications or applications for international protection, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, data revealing criminal convictions or offences.

4. Does the Home Office have or used to have a written contract(s) (or other legal act), as required by the Information Commissioner’s Office, with Palantir that governs the processing of personal data by Palantir? If yes, please provide a copy of such processing agreement(s)/contract(s). If not please explain why.

5. Do Palantir products process any non-personal data? If yes, can you list the categories of non-personal data that may be processed by Palantir products? Do, for example, process any aggregated data, anonymised or pseudonymised data? If so, does the Home Office control or process the non-personal data processed by the Palantir products?

6. Was there a Data Protection Impact Assessment done in relation to each of the Palantir products? If yes, please provide a copy of the Data Protection Impact Assessment Reports for each product. If not please explain why.

7. Has the ICO been notified in relation to the use of each of the Palantir products, including by communicating Data Protection Impact Assessments (DPIAs) to it and/or seeking its views on data processing matters in relation to any of the Palantir products?

8. Was there an Equality and Human Rights Impact Assessment done in relation to each of the Palantir products? If yes, please provide a copy of the Impact Assessment Reports for each product. If not please explain why.

9. Please provide copies of any current or past agreement(s)/contract(s) with Palantir.

10. Please provide any communications (meeting recordings, emails or other) between Palantir and the Home Office in the past 12 months relating to the above.

**If it is not possible to provide the information requested due to the information exceeding the cost of compliance limits identified in Section 12 of FOIA, please provide advice and assistance, under the Section 16 obligations of FOIA, as to how to refine this request. We would be grateful for any advice and assistance.

If you have any queries please don’t hesitate to contact us via email or phone and we will be very happy to clarify what we are asking for and discuss the request, our details are outlined below.

Thank you for your time and we look forward to your response.

Yours faithfully,

Dr Ilia Siatitsa
Programme Director and Legal Officer
Privacy International

Dear FOI Requests,

Thank you for confirming the receipt of our request.

We look forward to hearing from you.

Yours sincerely,
Ilia

Dr Ilia Siatitsa
Programme Director and Legal Officer
Privacy International

Dear Home Office,

To whom this may concern,

Following your letter on 15 October 2020, I have now revised the questions to limit the scope of the request as indicated in your correspondence.

In accordance with Section 16 obligations of FOIA your office should provide advice and assistance on how to limit the scope of the request. If it is still not possible to provide the information requested due to the information exceeding the cost of compliance limits identified in Section 12 of FOIA, please provide advice and assistance as to how to further refine this request.

On behalf of Privacy International, under the Freedom of Information Act 2000, I am seeking access to the following information:

1. Have you currently or in the past tested, piloted, or used any products or services developed by Palantir? If yes, could you list which ones, when and for what purpose, i.e. immigration enforcement, border control, or policing/prevention or detection of crime?

2. Could you list the categories of personal data processed by any of the Palantir products or services corresponding to question 1 above, including special-category personal data processed by Palantir products or services, such as personal data revealing among others nationality, information contained in asylum applications or applications for international protection, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, data revealing criminal convictions or offences.

3. Does the Home Office have or used to have written contract(s) (or other legal act such agreements), as required by the Information Commissioner’s Office, with Palantir that governs the processing of personal data by Palantir? If yes, please provide a copy of such processing contract(s)/agreement(s).

4. Was there a Data Protection Impact Assessment done by the Home Office in relation to each of the Palantir products? If yes, please provide a copy of the Data Protection Impact Assessment Reports for each product. If not, please explain why no data Protection Impact Assessment was done.

5. Please provide any communications (meeting recordings, emails or other) between Palantir and the Home Office from 01 April 2020 until 31 October 2020 relating to the above.

**As mentioned above if it is not possible to provide the information requested due to the information exceeding the cost of compliance limits identified in Section 12 of FOIA, please provide advice and assistance, in accordance with Section 16 obligations of FOIA, as to how to refine this request.

If you have any queries please don’t hesitate to contact us via email or phone and we will be very happy to clarify what we are asking for and discuss the request, our details are outlined below.

Thank you for your time and we look forward to your response.

Yours sincerely,

Dr Ilia Siatitsa
Programme Director and Legal Officer
Privacy International