Stored here, but whose law applies?

From the paper “Beyond Planning Permission”

The full text of the relevant sections of the paper, with its own numbered notes. Note numbers match the paper.

9. Digital Sovereignty, Jurisdiction and Public Trust

Data-centre discussions increasingly extend beyond environmental impacts and into questions of governance.

Modern cloud infrastructures commonly involve information being processed, stored and replicated across multiple locations. Ownership, operational control, legal responsibility and physical location may not always coincide.^135,136

This complexity has encouraged growing interest in concepts such as:

• data residency;
• digital sovereignty;
• sovereign cloud services;
• operational control.

Physical storage within a particular jurisdiction does not automatically resolve all questions of governance and accountability.

Whether existing arrangements are sufficient is ultimately a question of public policy rather than purely technical analysis.

10. International Data Transfers and Jurisdictional Complexity

Modern digital infrastructures routinely rely upon backup, replication and disaster-recovery arrangements extending across multiple sites.

Such arrangements typically improve resilience and service continuity.^137,138

At the same time, they may raise questions including:

• To what extent should backup locations be disclosed?
• Should different categories of information be treated differently?
• Is data residency equivalent to data sovereignty?
• How should resilience benefits be balanced against increasing jurisdictional complexity?

These questions do not imply flaws in existing arrangements. They reflect the reality of increasingly sophisticated and geographically distributed digital infrastructures.

The author admits to being unable to resolve apparent issues that appear to arise as between the GDPR and the way in which the internet seems to operate.

A search can be carried out with a result that the person searching will be supplied with information that might be gathered from any jurisdiction connected to the WWW where such information is available to a search engine. In the same way, a search from another jurisdiction can result in information being scraped from eg a website, social media etc where information may have been uploaded. Information and data can, in this way, find its way from the UK to any other jurisdiction without worrying about the limitations imposed on the transfer of information out of the jurisdiction.

This appraisal does not, cannot, explain how GDPR fits into this.

11. The CLOUD Act and International Governance

Legal commentators have identified continuing debate regarding the interaction between cross-border disclosure obligations under the United States CLOUD Act and European concepts of data sovereignty.

At the same time, UK organisations remain subject to UK GDPR and to applicable transfer mechanisms recognised by the Information Commissioner's Office.^139,140

The existence of these debates should not be interpreted as evidence of unlawful disclosures.

Rather, they demonstrate the complexity that can arise when infrastructure, information flows and legal authority operate across national boundaries.

We are looking at the issues that could arise in the near and distant future where the UK might be assuming a world order that did exist and hopes it will persist. At the same time huge power is to be vested in a few super rich individuals who are not elected representatives and whose ambitions might not align with the need to maintain what we presently consider to be a rule of law.

12. Public-Sector Data and National Sovereignty

Particular attention is often directed towards public-sector information.

Examples include:

• healthcare records;
• justice-system information;
• policing data;
• taxation records;
• critical-infrastructure information.

Questions raised in policy discussions include:

• Should certain categories of information remain under domestic legal control?
• Is physical storage within the UK sufficient?
• Should backup arrangements be subject to additional scrutiny?
• How should governments balance innovation, research, efficiency and sovereignty?

These questions concern governance and public confidence rather than simple technical compliance.

Questions of sovereignty should also be distinguished from questions of privacy. Information may be processed lawfully while debate continues regarding appropriate legal and operational control.

Recent experience: Palantir in the UK public sector, and the United States 'DOGE' episode

Two recent episodes show that the questions above are not abstract. Neither concerns a data centre in Wales, and neither is evidence that data held in the United Kingdom has been misused. They are included because they show how questions of control, as distinct from questions of physical location, arise in practice.

The first concerns Palantir Technologies, a US-headquartered data-analytics company. In November 2023 NHS England awarded Palantir a contract worth £330 million over seven years for its Federated Data Platform.¹⁴¹

NHS England states that each NHS trust and integrated care board remains the data controller for its own instance, that patient data is 'retained within the UK region', and that Palantir 'cannot commercialise or market NHS data, even on an anonymised basis'.¹⁴²

Palantir has since entered a strategic partnership with the Ministry of Defence, announced in September 2025 alongside up to £1.5 billion of Palantir investment in the United Kingdom and defence opportunities 'worth up to £750 million over the next five years',¹⁴³ and was selected in 2026 for a £9 million Home Office contract to replace the national firearms licensing system.¹⁴⁴ More than a quarter of the 43 police forces in England and Wales have been reported to be involved in Palantir pilots, although none of the forces named is Welsh.¹⁴⁵

In June 2026 the House of Commons Science, Innovation and Technology Committee concluded: 'Of the small number of technology providers that the UK public sector relies upon, Palantir concerns us most.'

It described Palantir's increasing presence across the public sector as 'an unacceptable point of weakness', while stating that this view was 'not ideologically motivated or driven by concerns about the quality of their products', and it recommended that the Government commit to exercising the February 2027 break clause in the Federated Data Platform contract.

More generally, the Committee found that 'the UK's reliance on a small number of US-based providers for digital infrastructure and public service delivery is a strategic and economic vulnerability', and recorded concerns that under the CLOUD Act US-headquartered companies 'could in principle be compelled to provide the US Government with access to UK customers' data held in their UK data centres' (see Section 11 above).¹⁴⁶ Separately, the platform's whole-life cost has been revised upwards to £1.1 billion and its forecast benefits reduced to £808 million; Palantir has said the programme 'remains on track from a project-delivery perspective'.¹⁴⁷

The Federated Data Platform is an NHS England programme. This appraisal has found no published information on whether NHS Wales bodies or the Welsh Government use Palantir software, and has not located a published Government response to the Committee's report.

The second episode concerns the United States 'Department of Government Efficiency' (DOGE) in 2025.

In June 2025 the US Supreme Court allowed DOGE team members access to Social Security Administration records while litigation continued.¹⁴⁸ In August 2025 the Administration's chief data officer, Charles Borges, made a whistleblower disclosure to the Office of Special Counsel and to Congress alleging that DOGE personnel had created 'a live copy of the country's Social Security information in a cloud environment that circumvents oversight', covering more than 300 million Americans. The Administration responded that the data was held in a secure environment and that it was 'not aware of any compromise'.¹⁴⁹

In January 2026, however, a Justice Department court filing acknowledged that DOGE staff had shared data through links on a third-party server, Cloudflare, and that the Administration did not know what data had been shared or whether it remained there.¹⁵⁰

A further, anonymous, allegation in March 2026, that a former DOGE engineer had retained Social Security databases on a thumb drive, is under review by the Administration's Inspector General and has been denied by all those named.¹⁵¹

Palantir was reported in April 2025 to be involved in a separate DOGE effort to build a single 'mega API' for accessing Internal Revenue Service records.¹⁵²

This appraisal has found no evidence that Palantir was involved in the Social Security incidents described above, and none are inferred.

What follows is this appraisal's own inference, not a finding of any of the sources cited.

The lesson of these episodes is not that one company or one administration is uniquely untrustworthy. It is that legal and contractual safeguards for data are only as strong as the willingness and ability of those who operate the systems to observe them, and that the political direction of the state in which a provider is headquartered can change quickly.

In the United States case, the data was held by the state's own agencies in its own jurisdiction, and physical location gave no protection against people with wide administrative access acting outside normal controls.

Where public-sector data in Wales or England is held in UK data centres but processed using software or services from foreign-headquartered providers, operational control, audit, insider access and exit arrangements therefore deserve at least as much scrutiny as the location of the servers.

The author intends to put the following question in writing to the Welsh Government Cabinet Secretary with responsibility for health and social care, copied to the minister responsible for digital and data policy:

'Do NHS Wales bodies, Digital Health and Care Wales or the Welsh Government

• use, pilot or intend to procure data-analytics or data-platform software supplied by Palantir Technologies or any other US-headquartered provider for identifiable patient or citizen data;
• if so, who is the data controller, where is the data processed and backed up, what assessment has been made of exposure to the United States CLOUD Act, and what exit arrangements exist?'

No answer to a question in these terms has been identified. A request via WhatDoTheyKnow to Digital Health and Care Wales for any such contracts and data protection impact assessments could follow once a reply is received.

And another proposed to go to Kanishka Narayan MP, as Minister for Artificial Intelligence, asking that it be passed to the Secretary of State for Health and Social Care if the first part falls to that department:

'Will the Government accept the Science, Innovation and Technology Committee's recommendation to exercise the February 2027 break clause in the NHS Federated Data Platform contract; and what contingency plans has the Government made in case a US-headquartered provider of public-sector data infrastructure is compelled, under the CLOUD Act or otherwise, to give access to UK data or to withdraw its services?'

A request via WhatDoTheyKnow to NHS England for the exit plan for the Federated Data Platform contract could be a natural follow-up.

Control of computing power, not only of data

The questions above concern data. A parallel set of questions concerns computing capacity itself.

As one commentator has put it, 'Ownership, operating rights and contractual access decide who can use the machines - not the building's postcode.'¹⁵³ Four recent developments suggest that this is a practical rather than a theoretical concern.

First, the Government's plan for AI Growth Zones, published in November 2025, offers developers faster planning decisions, priority for grid connections and, in some regions, discounted electricity.

It states that 'onshore data centre capability is essential for protecting sensitive data' and that the Government's approach 'will ensure we have the ability to act independently and effectively where it matters most', while accepting that 'certain AI (artificial intelligence) workloads can and will be serviced offshore'.

This appraisal has found nothing in it requiring operators, in return for those advantages, to give the United Kingdom any right to reserve computing capacity in an emergency, to disclose who their customers are or what works is done, or to observe any restriction on foreign ownership or on foreign military or intelligence use.¹⁵⁴

The private partnership announced for the North East AI Growth Zone, Stargate UK, is described by OpenAI as strengthening the United Kingdom's 'sovereign compute capabilities', although it involves privately owned companies, two of them headquartered in the United States.¹⁵⁵

In June 2026 a decision taken in another country switched off advanced AI services for users in the United Kingdom.

On 12 June the United States Government directed that two of Anthropic's most advanced models, Fable 5 and Mythos 5, must not be made available to non-US nationals. Because it could not check users' nationality in real time, Anthropic suspended both models for all customers worldwide. The company complied while publicly disagreeing with the directive, which was lifted on 30 June, with access returning from 1 July.^156,157

One analyst observed that spreading services across several cloud providers does not protect a user against action taken against the model provider itself.¹⁵⁸ Where a service is switched off at source, it makes no difference in which country's data centre it would otherwise have run.

Independent safety testing depends on suppliers' cooperation. The Financial Times reported in September 2026 that the UK AI Security Institute was not given access to Anthropic's Mythos 5.1 before its release, although the Institute had evaluated earlier Anthropic models. The Government said that the Institute 'continues to work closely with industry partners, including Anthropic'.¹⁵⁹

Much of the capacity being built is dual-use. Several of the companies building or using AI infrastructure in the United Kingdom also serve the United States defence establishment. OpenAI, for example, was awarded a $200 million US Department of Defense contract in June 2025.¹⁶⁰ This appraisal has not identified any published requirement, for AI Growth Zones or more generally, that would prevent capacity on UK sites, built with the benefit of UK planning and grid priority, from being used for another state's military or intelligence work, or that would allow the UK Government to know whether it is.

What follows is the author's own inference, not a finding of any of the sources cited.

'Sovereign' capacity should mean capacity over which the United Kingdom has enforceable rights: to call on it in an emergency, to prevent it from being directed by another government against UK interests, and to know, at least by category, who uses it and for what. Such rights could be made conditions of the planning, grid and energy advantages now on offer, but they do not appear to have been sought. As with water and energy, the remedy is disclosure and enforceable terms, so that the public can see what is being obtained in return for public advantages.

Similar considerations apply to the public money now committed to AI. The Government has told Parliament that the Managing Partner of the £500 million Sovereign AI Fund was appointed through a competitive civil-service process in which ministers had no role, and that she is recused from decisions involving real or perceived conflicts of interest.¹⁶¹ Given the number of public and private roles that now touch AI investment, procurement and data-centre policy, a single published account of how conflicts of interest are recorded and managed across that field, for ministers, officials and fund managers alike, would strengthen public confidence.

The author intends shortly to put the following questions in writing to Kanishka Narayan MP, as Minister for Artificial Intelligence. First:

'What does the Government mean by sovereign AI capability in practice, and will it attach enforceable conditions to the planning, grid and energy advantages given to AI Growth Zones, including a right for the United Kingdom to reserve capacity in an emergency, a requirement that operators do not give another government's directions priority over their contracts with UK public bodies, disclosure to the Government of customer nationality and workload categories, and notification or prohibition of foreign military and intelligence workloads?'

A request via WhatDoTheyKnow to the Department for Business, Innovation, Science and Trade for any agreements or heads of terms with AI Growth Zone operators would show whether any such terms exist if no response is forthcoming.

Secondly:

'Following the United States directive of June 2026 that removed access to two AI models for all non-US nationals, what assessment has the Government made of the exposure of UK public services and businesses to foreign export-control and similar decisions affecting AI services and computing capacity, and what contingency arrangements are in place?'

A request via WhatDoTheyKnow for any such assessment could follow, although national-security exemptions may well be claimed.

Thirdly:

'Will the Government seek a statutory or contractual right for the AI Security Institute to test the most capable AI models before their release, given reports that it was not given pre-release access to Mythos 5.1?'

No answer to a question in these terms has been identified.

Fourthly:

'Will the Government publish a single account of how conflicts of interest are recorded and managed across AI investment, procurement and data-centre policy, including for ministers, officials and those managing the Sovereign AI Fund?'

A request via WhatDoTheyKnow to the Cabinet Office for the guidance applied could follow; records about individuals are likely to be withheld as personal data.

13. Regulatory Stability and International Confidence

International transfer frameworks depend not only upon legal rules but also upon confidence in the institutions responsible for implementing them.

The United Kingdom currently maintains adequacy arrangements and transfer mechanisms designed to support lawful international transfers, including transfers involving participating organisations in the United States.^162,163

Recent developments in the United States, including the Supreme Court decision in Trump v Slaughter, have prompted discussion among some observers regarding wider questions of institutional governance and regulatory stability. However, the case was not a data-protection case and did not alter UK GDPR, UK adequacy regulations or existing UK-US transfer arrangements.¹⁶⁴

Its relevance, if any, lies within broader discussions concerning institutional confidence rather than direct changes to data-protection law. However, it does demonstrate a weak link waiting to be broken and raising the question whether there is a GDPR-proof pipeline that is sufficiently solid for use at this time.

Sovereignty by dependence: a discussion point

Sections 9 to 13 above consider the legal mechanisms that govern where data is held and who may lawfully see it.

A further question, more speculative but potentially more important, is offered here as a point for discussion rather than as a finding. Whether, by allowing so much of the data belonging to their citizens, businesses and public institutions to be held by a small number of companies headquartered in another state, Western host nations have in practice ceded part of their sovereignty to that state - not by any treaty or deliberate decision, but by dependence.

The mechanism is simple to state.

A company remains subject to the laws of the state in which it is headquartered, wherever its servers happen to be.

If that state requires the company to produce, copy or withhold data, the company faces conflicting obligations. UK data protection law offers less protection here than is sometimes assumed. Article 48 of the EU GDPR provides that a judgment or decision of a court or authority outside the EU requiring personal data to be transferred or disclosed may be recognised or enforced only if it is based on an international agreement. The equivalent article was omitted from the UK GDPR when the Brexit transition period ended on 31 December 2020, so UK law now contains no express rule of that kind. A company asked by a foreign authority to hand over personal data held here must still comply with the general UK GDPR rules on transfers abroad, but there is no specific bar on giving effect to the foreign order.

Even in the EU, the protection binds the company, not the foreign state, and it works only if the company is willing and able to refuse. Where the penalty for defying its home state is heavier than the penalty for breaching the host nation's data protection law, the host nation's law may in practice give way.

A senior representative of one major cloud provider, asked under oath by a French Senate inquiry in June 2025 whether he could guarantee that French citizens' data would not be transmitted to a foreign government without French consent, answered that he could not, while adding that it had never happened.^165,166

Nor is this a matter of hypothesis so far as the law is concerned. At least two of the world's largest economies already have laws under which their authorities can require companies within their jurisdiction to produce data held abroad, or to support, assist and cooperate with state intelligence work. This appraisal deliberately does not single out any one state in the text: the point is structural, and would apply to whichever state is home to the companies on which a host nation comes to depend.¹⁶⁷

Legal compulsion is not the only lever.

A powerful state can also apply financial pressure, through sanctions or penalties directed at the companies themselves or at those they serve.

One recent episode illustrates the point, although it concerns access to a service rather than access to data.

After sanctions were imposed by one state on officials of the International Criminal Court in 2025, the Court's chief prosecutor was disconnected from the email service provided by a major technology company. That company first told a UK parliamentary committee that the disconnection had been the Court's own decision, and in February 2026 apologised and asked for the record to be corrected, stating that it had been in touch with the Court throughout the process that resulted in the disconnection.

The Court has since begun moving to open-source software provided through a European public body. An international institution's dependence on a single foreign provider was, in other words, capable of being turned against it by a third state's financial measures.^168,169

Access may also be obtained without any open demand at all.

In 2020 the Court of Justice of the European Union, invalidating an earlier transatlantic data transfer arrangement, found that the surveillance programmes of the state concerned were not limited to what is strictly necessary and did not give the people affected rights they could enforce in court.

Read with the material above, this suggests a sliding scale. How a powerful state might obtain material held by its own companies - by negotiated agreement, by legal compulsion, by financial pressure, or covertly - is likely to depend on the difference in power between that state and the host nation, and on how much the material matters to it. The host nation will often not know which, if any, has occurred.¹⁷⁰

A further possibility, which this appraisal has not seen in force anywhere and offers purely as its own inference, is that the state in which a custodian of another nation's data is based could in future legislate to require that custodian to copy that state in to data it holds, or to give that state's own businesses, investigators or agencies access to it, for commercial as well as security purposes. Nothing in the present arrangements identified in this appraisal would prevent such a law being passed, and a host nation's practical remedies once it was passed - other than moving its data elsewhere, at great cost and over many years - appear limited.

Some host nations have begun to respond.

France's SecNumCloud qualification for cloud services used by sensitive public bodies includes requirements intended to protect against the reach of non-European laws, including limits on non-European ownership and control.

Denmark's ministry for digitalisation announced in 2025 that it was moving its staff from proprietary office software to open-source alternatives, citing digital independence.

The United Kingdom has taken a different route. Its Data Access Agreement with one major partner state, in force since October 2022, creates a negotiated channel through which each country's authorities can make requests directly to service providers in the other, subject to safeguards - an approach that regulates access rather than preventing it. This appraisal has not identified any UK or Welsh Government policy that assesses the risk described in this section for public-sector or citizens' data held by foreign-headquartered providers, nor any requirement comparable to SecNumCloud. The point has particular force where, as at Bro Tathan (Section 16 below), a foreign-headquartered operator's infrastructure is sited on land owned by government itself.^171,172,173

None of this suggests that any company has acted unlawfully, or that data belonging to people in Wales or England has been disclosed in the ways described; the companies concerned state that they resist requests they consider unfounded. The risk is of low probability but high consequence, and once data has been taken it cannot be recovered. That is precisely the kind of risk to which the precautionary principle discussed in Section 17 below is directed. The question this appraisal asks is therefore not whether the risk will materialise, but what host nations are doing about it.

A suggested question, which the author intends to put in writing to the Welsh Government minister responsible for digital and data policy, and in parallel to Kanishka Narayan MP as Minister for Artificial Intelligence, asking him to pass it to the responsible minister if digital and data policy falls elsewhere, reads:

'What assessment has the Government made of the risk that data held for public bodies, businesses and citizens in Wales [the United Kingdom] by companies headquartered in another state could be accessed, copied or withheld as a result of that state's laws, sanctions or financial pressure on those companies, rather than under Welsh or UK law; and what safeguards - for example, requirements comparable to France's SecNumCloud qualification - are in place or under consideration for public-sector data, including data held at facilities such as Bro Tathan?'

No answer to a question in these terms has been identified in the Senedd Record, Hansard or via WhatDoTheyKnow to date. A freedom of information request via WhatDoTheyKnow to the Welsh Government and to Digital Health and Care Wales, seeking any risk assessment of foreign-law exposure in their principal cloud contracts, could be a useful parallel step; any answer received could then be compared with the safeguards adopted in France and Denmark.

Notes from the paper

1. 135. Information Commissioner's Office, Adequacy Regulations (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/
2. 136. Information Commissioner's Office, UK Extension to the EU-US Data Privacy Framework (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/how-does-the-uk-extension-to-the-eu-us-data-privacy-framework-work/
3. 137. Information Commissioner's Office, Adequacy Regulations (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/
4. 138. Information Commissioner's Office, UK Extension to the EU-US Data Privacy Framework (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/how-does-the-uk-extension-to-the-eu-us-data-privacy-framework-work/
5. 139. Information Commissioner's Office, Adequacy Regulations (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/
6. 140. Information Commissioner's Office, UK Extension to the EU-US Data Privacy Framework (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/how-does-the-uk-extension-to-the-eu-us-data-privacy-framework-work/
7. 141. The Stack, 'NHS signs Palantir up under £330 million NHS data contract' (21 November 2023). https://thestack.technology/nhs-signs-palantir-up-under-330-million-nhs-data-contract
8. 142. NHS England, 'NHS Federated Data Platform: frequently asked questions'. https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/fdp-faqs/
9. 143. Ministry of Defence, 'New strategic partnership to unlock billions and boost military AI and innovation' (press release, 18 September 2025). https://www.gov.uk/government/news/new-strategic-partnership-to-unlock-billions-and-boost-military-ai-and-innovation
10. 144. PublicTechnology, 'Palantir picked for new £9m national gun database as MPs join opposition to US firm's public sector deals' (3 June 2026). https://www.publictechnology.net/2026/06/03/business-and-industry/palantir-picked-for-new-9m-national-gun-database-as-mps-join-opposition-to-us-firms-public-sector-deals/
11. 145. Computing, 'More than a quarter of England and Wales police forces now involved in Palantir pilots' (7 September 2026), reporting research by the Financial Times; the forces named are all English, together with the Metropolitan Police. https://www.computing.co.uk/news/2026/government/more-than-a-quarter-of-england-and-wales-police-forces-now-involved-in-palantir-pilots
12. 146. House of Commons Science, Innovation and Technology Committee, 'Rewiring the state: Delivering digital government' (report, 3 June 2026), conclusions and recommendations on Palantir, technological sovereignty and the CLOUD Act; see also the Committee's press notice of the same date. https://publications.parliament.uk/pa/cm5902/cmselect/cmsctech/61/report.html https://committees.parliament.uk/committee/135/science-innovation-and-technology-committee/news/214048/mps-warn-that-palantirs-increasing-presence-in-the-uk-public-sector-is-an-unacceptable-point-of-weakness/
13. 147. Computing, 'NHS Palantir platform's business case under pressure as costs rise and benefits fall' (10 August 2026). https://www.computing.co.uk/news/2026/government/nhs-palantir-platform-s-business-case-under-scrutiny-as-costs-rise-and-benefits-fall
14. 148. Supreme Court of the United States, Social Security Administration v American Federation of State, County and Municipal Employees, No 24A1063, order of 6 June 2025 staying the preliminary injunction pending appeal. https://www.supremecourt.gov/opinions/24pdf/24a1063_6j37.pdf
15. 149. Government Accountability Project, 'Whistleblower warns of possible risks to Americans' Social Security information' (press release, 26 August 2025); for the Administration's response, see Government Accountability Project, 'Whistleblower claims DOGE compromised Social Security data of hundreds of millions of Americans' (reproducing The Independent). https://whistleblower.org/press-release/whistleblower-warns-of-possible-risks-to-americans-social-security-information/ https://whistleblower.org/in-the-news/the-independent-whistleblower-claims-doge-compromised-social-security-data-of-hundreds-of-millions-of-americans/
16. 150. Government Executive, 'DOGE officials face Hatch Act referrals for work with org aiming to "overturn election results"' (January 2026), reporting the Justice Department's court filing of January 2026. https://www.govexec.com/management/2026/01/doge-officials-face-hatch-act-referrals-work-org-aiming-overturn-election-results/410825
17. 151. NPR, 'The government is investigating new claims that DOGE misused Social Security data' (12 March 2026), as published by OPB. https://www.opb.org/article/2026/03/12/new-investigations-look-at-doge-and-social-security-data/
18. 152. Wired, 'Palantir is helping DOGE with a massive IRS data project' (April 2025), as summarised by beSpacific (12 April 2025). https://www.bespacific.com/?p=112372
19. 153. Nation.Cymru, 'AI Minister Kanishka Narayan criticised in new book' (9 October 2026), quoting the author Thomas Vale. https://nation.cymru/news/ai-minister-kanishka-narayan-criticised-in-new-book/
20. 154. Department for Science, Innovation and Technology, 'Delivering AI Growth Zones' (policy paper, 13 November 2025). https://www.gov.uk/government/publications/delivering-ai-growth-zones/delivering-ai-growth-zones
21. 155. OpenAI, 'Introducing Stargate UK' (16 September 2025), with NVIDIA and Nscale; see also Department for Science, Innovation and Technology, 'North East England set for billions in investment and thousands of jobs as UK and US ink tech partnership' (September 2025), confirming that Cobalt Park forms part of the North East AI Growth Zone. https://openai.com/index/introducing-stargate-uk/ https://www.gov.uk/government/news/north-east-england-set-for-billions-in-investment-and-thousands-of-jobs-as-uk-and-us-ink-tech-partnership
22. 156. Anthropic, 'Statement on the directive to suspend Fable 5 access' (12 June 2026). https://www.anthropic.com/news/fable-mythos-access
23. 157. CIO, 'US reverses export restrictions on Anthropic's Fable 5, Mythos 5 AI models' (30 June 2026). https://www.cio.com/article/4191550/us-reverses-export-restrictions-on-anthropics-fable-5-mythos-5-ai-models.html
24. 158. CIO, 'US reverses export restrictions on Anthropic's Fable 5, Mythos 5 AI models' (30 June 2026). https://www.cio.com/article/4191550/us-reverses-export-restrictions-on-anthropics-fable-5-mythos-5-ai-models.html
25. 159. ITPro, 'Anthropic reportedly withholds access to Mythos 5.1 from UK safety testing body' (9 September 2026), reporting the Financial Times; see also The Next Web, 'Anthropic kept Mythos 5.1 from the UK's AI safety testers' (10 September 2026). https://www.itpro.com/technology/artificial-intelligence/anthropic-reportedly-withholds-access-to-mythos-5-1-from-uk-safety-testing-body https://thenextweb.com/news/anthropic-mythos-5-1-uk-aisi-pre-release-testing-withheld
26. 160. Bloomberg, 'OpenAI Snags $200 Million Contract With US Defense Department' (17 June 2025). https://www.bloomberg.com/news/articles/2025-06-17/openai-snags-200-million-contract-with-us-defense-department
27. 161. UK Parliament, written question on Sovereign AI Unit appointments, answered 22 May 2026. https://www.parallelparliament.co.uk/question/864/sovereign-ai-unit-public-appointments
28. 162. Information Commissioner's Office, Adequacy Regulations (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/
29. 163. Information Commissioner's Office, UK Extension to the EU-US Data Privacy Framework (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/how-does-the-uk-extension-to-the-eu-us-data-privacy-framework-work/
30. 164. Trump v Slaughter, 609 U.S. ___ (2026). The decision concerned presidential removal powers relating to FTC commissioners and did not alter UK GDPR, adequacy regulations or UK-US transfer arrangements. https://supreme.justia.com/cases/federal/us/609/25-332/
31. 165. EU GDPR, Article 48 ('Transfers or disclosures not authorised by Union law'), under which a judgment or decision of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement (second link). The corresponding article of the UK GDPR was omitted with effect from 31 December 2020 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), Schedule 1, paragraph 41; only its heading remains on the UK legislation database (first link). https://www.legislation.gov.uk/eur/2016/679/article/48 https://gdpr-info.eu/art-48-gdpr/
32. 166. The Register, 'Microsoft admits it cannot guarantee data sovereignty' (25 July 2025), reporting the evidence of Anton Carniaux, Microsoft France's director of public and legal affairs, to a French Senate inquiry on 18 June 2025, in the context of the United States CLOUD Act. https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/
33. 167. Examples include the United States CLOUD Act 2018 (see n 166 above) and Articles 7 and 14 of the National Intelligence Law of the People's Republic of China (2017, amended 2018), Article 7 of which provides that 'all organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law'. The examples are given to show that the issue is not confined to one state. https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-c-2017/
34. 168. The Register, 'Microsoft throws spox under the bus in ICC email flap' (18 February 2026), reporting Microsoft's apology to the House of Commons Business and Trade Committee and its request that the record be corrected; see also Computer Weekly, 'Microsoft's ICC email block reignites European data sovereignty concerns' (23 May 2025). https://www.theregister.com/2026/02/18/microsoft_asks_uk_parliament_to_correct_record/ https://www.computerweekly.com/opinion/Microsofts-ICC-email-block-reignites-European-data-sovereignty-concerns
35. 169. The Register, 'International Criminal Court dumps Microsoft Office' (31 October 2025), reporting the Court's move to openDesk, an open-source suite provided by Germany's Centre for Digital Sovereignty (ZenDiS) on behalf of the German Federal Ministry of the Interior. https://www.theregister.com/software/2025/10/31/international-criminal-court-dumps-microsoft-office/680564
36. 170. Court of Justice of the European Union, Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems ('Schrems II'), judgment of 16 July 2020; Court press release No 91/20. https://curia.europa.eu/site/upload/docs/application/pdf/2020-07/cp200091en.pdf
37. 171. BSA | The Software Alliance, comments to ANSSI on SecNumCloud version 3.2 (15 November 2021), objecting to its 'immunity to extraterritorial legislation' requirements; for a summary of the requirements, including limits of 24% individually and 39% collectively on non-EU shareholdings, see Scalingo, 'SecNumCloud qualification (ANSSI): complete guide' (a cloud provider's guide, not an official source). https://www.bsa.org/policy-filings/france-bsas-comments-to-anssi-on-secnumcloud-version-32a https://scalingo.com/blog/secnumcloud-qualification-anssi-guide
38. 172. The Record, 'Danish government agency to ditch Microsoft software in push for digital independence' (June 2025), quoting the Danish Minister for Digitalisation, Caroline Stage Olsen. https://therecord.media/denmark-digital-agency-microsoft-digital-independence
39. 173. eucrim, 'UK-US E-Evidence Agreement in Force', reporting the entry into force of the UK-US Data Access Agreement on 3 October 2022. https://eucrim.eu/news/uk-us-e-evidence-agreement-in-force/