Question to the Home Office:

To ask His Majesty's Government whether the use of Microsoft cloud services by public bodies is limited to at and below the OFFICIAL classified information tier; and what assessment they have made of the compatibility of police use of cloud services with Microsoft's service terms regarding high risk use.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

The Government’s Cloud First Policy [Government Cloud First policy - GOV.UK] sets out the position for cloud use in the public sector, including particular considerations for information at different classification levels. It provides principles for the public sector to help navigate delivering technology solutions quickly, the associated cost and resources, and reducing risk.

In relation to police use specifically, it is for policing to determine their technology needs in line with government and policing guidance. However, when evaluating new technology to support and enhance data processing in law enforcement systems, the highest standards of data security are required from any technology provider.

Question to the Home Office:

To ask His Majesty's Government whether the 2017 security assessment concerning the use of Microsoft cloud services by police was subsequently revised or supplemented by further security or risk assessments; if so, on what dates; and whether they plan to publish these assessments.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

The Government would not routinely monitor such police assessments and there is no requirement on the police to publish internal security assessments.

As the police are operationally independent it is the responsibility of Chief Constables to ensure they contract appropriate suppliers, in line with national guidelines, who represent value for money and can meet their strict security requirements.

Question to the Home Office:

To ask His Majesty's Government how the Code of Practice on vetting issued under section 39A of the Police Act 1996 is applied to personnel of Microsoft and other cloud service providers, including sub-processors and personnel based overseas, who have access to police data or to systems holding police data.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.

Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.

Question to the Home Office:

To ask His Majesty's Government what evidence they have that police forces complied with the requirement in section 77(7) of the Data Protection Act 2018 to inform the Information Commissioner of international transfers of personal data, in the period from May 2018 until that requirement was amended by the Data (Use and Access) Act 2025.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.

Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.

Question to the Home Office:

To ask His Majesty's Government which terms in the contract signed with Microsoft concerning the use of cloud services by police prevent the sharing of data with the government of the USA without the express permission of the government of the UK; and whether those terms differ from Microsoft's standard terms of service.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.

Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.

Question to the Cabinet Office:

To ask His Majesty's Government when will the first AI Assurance Innovation Fund awards be announced; and what the typical award size will be.

Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)

The AI Assurance Innovation Fund will issue up to £11 million in funding to support the development of innovative and novel AI assurance mechanisms and help actors across the AI value chain identify and address the risks posed by high-capability AI systems, ensuring the UK is ready and equipped to respond to rapidly advancing AI capabilities.

The Centre for AI Measurement, led by the National Physical Laboratory, was established by Government to deliver on the objectives of the AI Assurance Innovation Fund, with a call for applications to be announced later this year. Fund awards will support industry, start-ups and researchers looking to develop novel assurance techniques in a variety of sectors.

Question to the Home Office:

To ask His Majesty's Government what arrangements exist for them to be notified of any request made by the government of the USA to a US-based cloud provider to produce data held on behalf of UK police; and whether the UK–US Data Access Agreement prevents US-based cloud provider from being compelled to produce this data.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

The UK-US Data Access Agreement (DAA) applies only to cross-border requests between the UK and the US. It enables law enforcement and security agencies to request data direct from telecommunications operators in the other party’s jurisdiction for the purposes of preventing, detecting, investigating and prosecuting serious crime.

The DAA contains targeting restrictions that prevent US authorities from targeting anyone located in the UK. The DAA does not govern requests made by US authorities to US-based providers.

Found: Representation of the People Bill 136 LORD CLEMENT-JONES LORD RUSSELL OF LIVERPOOL 217_ After Clause

Found: Representation of the People Bill 112 LORD CLEMENT-JONES _ After Clause 73, insert the following new

Found: LORD CLEMENT-JONES LORD RUSSELL OF LIVERPOOL _ After Clause 73, insert the following new Clause— “

Found: LORD CLEMENT-JONES 123_ Clause 52, page 36, line 18, leave out “health” and insert “direct patient”

Found: LORD CLEMENT-JONES LORD RUSSELL OF LIVERPOOL _ After Clause 73, insert the following new Clause— “

Found: LORD CLEMENT-JONES 127★_ Clause 52, page 36, line 37, at end insert— “(e) requiring any electronic

Found: Representation of the People Bill 78 LORD CLEMENT-JONES THE LORD BISHOP OF LEICESTER _ After Clause

Found: Clause 52 LORD CLEMENT-JONES _ Clause 52, page 36, line 15, after “available” insert “for the purpose

Found: Clause 9 LORD CLEMENT-JONES 2_ Clause 9, page 9, line 20, at end insert— “(3E) A person does not provide

Found: Health Bill 54 After Clause 52 LORD CLEMENT-JONES _ After Clause 52, insert the following new Clause

Found: Representation of the People Bill 74 LORD CLEMENT-JONES THE LORD BISHOP OF LEICESTER _ After Clause

Found: Clause 9 LORD CLEMENT-JONES _ Clause 9, page 9, line 20, at end insert— “(3E) A person does not provide

Found: Clause 52 LORD CLEMENT-JONES _ Clause 52, page 36, line 15, after “available” insert “for the purpose

Found: Representation of the People Bill 68 LORD CLEMENT-JONES THE LORD BISHOP OF LEICESTER _ After Clause

Found: Clause 9 LORD CLEMENT-JONES _ Clause 9, page 9, line 20, at end insert— “(3E) A person does not provide

Found: LORD CLEMENT-JONES _ After Clause 52, insert the following new Clause— “Single patient record: right

Found: prevent campaigning via the likes of BSL or Braille. 65 Representation of the People Bill LORD CLEMENT-JONES