Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the personnel vetting and physical security requirements applied to cloud service providers holding police data are the same as those applied to UK-based policing suppliers; and if not, why not.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
I refer the Noble Lord to Question UIN HL4363 published on the 4 November.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government how many personnel of cloud service providers that hold police data have been vetted to Non-Police Personnel Vetting Level 2 (Full) or above since 2017; and which police force or body carried out that vetting.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Government does not routinely monitor the number of personnel vetted by individual police forces or policing bodies.
As the police are operationally independent it is the responsibility of Chief Constables to ensure that appropriate security and vetting arrangements are in place for personnel who have access to police information and systems, including those employed by suppliers.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government whether they intend to publish the conflicts assessment prepared in accordance with section 83 of the Procurement Act 2023 in relation to the award of a contract to Mila Quebec AI Institute in May 2025 for the delivery of the 2025/2026 International AI Safety Report; and if not, whether they intend to publish a summary of the conflicts and proposed mitigations recorded in the assessment.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
Section 83 of the Procurement Act 2023 requires contracting authorities to prepare, and keep under review, a conflicts assessment, and to confirm in the relevant procurement notice that this has been done. The Act does not require the conflicts assessment itself to be published. The Government has complied with this requirement by confirming in the relevant Contract Award Notice that a conflict of interest assessment was undertaken for this procurement.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what rules apply to AI Security Institute staff and advisers who hold roles with organisations that apply for, or receive funding from, programmes the Institute administers; whether a register of such roles is published; and which body is responsible for assessing the cumulative concentration of advisory, agenda-setting and funding-related roles among the same individuals and organisations following the transfer of responsibility for the Institute to the Cabinet Office.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The AI Security Institute’s staff are bound by the Civil Service Code, the Declaration and Management of Outside Interests guidance, and departmental Conflict of Interest Guidance. Staff are required to declare any outside interests that could give rise to an actual or perceived conflict. Declared interests are assessed and mitigated as appropriate.
Advisers are also subject to applicable conflict of interest, confidentiality and governance requirements through their terms of appointment, contracts or other engagement arrangements.
Conflicts of interest controls are also applied throughout the Institute’s commercial and grant-making activities, including procurement, supplier selection, contract award and management, grant assessment, award and ongoing grant management. Individuals involved must declare any actual, potential or perceived conflict before participating in contract or grant award decisions.
Senior Civil Servants' paid outside roles are published in line with cross Government requirements.
Following the Machinery of Government changes, responsibility for managing conflicts of interests at the AI Security Institute rests with the Cabinet Office Permanent Secretary as Accounting Officer.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government when they expect the Information Commissioner to publish guidance on international transfers of personal data for law enforcement purposes under Part 3 of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Information Commission has been reviewing all its guidance following the Data (Use and Access) Act 2025 coming into effect. The chapter on international transfers which sits within the existing Guide to Law Enforcement Processing has been a part of that process. We expect the updated chapter to be published before the end of 2026.
There is a formal requirement for organisations to consult with the Information Commission pursuant to Section 65(2) of the Data Protection Act 2018 or Article 36(1) of the UK GDPR in relation to high risks identified in a Data Protection Impact Assessment. We understand that a consultation was made. The Information Commission has, in addition, engaged informally with law enforcement authorities on issues relating to the use of cloud services for law enforcement processing.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the Information Commissioner's Office was consulted on the migration of police data to Microsoft cloud services, either before 2017 or at any point since.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Information Commission has been reviewing all its guidance following the Data (Use and Access) Act 2025 coming into effect. The chapter on international transfers which sits within the existing Guide to Law Enforcement Processing has been a part of that process. We expect the updated chapter to be published before the end of 2026.
There is a formal requirement for organisations to consult with the Information Commission pursuant to Section 65(2) of the Data Protection Act 2018 or Article 36(1) of the UK GDPR in relation to high risks identified in a Data Protection Impact Assessment. We understand that a consultation was made. The Information Commission has, in addition, engaged informally with law enforcement authorities on issues relating to the use of cloud services for law enforcement processing.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what assessment they have made of whether police forces' reliance on internet-delivered cloud services is consistent with their duties as Category 1 responders under the Civil Contingencies Act 2004.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
Police forces are operationally independent, and Chief Constables are responsible for determining the most appropriate hosting arrangements for their local systems, including the extent to which they utilise internet-delivered cloud services.
As Category 1 responders under the Civil Contingencies Act 2004, forces must ensure they are able to maintain critical functions and respond effectively to emergencies. Decisions relating to technology hosting, resilience and business continuity therefore form part of forces' own risk management, resilience and assurance arrangements. The Government does not routinely monitor assessments undertaken by the police
Where national police capabilities are delivered by the Home Office using internet delivered cloud services there is a robust assessment of security, resilience, continuity and operational requirements.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what plans they have, if any, to publish all information risk assessments prepared by or for the National Enabling Programme in respect of the adoption of Microsoft Office 365 and Azure by police forces, together with any subsequent risk assessments about this that are currently active.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The National Enabling Programme (NEP) rolled out the Microsoft 365 (M365) suites and the Identity and Access Management capability to 40 forces. A redacted version of the NEP programme-level Data Protection Impact Assessment, dated December 2020, has been published and is publicly available online.
As data controllers, individual police forces are responsible for assessing the risks associated with their implementation of the NEP.
The Government does not routinely monitor information risk assessments undertaken by the police and does not determine whether they should be published. Decisions on publication are a matter for policing, and there is no requirement on the police to publish such assessments.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether they intend to publish all information risk assessments prepared by or for the National Enabling Programme, including those prepared by external consultants, relating to the adoption of Microsoft 365 and Microsoft Azure by police forces, together with any subsequent assessments currently in force.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The National Enabling Programme (NEP) rolled out the Microsoft 365 (M365) suites and the Identity and Access Management capability to 40 forces. A redacted version of the NEP programme-level Data Protection Impact Assessment, dated December 2020, has been published and is publicly available online.
As data controllers, individual police forces are responsible for assessing the risks associated with their implementation of the NEP.
The Government does not routinely monitor information risk assessments undertaken by the police and does not determine whether they should be published. Decisions on publication are a matter for policing, and there is no requirement on the police to publish such assessments.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what assessment they have made of whether police forces' use of Microsoft Azure and Microsoft 365 complies with the current international transfer provisions of Part 3 of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The College of Policing’s Vetting Code of Practice requires an appropriate level of vetting of individuals working in policing. This extends to contractors, where the role allows access to police information that is not publicly available. Individuals working for providers who are not based in the UK cannot be subject of police vetting since police vetting is completed against systems holding information from the UK. UK vetting authorities would therefore not have access to the full range of information necessary for vetting decisions.
However, as a result of various security requirements including encryption and legislative data protection requirements, individuals working for cloud service providers are unlikely to be able to access police data when contracted to process data for the police. If they do so, this is strictly under the control of the police and subject to an appropriate duty of confidentiality as data protection legislation requires.
The Home Office does not collect data in relation to the number of individuals who have police vetting or non-Police Personnel Vetting, which is an operational matter for police forces.