Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what steps government departments and police forces have taken to implement the revised Government Security Classifications Policy published in June 2023; and how that implementation is being monitored.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
This Government takes the protection of its information assets extremely seriously, including keeping its protective security measures under review.
To implement the revised 2023 Government Security Classification Policy (GSCP) across Whitehall, the Cabinet Office took a number of steps, including: issuing guidance on implementation timelines; distributing a range of training resources and communications material; and providing guidance on enabling the policy on departmental IT systems.
Cross-government compliance with the GSCP is routinely monitored by the Cabinet Office under its existing annual assurance regime, the Departmental Security Health Check.
Police forces are operationally independent from the UK Government and therefore manage their own information security policies.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government when they expect the Information Commissioner's Office to publish guidance on international transfers of personal data for law enforcement purposes under Part 3 of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Information Commission has been reviewing all its guidance following the Data (Use and Access) Act 2025 coming into effect. The chapter on international transfers which sits within the existing Guide to Law Enforcement Processing has been a part of that process. We expect the updated chapter to be published before the end of 2026.
There is a formal requirement for organisations to consult with the Information Commission pursuant to Section 65(2) of the Data Protection Act 2018 or Article 36(1) of the UK GDPR in relation to high risks identified in a Data Protection Impact Assessment. We understand that a consultation was made. The Information Commission has, in addition, engaged informally with law enforcement authorities on issues relating to the use of cloud services for law enforcement processing.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the Information Commissioner's Office was consulted on the migration of police data to Microsoft cloud services, either before 2017 or at any point since.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Information Commission has been reviewing all its guidance following the Data (Use and Access) Act 2025 coming into effect. The chapter on international transfers which sits within the existing Guide to Law Enforcement Processing has been a part of that process. We expect the updated chapter to be published before the end of 2026.
There is a formal requirement for organisations to consult with the Information Commission pursuant to Section 65(2) of the Data Protection Act 2018 or Article 36(1) of the UK GDPR in relation to high risks identified in a Data Protection Impact Assessment. We understand that a consultation was made. The Information Commission has, in addition, engaged informally with law enforcement authorities on issues relating to the use of cloud services for law enforcement processing.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what steps government departments and police forces have taken to implement the revised Government Security Classifications Policy published in June 2023; and how that implementation is being monitored.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
This Government takes the protection of its information assets extremely seriously, including keeping its protective security measures under review.
To implement the revised 2023 Government Security Classification Policy (GSCP) across Whitehall, the Cabinet Office took a number of steps, including: issuing guidance on implementation timelines; distributing a range of training resources and communications material; and providing guidance on enabling the policy on departmental IT systems.
Cross-government compliance with the GSCP is routinely monitored by the Cabinet Office under its existing annual assurance regime, the Departmental Security Health Check.
Police forces are operationally independent from the UK Government and therefore manage their own information security policies.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question
To ask His Majesty's Government what arrangements are in place within the Government Digital Service to ensure that staff who raise security concerns about GOV.UK One Login can do so without detriment; and what assessment they have made of the effectiveness of those arrangements.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The Department for Digital, Culture, Media and Sport (DCMS) has a robust whistleblowing policy in place and individuals are encouraged to raise a concern immediately if they are concerned about any wrongdoing. If a concern is raised through the policy procedures, the individual will be protected. Information on this departmental policy can be found on the department’s intranet.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what role, if any, members of the expert advisory board for the AI Security Institute's Alignment Project have in individual funding decisions; what (1) interests those members declared, and (2) recusal arrangements were adopted, during the first funding round; and what was the total value and composition of the support awarded to LawZero.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The Alignment Project is a global fund dedicated to accelerating progress in AI alignment research. It is led by the AI Security Institute and backed by an international coalition of governments, industry, venture capital and philanthropic funders. Since its launch over £27 million has been awarded to 60 projects dedicated to accelerating progress in AI alignment research. LawZero was awarded a grant of up to £697,756 over 21 months (June 2026 to March 2028), comprising of staff costs and overheads.
Grants are awarded via a multi-stage application and review process, operated in line with established government grant-making procedures. The Alignment Project's Expert Advisory Board has no role in individual grant selection or funding decisions of the Alignment Project.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Department for Environment, Food and Rural Affairs:
To ask His Majesty's Government what plans they have to protect research and development, and a path to production and sale, of precision bred products.
Answered by Baroness Hayman of Ullock - Parliamentary Under-Secretary (Department for Environment, Food and Rural Affairs)
Precision breeding remains subject to ongoing negotiations between the UK and the EU as part of the SPS agreement. The EU has however accepted there will need to be some areas where we retain our own rules. This includes research and development where we have confirmed that we will continue our regulatory approach to support science and innovation in the UK. Defra has also funded a £12.5 million Farming Innovation Programme competition specifically to support innovation in precision breeding, and Defra’s Genetic Improvement Networks Platform provides £15 million to support precision breeding for priority traits in key crops.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what arrangements exist for them to be notified of any request made by the government of the USA to a US-based cloud provider to produce data held on behalf of UK police; and whether the UK–US Data Access Agreement prevents US-based cloud provider from being compelled to produce this data.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The UK-US Data Access Agreement (DAA) applies only to cross-border requests between the UK and the US. It enables law enforcement and security agencies to request data direct from telecommunications operators in the other party’s jurisdiction for the purposes of preventing, detecting, investigating and prosecuting serious crime.
The DAA contains targeting restrictions that prevent US authorities from targeting anyone located in the UK. The DAA does not govern requests made by US authorities to US-based providers.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the use of Microsoft cloud services by public bodies is limited to at and below the OFFICIAL classified information tier; and what assessment they have made of the compatibility of police use of cloud services with Microsoft's service terms regarding high risk use.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Government’s Cloud First Policy [Government Cloud First policy - GOV.UK] sets out the position for cloud use in the public sector, including particular considerations for information at different classification levels. It provides principles for the public sector to help navigate delivering technology solutions quickly, the associated cost and resources, and reducing risk.
In relation to police use specifically, it is for policing to determine their technology needs in line with government and policing guidance. However, when evaluating new technology to support and enhance data processing in law enforcement systems, the highest standards of data security are required from any technology provider.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the 2017 security assessment concerning the use of Microsoft cloud services by police was subsequently revised or supplemented by further security or risk assessments; if so, on what dates; and whether they plan to publish these assessments.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Government would not routinely monitor such police assessments and there is no requirement on the police to publish internal security assessments.
As the police are operationally independent it is the responsibility of Chief Constables to ensure they contract appropriate suppliers, in line with national guidelines, who represent value for money and can meet their strict security requirements.