To ask the Secretary of State for Defence whether (a) companies based in the United States and (b) UK subsidiaries of US companies have been contracted by his Department and its agencies to provide services involving the use, storage, processing or analysis of databases of personal information held by the Government on UK citizens in the last five years.
My Department including its agencies has engaged a US registered service provider and UK subsidiaries of US registered service providers to manage storage, processing or analysis of personal information during the last five years.
The Data Protection Act 1998 includes provisions to ensure that personal data benefits from adequate protection when it is transferred outside the European economic area(1) by UK data controllers. Contracts are based on UK contract law with the applicable statutory safeguards.
(1) The 27 EU member states plus Iceland, Liechtenstein and Norway.