To ask the Secretary of State for Health whether (a) companies based in the United States and (b) UK subsidiaries of US companies have been contracted by his Department and its agencies to provide services involving the use, storage, processing or analysis of databases of personal information held by the Government on UK citizens in the last five years. (188218)

The Department including its agencies has no contract with a United States (US) registered service provider for information storage, processing or analysis.

The Department, including its agencies has engaged a United Kingdom subsidiary of a US registered service provider to manage (aspects of) storage, processing or analysis of personal information.

The Data Protection Act 1998 includes provisions to ensure that personal data benefits from adequate protection when it is transferred outside the European economic area¹ by UK data controllers. Contracts are based on UK contract law with the applicable statutory safeguards.

¹ The 27 EU member states plus Iceland, Liechtenstein and Norway.