Written questions by Wrigley.

What plans his Department has to ensure that (a) cloud hosting, (b) data processing and (c) other core components of the proposed digital ID system are under sovereign UK control.

Data associated with the Digital ID system will be held and kept safe in secure cloud environments hosted in the United Kingdom. The Government will work closely with expert stakeholders to make the programme effective, secure and inclusive, including taking insights from previous IT projects where appropriate.

Whether it is his Department's policy that the proposed digital ID scheme will be overseen by an independent body to (a) monitor compliance, (b) investigate misuse and (c) publish annual transparency reports.

The Digital ID scheme will build on existing programmes and infrastructure. We will follow best practice on privacy and security, from both within the UK and internationally. The National Cyber Security Centre Security (NCSC) is advising how this is done to the highest standard. We will adhere to all existing UK law and governance structures, including close working with the ICO during the development of the scheme. We will examine options for appropriate oversight of the digital ID system through the upcoming consultation, which will begin in the new year.

What (a) offline and (b) paper-based alternatives will be available for citizens without (i) digital access and (ii) smartphones under the proposed digital ID system.

To design and deliver digital ID, this government will undertake the biggest digital inclusion drive in our country's history. This will ensure everyone eligible can access and use this new digital ID, including those more likely to be digitally excluded. We are considering options like a digitally enabled physical alternative for those without access to technology, help for those who are partially sighted, in-person support for those who struggle to engage digitally, and a dedicated team of case workers to support those who may struggle to initially prove their identity and access the system. We will launch a public consultation in the coming months and have already started to engage with a range of expert organisations and community groups, including the Digital Inclusion Action Committee.

What assessment his Department has made of the risk from non-government actors to people's personal data security under the proposed digital ID scheme; and what (a) technical and (b) legal controls will be used to mitigate this.

The cyber security of the UK is a key priority for this government – crucial to protecting the public and our way of life, and a successful, growing economy. We are introducing the Cyber Security and Resilience Bill to improve UK cyber defences - protecting our economy, safeguarding essential public services and strengthening UK national security. The bill will deliver a fundamental step change in the UK’s national security – making essential and digital services more secure in the face of cyber criminals and state actors who want to disrupt our way of life. This framework will be applied to the new digital ID, which will have robust cyber security and personal data protections in place. These will also feature in the upcoming consultation on the scheme.

What types of cross-system data matching he is planning under the proposed digital ID system.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

Whether proposals for digital ID include a centralised audit log of verification events.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

What process the he is planning for (a) employers and (b) landlords to verify digital ID credentials; and whether that process will require personal data to be transmitted to a (i) central record and (ii) broker service.

Employers will be required to conduct digital right to work checks using the new digital credential by the end of this Parliament.We will be consulting on the detail of the programme in due course, including how to help employers onboard onto the system and how they will validate the credential to prove an employee's right to work.There are no plans to pool data in a single location. The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.

Whether his digital ID proposals will use (a) biometric and (b) facial-recognition technology for age verification.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

What assessment he has made of the potential merits of allowing people using the UK digital ID system to have the right to view an access log showing (a) which and (b) organisations checked their identity.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

Whether he plans to take steps to prevent commercial entities acting as digital ID verifiers from using verification data for (a) marketing, (b) analytics and (c) employment profiling.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

What steps he plans to take to ensure that any AI-assisted (a) decision and (b) image recognition within the digital ID system is (i) explainable, (ii) human-reviewed before adverse action, and (iii) subject to a right of correction or appeal.

The Government will conduct a full public consultation on the new digital ID to inform our approach. We are currently exploring best practice from other countries with digital identity schemes and other private sector companies who have digitised their services in order to develop the set of proposals to take to public consultation.The Government has been clear that privacy and security will be hard-wired into the system from the start, and user control will be central to plans. It will operate to best practice standards for security and privacy.This includes established standards for cyber security, counter-fraud and data storage, and following all existing UK legislation.

Whether (a) Palantir Technologies (b) other analytics contractors and (c) external data warehouses are being considered to support cross-departmental data matching under the digital ID initiative.

We expect the new digital ID to be designed, built and run by in-house Government teams, not outsourced to external suppliers. In the event any specialist external services or expertise are procured to support the delivery of new digital ID, this will be subject to all the usual competitive processes to ensure transparency, and value for the taxpayer.

Whether the Prime Minister plans to attend COP30 in Brazil.

The Prime Minister plans to attend COP30.

What guidance was in use in 2019 on keeping written records of meetings between Ministers and external stakeholders.

Guidance for the Management of Private Office Information and Records is published on www.gov.uk. The guidance was last updated in December 2023. Previous versions are available on the website of The National Archives.

Whether the then Prime Minister met Peter Thiel between July 2019 and September 2022.

Details of official meetings held in a ministerial capacity with external organisations or individuals are declared quarterly on GOV.UK. This includes the meetings of the former Prime Minister.

If he will publish a list of (a) call-off contracts, (b) contract values and (c) delivery milestones awarded to Palantir Technologies under Crown Commercial Service frameworks since 2020.

Crown Commercial Service (CCS) does not maintain a centralised list of all call-off contracts, values, or delivery milestones awarded to Palantir Technologies. Details of individual call-off contracts, including contract values and delivery milestones, are publicly available on the Contracts Finder website: https://www.contractsfinder.service.gov.uk. Contracts Finder lists information on government contracts worth over £12,000 (including VAT), including those awarded by departments and agencies across the public sector. It is the responsibility of the contracting authority to upload contract information to Contracts Finder.

What assessment he has made of the adequacy of the compliance of Palantir Technologies Ltd with transparency obligations under the Public Contracts Regulations 2015 prior to 2021.

The transparency obligations prior to 2021 would have been managed directly by the awarding department or contracting authority. Details of Government contracts awarded prior to 2021 above £10,000 in Central Government, and £25,000 in the wider public sector, should be published on Contracts Finder: https://www.contractsfinder.service.gov.uk/Search

Whether his Department has issued guidance on considering political neutrality when awarding government contracts.

The Procurement Act 2023 requires contracting authorities to act, and to be seen to act, with integrity, and has introduced new requirements to identify and review any potential conflicts of interest in relation to a procurement. Contracting Authorities must now prepare a conflict of interest assessment at key points in the procurement, including details of any actual or potential conflicts of interest and any steps they have taken to mitigate them.

What contracts their Department has with Palantir.

Details of central government contracts above £12,000 for procurements commenced before 24 February 2025 are published on Contracts Finder. Contracts procured under the Procurement Act 2023, which came into force on 24 February 2025, are published on the Central Digital Platform Find a Tender service.

Whether his Department has undertaken a cross-Government security risk assessment of sensitive data contracts awarded to Palantir Technologies Inc.

It is long-standing policy that the Government does not disclose the specifics of its security arrangements, including with suppliers.The UK takes national security extremely seriously and has taken robust action to ensure the security of sensitive government data. As set out in the recent National Procurement Policy Statement, the Government mitigates supply chain and national security risks by ensuring appropriate data and security controls are in place. All contracting authorities are encouraged to follow the Government Security Group’s guidance on Tackling Security Risk in Government Supply Chains, which details best practices for procurement, commercial, and security practitioners when selecting and onboarding suppliers.We also encourage organisations to adhere to the National Cyber Security Centre and the National Protective Security Authority’s supply chain security guidance when selecting technology suppliers, which outlines the required security standards and procurement considerations.The National Security Unit for Procurement (NSUP) has been established to support Ministers in assessing suppliers on national security grounds in line with the Procurement Act 2023. NSUP works closely with government departments to oversee implementation of these measures and enhance supplier security assessments across the procurement process.