The move to Office 365, which necessitated the storage of parliamentary data on Microsoft servers, was a core part of Parliament’s ICT Strategy to deliver improved services, connecting Members to the information that they need from anywhere, at any time and from any device.

Parliamentary ICT worked in collaboration with the Parliamentary Security Director, the Senior Information Risk Owners of both Houses, counsel, other parties and the supplier to assess the risks of the proposed new arrangements. Any risks in relation to conventional cyber-attacks were assessed to be sufficiently mitigated and the risk of potential cross jurisdictional action was considered to be negligible (for example, under the USA PATRIOT Act) given the reassurances that were received.

It would not be for me to comment on possible or actual activities of another country’s authorities.

Storage of Parliamentary data is a matter for the House authorities. The application of the US's bilateral Mutual Legal Assistance Treaties (MLATs) with the Netherlands and the Republic of Ireland in regard to data held on Microsoft servers is a matter for those countries.