NHS England owns the keys. The Privacy Enhancing Technology (PET) software generates, controls, and stores the key values securely, so they are not accessible to human users.

The use of encryption keys is strictly controlled by NHS England for the NHS Federated Data Platform (NHS FDP) tenant and by the data owners of local tenants.

Both the NHS FDP and PET contracts are based on Government Legal Department terms and conditions, aligning to best practice in respect of cyber security and security management, which is reflected in the redacted versions of the agreements available on Contracts Finder.

The contract terms reflect and support the management of encryption keys as set out above, where specific requirements relate to encryption keys this would be included in the specifications of the contracts. Both agreements have terms which ensure enforcement of United Kingdom legislation and regulatory requirements in relation to data processing. For reference, the NHS FDP contract can be found at the following link:

https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0

In addition, the NHS England PET contract can be found at the following:

https://www.contractsfinder.service.gov.uk/Notice/2fa49293-bc01-4e0f-a017-f01cb0195212

GCS works closely with media partners and makes use of advanced technical capabilities, including artificial intelligence-driven tools, verification systems, and third-party brand safety tools, to ensure official content is served in safe, authentic, and suitable environments.

GCS continuously monitors developments from regulators to ensure that all platforms hosting official government messages uphold robust security measures.

The government is not considering hash matching to address the spread of mis- and disinformation. We recognise concerns and continue to explore options, but there is no single solution. Tackling such content requires a mix of regulation, law enforcement, education and technical solutions, balanced with freedom of expression – a fundamental right.

The Ministry of Defence (MOD) recognises that Crypt-Key is fundamental to the defence and security of the UK. The ability to develop Crypt-Key technologies and capabilities is a strategic imperative for the United Kingdom’s (UK) national security.

The National Crypt-Key Strategy and the Crypt-Key Industrial Strategy were approved by the National Security Council (NSC) in May 2022. The MOD has implemented the core strategy outcomes such as the Cabinet Office Spent Control measures for Crypt-Key and continues to support their full implementation.

The Defence Industrial Strategy (2025) continues to recognise Crypt-Key as a critical sub-sector where strategic imperative requires full, or majority, industrial capability to be UK-based.

The MOD has taken the appropriate steps to ensure alignment to the Crypt-Key strategies.

This Government supports strong encryption, which protects our citizens online. However, this must not and need not be at the expense of public safety, which is this Government’s first priority.

Targeted investigatory powers allow the authorities to investigate terrorists, paedophiles and the most serious criminals and are subject to robust safeguards, including judicial authorisations and oversight to protect people’s privacy.

We have been consistent that the increasing moves to end-to-end-encryption (E2EE) on private messaging spaces, without sufficient safeguards to maintain proactive detection of child sexual abuse (CSA) will have a significant impact on our ability to keep children safe.

In May this year, the National Centre for Missing and Exploited Children (NCMEC) published their Cyber Tipline report for the year of 2024. This report indicated that globally there were 7 million fewer incidents of suspected child sexual abuse material reported in 2024 compared with 2023, which was partly attributed to the increased rollout of E2EE.

The Government is implementing the Online Safety Act (OSA) regulatory framework, to ensure that online platforms do more to protect their users from illegal content on their services. The Government is clear that platform design, including E2EE does not exempt platforms from their obligations to protect children from CSA.

The Government is committed to using all available levers, such as the Online Safety Act, to ensure children are protected online, and we will not hesitate to go further if necessary.

Ofcom is responsible for assessing the possible implications of its codes of practice and guidance under the Online Safety Act (OSA).

As previously noted, the OSA does not ban any service design and the European Conventions of Human Rights (ECHR) requires all UK public bodies, including Ofcom, to act in a way that complies with ECHR rights. Companies are legal persons having rights afforded by the ECHR.

DSIT will carry out a Post Implementation Review to assess the effectiveness of the legislation, including how the OSA has addressed harmful online content while protecting UK users’ rights.

The Online Safety Act does not ban any service design, including end-to-end-encryption. Under the Act, providers must risk assess the design of their service. Ofcom can only recommend measures in codes of practice that are technically feasible. Separately, Ofcom has powers to direct companies to develop and deploy accredited and accurate technology to identify and remove child sexual abuse material on private communications, but only when all other measures have not adequately addressed the risk.

I refer the Hon. Member to the response given to UIN 33378 answered on 3rd March 2025.

I refer the Hon. Member to the response given to UIN 33378 answered on 3rd March 2025.

The UK has a strong track record of protecting people’s privacy whilst also ensuring action can be taken against child sexual abusers and terrorists.

The Investigatory Powers Act contains robust safeguards and independent oversight to protect privacy and ensure that data is only obtained on an exceptional basis and only when it is necessary and proportionate to do so.

The Home Office does not comment on operational matters. This has been the longstanding position of successive UK Governments for reasons of national security.

Home Office Ministers and senior officials regularly meet with key stakeholders, including technology companies, legal experts and privacy advocates, on a range of policies and issues.

Details of Ministerial meetings are published on a quarterly basis on gov.uk.

The UK has a longstanding position of protecting people’s privacy whilst also ensuring action can be taken against child sexual abusers and terrorists.

The suggestion that cybersecurity and access to data by law enforcement are at odds is false. The Investigatory Powers Act contains robust safeguards and independent oversight to protect privacy and ensure that data is only obtained on an exceptional basis and only when it is necessary and proportionate to do so.

It is entirely possible to have robust cyber security measures that guard against access to data by malicious actors whilst also ensuring data can be disclosed in response to specific authorised requests.

Home Office Ministers and senior officials regularly meet with key stakeholders, including technology companies, on a range of policies and issues.

Details of ministerial meetings are published on a quarterly basis on gov.uk.

The UK has a longstanding position of protecting people’s privacy whilst also ensuring action can be taken against child sexual abusers and terrorists.

The suggestion that cybersecurity and access to data by law enforcement are at odds is false. The Investigatory Powers Act contains robust safeguards and independent oversight to protect privacy and ensure that data is only obtained on an exceptional basis and only when it is necessary and proportionate to do so.

It is entirely possible to have robust cyber security measures that guard against access to data by malicious actors whilst also ensuring data can be disclosed in response to specific authorised requests.

Home Office Ministers and senior officials regularly meet with key stakeholders, including technology companies, on a range of policies and issues.

Details of ministerial meetings are published on a quarterly basis on gov.uk.

The UK has a longstanding position of protecting people’s privacy whilst also ensuring action can be taken against child sexual abusers and terrorists.

The suggestion that cybersecurity and access to data by law enforcement are at odds is false. The Investigatory Powers Act contains robust safeguards and independent oversight to protect privacy and ensure that data is only obtained on an exceptional basis and only when it is necessary and proportionate to do so.

It is entirely possible to have robust cyber security measures that guard against access to data by malicious actors whilst also ensuring data can be disclosed in response to specific authorised requests.

Home Office Ministers and senior officials regularly meet with key stakeholders, including technology companies, on a range of policies and issues.

Details of ministerial meetings are published on a quarterly basis on gov.uk.

The UK has a longstanding position of protecting people’s privacy whilst also ensuring action can be taken against child sexual abusers and terrorists.

The suggestion that cybersecurity and access to data by law enforcement are at odds is false. The Investigatory Powers Act contains robust safeguards and independent oversight to protect privacy and ensure that data is only obtained on an exceptional basis and only when it is necessary and proportionate to do so.

It is entirely possible to have robust cyber security measures that guard against access to data by malicious actors whilst also ensuring data can be disclosed in response to specific authorised requests.

Home Office Ministers and senior officials regularly meet with key stakeholders, including technology companies, on a range of policies and issues.

Details of ministerial meetings are published on a quarterly basis on gov.uk.

I refer the Hon Member to my response to PQ 33378 answered on 3 March 2025.

I refer the Hon Member to my response to PQ 33378 answered on 3 March 2025.

I refer the Hon Member to my response to PQ 33378 answered on 3 March 2025.

I refer the Hon Member to my response to PQ 33378 answered on 3 March 2025.