British revenue agency admits losing confidential data on 25 million individuals
The Chancellor of the Exchequer, Alistair Darling MP (Member of Parliament), admitted in a statement that the data went missing when a "junior official" at HMRC sent two CD-ROMs to the National Audit Office using HMRC's internal courier, TNT. The disks contained full personal details of claimants and their children, including national insurance numbers and private bank details.
The chancellor explained that the information was sent on October 18th, but senior management at HMRC were not informed of the loss until November 5th. On November 14th, Customs officials began a search of all HMRC offices, but could not find the CDs. Darling then called in the Metropolitan Police, whose investigation is still ongoing. Advice has also been sought from the Financial Services Authority and the Serious Organised Crime Agency, as well as the Information Commissioner.
Numerous reviews are promised. Darling explained that Sir John Bourn at the National Audit Office (NAO) will look into its procedures for requesting data, and that he has asked Kieran Poynter, chair of PricewaterhouseCoopers, to issue an interim report on the incident next month followed by a full version in the spring. The Independent Police Complaints Commission, which has responsibility for investigating HRMC, will also be looking into the matter.
According to the Treasury, the announcement has been delayed to give Britain's banks and building societies sufficient time to safeguard the relevant accounts. Affected account holders were urged to monitor their accounts, but not to contact their actual banks or building societies. Closing their accounts was entirely unnecessary, the Chancellor said, who then went on to say there was "no evidence this information has reached the wrong hands." He also pointed out that innocent victims of fraud are protected by the banking code.
To general derision from the opposition benches, Darling also advised account holders it was important not to respond to unauthorized requests for personal information. Child benefit payments are to continue as before.
Changes have been initiated to ensure that data transmission out of HMRC now requires signed confirmation from senior management. Treasury spokesperson Vince Cable wondered why the data was transmitted via courier and not electronically. He also reminded the house of the 25,000 HMRC jobs to be cut by 2011 and its ongoing IT problems with CapGemini, and asked if the Treasury had now overtaken the Home Office as latest government department which is "no longer fit for purpose".
Cable also raised doubts as to how closely the Chancellor intends to follow the Information Commissioner's advice. When the Commissioner recommended the Treasury publish the Gateway Review, which looked into the value offered by private finance initiatives (PFIs), the department decided instead to suppress the findings in the high court.
"Private finance contractors have been given greater data protection than families," Cable said.
Another angry voice belonged to Edward Leigh, chairman of the Public Accounts Committee, who said the Chancellor had not only maligned the NAO and misled the house, but was also to blame for "criminally irresponsible behavior on that part of a department that once had an impeccable reputation."
When the NAO originally requested the information from HMRC, Leigh said, Sir John Bourn had asked for national insurance numbers only, and had specifically asked for all other information to be removed. In contrast to Darling's statement that senior management at HMRC were not made aware of the data loss until the November 5th, Leigh pointed out that the NAO informed HMRC of the missing information on the 24th of October.
The Chancellor repeated his understanding that senior management at HMRC were not informed until the 5th, but nevertheless added he "had no reason to criticize the NAO at all". He expressed hope that Kieran Poynter's review might "reconcile different opinions of what happened."
The scandal will not come as a surprise to many in Westminster. Conservative MP Michael Fallon, vice-chairman of the Treasury select committee, said earlier there had been "persistent rumors that all is not well at Revenue and Customs." This month HMRC has already admitted to losing a CD containing the names, national insurance numbers, and dates of birth of 15,000 Standard Life pension holders. A laptop containing 2,000 individuals' ISA details was also stolen from an employee's car.
Paul Gray became Chairman of HMRC after Sir David Varney moved to the Treasury in February. In a letter sent to HMRC staff he said he was resigning after "a substantial operational failure."
"This is not the way I would have planned to organise my departure," the letter read. "I had hoped to be around a while longer, and to have had the continuing privilege of leading HMRC towards the vision we have been developing. But I am extremely proud of what all of you in the organisation have achieved during my time as deputy chairman and chairman."
Fallon said he assumed Gray's resignation was "a matter of honor. It is a good example and should be followed more widely."
This article originally appeared on our sister site, AccountingWEB.co.uk