Skip to main content

HMRC (Personal Data)

Volume 468: debated on Thursday 29 November 2007

3. What recent assessment he has made of the implications of the loss by Her Majesty’s Revenue and Customs of personal data. (169065)

I refer the hon. Gentleman to the statement that I made in the House on 20 November and to what I said in yesterday’s debate.

It is clear that the matter goes much wider. On 31 October, my constituent, Mr. King of Bexhill, received a letter from HMRC, in which he was advised that a CD that had been sent to his pension provider, Standard Life, containing his surname, national insurance number, date of birth and plan reference number, had gone missing. He wants to know how many other CDs went missing before the CD that was sent to Standard Life, as well as the one that was sent out by HMRC with 25 million names on it. How many CDs went missing? How many of them have been accounted for? How many of them are still missing? And why, when CDs have gone missing in the past, did Ministers not act beforehand?

On the discs that went missing from the Standard Life, the hon. Gentleman will recall that I referred to that matter specifically in my statement on 20 November. As a result of that incident, HMRC wrote to all those affected, including the hon. Gentleman’s constituent. The circumstances relating to the losses of that material, and in relation to the much larger loss of child benefit records, are currently the subject of investigation by Kieran Poynter, the senior partner at PricewaterhouseCoopers. We will have his interim report in three weeks’ time, and, as I said yesterday—I do not think that the hon. Gentleman was here for yesterday’s debate—I intend to report to the House when I get that report.

In yesterday’s debate, the Government said that HMRC is still sending out CDs from time to time and encrypting them only when necessary. Why is it necessary to send out any CDs, and why, if CDs must be sent out, which is obviously the worst possible method, is it not always necessary to encrypt them?

It is necessary from time to time for information to be sent between offices, which is normal. We have ensured that procedures have been tightened, particularly in relation to bulk transfer. The transfer of information by HMRC will be the subject of the report that I have commissioned. I agree with the hon. Gentleman, many hon. Members and many people outside this House that we need thoroughly to examine how information is transferred and to ask ourselves whether it needs to leave a particular building in the first place. If information needs to be transferred, we need to consider the necessary security such as encryption or another appropriate measure. I have given Kieran Poynter wide-ranging terms of reference, so that he can cover all those matters. We will receive his interim report fairly shortly, and we will get a wider report in the spring, which will allow us to take whatever action is appropriate.

Does the Chancellor now regret that both he and the Prime Minister specifically allocated initial responsibility to a junior official? Does the Chancellor regret that that individual has been hounded and forced into hiding?

As I said yesterday, what I said in my statement on 20 November was absolutely correct in accordance with the information that I had then and that I have now. I covered all such matters in yesterday’s debate. As I say, we will have the interim report from Kieran Poynter very shortly; that will allow us to draw conclusions and take the necessary action as a result of what happened.

After the Chancellor was informed of the loss of the data, why did it take him six days to inform the banks? Why does it appear from the e-mails released by the National Audit Office that it took seven days before HMRC searched the offices of the NAO?

Again, I explained that when I gave my statement on 20 November. When I was told what had happened, I asked HMRC to carry out a thorough search, using its Customs investigations officers. When it was clear that that had not found anything, the Metropolitan police were called in and they carried out various searches. The position is that various buildings belonging to Revenue and Customs and the NAO were searched at various times as it became clear that the discs had gone missing. However, I covered all those points, both in my statement and in the debate yesterday. As I say, not only is the Metropolitan police investigation continuing, but we will have the results of Mr. Poynter’s review fairly shortly. We can then discuss the matters further.