HM Revenue and Customs
Philip Dunne condemns the Government for being quick to blame junior officials when it now appears that senior officials in several departments were involved in the decisions that led to the loss of the child benefit data.
3.49 pm
Mr. Philip Dunne (Ludlow) (Con): In the short time available to me before the wind-ups, I should like to focus on three specific aspects of this shoddy state of affairs. First, I want to speak up for the chairman of HMRC, Mr. Paul Gray, who has been a regular witness before the Public Accounts Committee and one of the few senior civil servants who has been prepared to acknowledge error where it has occurred within his department. He has had to deal with many difficulties arising out of the merger of the Inland Revenue and Customs, to which other hon. Members have referred. In this case, he saw the seriousness of the failure and was accountable in a manner that must be applauded across government and is in stark contrast to the approach taken by some of the other heads of department, on whose watches similar disasters have occurred. In such cases, they have not taken responsibility. Ministers must carefully examine how Mr. Gray has conducted himself and how they are conducting themselves. I applaud him for that.
My second point deals with the sequence of events and responsibility. As my hon. Friend the Member for Tatton (Mr. Osborne) pointed out in his opening remarks, the Government have been quick to blame junior officials. The National Audit Office e-mail exchanges with HMRC, which came out two days after the Chancellor's statement, are extremely revealing. In contrast to what the Chancellor said earlier, it is clear that there are two aspects to this calamity. The first aspect is that the CDs were put in the post and transmitted contrary to procedure-that clearly should not have happened. The second aspect is the decision to provide sensitive data, which is more fundamental and lies at the heart of this problem.
I understand that the NAO requested a set of data in order to verify its sampling methodology when it came to do the audit of child benefit, because that area of work had been taken within HMRC having previously been done by the Department for Work and Pensions. The NAO sought certain data, but those did not include sensitive data such as bank account details and addresses that would identify individuals. Several people in the department-not just a junior official-were involved in deciding to provide the full set of data.
That is made crystal clear in an e-mail of 13 March 2007 timed at "15:23". Because of the measures taken to protect the identity of the individuals concerned, we do not know exactly who in HMRC sent it, but we can see that it was copied to one person at the NAO-we presume it was sent to the NAO-and to three people in HMRC, one of whom, we are led to believe, is the process owner for child benefit.
The first sentence of the e-mail states that somebody had
"passed this over to me for my views."
It is thus evident that consultation was taking place at different seniority levels in HMRC on the issue of how much data should be provided. It continues:
"Your original request was for 100 per cent. scan of the data, and fortunately a scan was complete earlier this year, and we have shared this with you at no additional cost to the department."
The important bit is the fact that the e-mail goes on to state:
"I know you are meeting with Compliance and KAI colleagues on Wednesday and all your issues regarding data extracts etc should be taken up with them."
Two other departments in HMRC are involved-quite apart from there being a direct interface with HMRC-in making this decision. The e-mail goes on to say:
"I must stress we must make use of data we hold and not over burden the business by asking them to run additional data scans/filters that may incur a cost to the department."
That exposes the fact that this was all about saving money within HMRC and not about protecting data. That is where the Government have not come clean in their explanation of why we got into this sorry state of affairs.
In an intervention on the Chancellor, I referred to encryption and data protocols. It is lamentable that Treasury Ministers have not been prepared to tell us that they have undertaken a complete overhaul of data protection procedures in their Department. It would be refreshing if the Minister were prepared to be a bit more forthcoming about exactly what Ministers have asked to be undertaken in their Department. Perhaps she could also explain what distinguishes those procedures from those that were in place before this terrible state of affairs arose.
The Government do not seem to realise the impact of this data loss on our population. There is fury out there that such sensitive data could have been lost. People can no longer trust the Government with their bank details, so how can the Government possibly expect people to trust them with even more sensitive data such as those that will be needed for an ID card? I take no pleasure in saying this, but this Government have lost the trust of the people.
3.55 pm
...
Mr. Philip Dunne (Ludlow) (Con): In view of what the Chancellor said about the importance that the Government attach to the security of data transfer, will he confirm to the House that the data included on the two CDs were not encrypted, as the HMRC's press office statement said, which was reported on Newsnight last week?
Mr. Darling: I said last week that the data were password-protected, but not encrypted. Most people agree that the data ought to have been encrypted, but they were not.
