25 Million Child Benefit Records Lost, Admits Chancellor
It emerged on the 20th November 2007 that the whereabouts of no less than 25 million sets of data relating to child benefit in the UK cannot be accounted for. Chancellor Alistair Darling attributed the situation to the errors of junior officials working at HM Revenue and Customs, adding that the data included bank details supplied by seven million families. The information, he said, was contained on discs that had been posted to the National Audit office. Recorded delivery had not been used.
Subsequently, Mr Darling advised Members of Parliament, the sent discs never reached their intended destination.
The Chancellor offered his apologies in respect of what he described as "an extremely serious failure", but affirmed that the public was safe from identification fraud.
Lost Benefit Records Include Names, Addresses and Bank Details
The data in question includes names, addresses, national insurance numbers, and dates of birth and - in a number of instances - bank/ building society numbers.
Mr Darling provided assurance that the data would be insufficient by itself to allow accounts to be accessed. However, he added that banks would reimburse those who believed they had had their personal security violated.
In light of the data loss, a police investigation, he said, has now begun.
Junior Workers Had Transferred the Data
Detailing the specifics of the incident to the MPs gathered, the Chancellor highlighted how, in contravention of HMRC protocol, the data had been transferred by junior members of staff.
"Contrary to all HMRC standing procedures, two password protected discs containing a full copy of HMRC's entire data in relation to the payment of child benefit was sent to the National Audit Office by HMRC's internal postal system operated by the courier TNT", he stated.
"The package was not recorded or registered."
He added: "...I also have to tell the house that on finding that the package had not arrived at the NAO a further copy of this data was sent - this time by registered post which did arrive at the NAO However, again HMRC should never have let this happen."
"The police tell me that they have no reason to believe that this data has found its way into the wrong hands. The police are not aware of any evidence that it has been used for fraudulent purposes or criminal activity."
Detailing the timeline along which the incident had developed to date, Mr Darling said the information was originally posted on the 18th October. On the 8th November, HMRC learnt it had gone missing, and he himself learnt the news two days later.
Government Criticised for Lost Child Benefit Records
Responding to Mr Darling's speech, George Osborne, the Shadow Chancellor, urged the government to "get a grip". The data loss, he said, stood as a "final blow for the ambitions of this government to create a national ID database", given that "they simply cannot be trusted with people's personal information."
Richard Thomas, the Information Commissioner, described the situation as "..an extremely serious and disturbing security breach.
He continued: "This is not the first time that we have been made aware of breaches at the HM Revenue and Customs - we are already investigating two other breaches. Incidents like these illustrate that any system is only as good as its weakest link. The alarm bells must now ring in every organisation about the risks of not protecting people's personal information properly.
"As I highlighted earlier this year, it is imperative that organisations earn public trust and confidence by addressing security and other data protection safeguards with the utmost vigour."
Mr Thomas responded positively to the news that PricewaterhouseCoopers' Kieran Poynter would be carrying out an independent review, adding that this would dictate his next action.
"Searching questions need to be answered about systems, procedures and human error inside both HMRC and NAO", Mr Thomas concluded.
Source - Security International's Current Affairs Correspondent
