---

HMRC Data Loss

With your permission, Mr. Speaker, I should like to make a statement on the progress report by Kieran Poynter, chairman and senior partner of PricewaterhouseCoopers, on the loss of child benefit records at Her Majesty's Revenue and Customs. Before I turn to that, I can confirm that the police investigation continues, and although the searches are drawing to a close, their inquiry is not yet complete. However, the police have reiterated that they have no information or intelligence that the data have fallen into the wrong hands. They will keep that under review. The banks, too, say that they have found no evidence of any activities suggesting fraud arising from the incident, but they continue to monitor closely the accounts concerned, so they can see immediately if there is any unusual or irregular activity. As I told the House previously, the majority of accounts into which child benefit is paid are with a small number of banks, and those banks have checked the accounts back to 18 October—the date on which the missing data were posted. There are no reports of any activities suggesting increased fraud attempts deriving from the incident. I deliberately gave Mr. Poynter wide-ranging terms of reference because of the seriousness of the loss and my concern about previous losses of data, to which I referred in my statement on 20 November. Mr. Poynter started his review on 23 November, just three weeks ago, and as he says, his work is far from complete and his conclusions will develop as his work progresses. Inevitably, therefore, the report is short, but I said last month that I would return to the House when it became available. A copy has been placed in the Vote Office in the usual way. Kieran Poynter sets out the work that he has put in hand. He says that he has given priority to the immediate steps that Revenue and Customs must take to protect data security. It has already put in place a number of measures. Mr. Poynter says that they are measures that he would have recommended, and they are set out in his report. Mr. Dave Hartnett, the acting head of Revenue and Customs, said to the Treasury Committee on 5 December that the measures include the imposition of a complete ban on the transfer of bulk data without adequate security protection, such as encryption, as well as measures to prevent the downloading of data without adequate security safeguards. In addition, Revenue and Customs disabled all the personal and laptop computers it uses to prevent the downloading of data on to removable media; they will be reactivated only with the approval of a senior manager, and for a specific business-critical purpose. Mr. Poynter has also started his investigation into exactly what happened in relation to the loss, but he makes the point that there are more inquiries to be made and more interviews to be carried out, and there is to be greater examination of the evidence available. As he says, it would be wholly inappropriate for him to draw final conclusions until his work is completed. Mr. Poynter also draws attention to the responsibilities and accountability in Her Majesty's Revenue and Customs generally. Those issues are also referred to in the capability review on Revenue and Customs, carried out by an independent panel overseen by the Cabinet Secretary. The House will be aware that the review was commissioned as part of a general review of the strengths and weaknesses of all Government Departments, and was announced in July 2006. The review on Revenue and Customs is published today, along with the Treasury's review, and updates for four Departments. I am also publishing Revenue and Customs' autumn performance report. The capability review identifies a number of important strengths of Revenue and Customs, including a proven ability to bring in money to fund public services while driving down its own costs and delivering greater efficiency. It refers to committed people with honesty and integrity, and with a clear desire to transform and improve. The review also highlights a number of areas where improvements are needed; it mentions the need to set up a simpler structure, the need for clearer accountability, and the need to improve confidence and strengthen management information. The acting chairman agrees, and is announcing proposals to put in place a simpler organisational structure with clearer accountabilities. As Mr. Poynter says, that will make it easier to implement recommendations on data security as his review progresses. I said in my statement that the Prime Minister had asked the Cabinet Secretary to ensure that every Government Department checked their procedures for the storage and use of data, and to make recommendations on how to improve data handling procedures across government. His interim report is also published today, alongside a written ministerial statement by the Minister for the Cabinet Office. The Prime Minister has already announced that the Information Commissioner will have the power to conduct spot-checks on departments. There will also be new sanctions under the Data Protection Act 1998 for the most serious breaches of its principles. These will take account of the need not only to provide high levels of data security, but to ensure that sensible data-sharing practices can be conducted with legal certainty. We will consult early in the new year on how this can best be done. There is also a range of other measures, which are set out in the report. Revenue and Customs and, before that, the Inland Revenue and HM Customs and Excise have served successive Governments well. Their staff are dedicated and hard working. However, the loss of these data was extremely serious and should not have happened, and again, I apologise to everyone who has been affected. As I told the House in November, the loss of these data, together with losses in previous incidents, means that a wide-ranging review was necessary so that lessons could be learned, procedures tightened and security improved. Mr. Poynter tells me that he expects to conclude his work in the first half of next year, and I shall report back to the House when I have his final report. I commend this statement to the House.