Government loses 25m confidential records
Tom Espiner ZDNet.co.uk
Her Majesty's Revenue & Customs has admitted to losing the details of 25 million individuals, with 7.25 million UK families potentially affected.
In a speech to parliament on Tuesday, the chancellor of the exchequer, Alistair Darling, said that two discs containing the details of everybody in the UK who claims and receives child benefits had been lost.
Details on the discs, which were only password protected, included names, addresses, dates of birth, national insurance numbers and bank and building society account details.
"This is an extremely serious matter," said Darling. "HMRC [Her Majesty's Revenue & Customs] failed to meet the high standards expected of it. I recognise that millions of people across the country will be concerned."
The discs were lost during a National Audit Office (NAO) investigation in October. A junior official in HMRC sent the unencrypted discs to the NAO, but HMRC were not informed that the discs had not arrived to be audited until 8 November. Darling himself was informed of the loss on 10 November — three weeks after the discs had failed to arrive at the NAO.
Edward Leigh, the chair of the Public Accounts Committee, later said that the information the NAO requested had specifically been national insurance numbers, and not other personal details.
HMRC had not followed procedures for data transit, said Darling. HMRC had given the discs to courier TNT, but had failed to record or register the discs. When those discs did not arrive, a further two discs with the same information were sent by registered post; those discs did arrive.
"Again, they should never have let this happen," said Darling.
When Darling was informed on 10 November, he ordered searches for the data. When nothing had been found by 14 November, Darling asked the Metropolitan Police to become involved.
Darling said that there had, as yet, been no evidence of fraudulent activity.
Read this 10 most foolish mistakes of IT pros End users aren't the only ones who can mess up the smooth running of a network. Here is a list of the most common mistakes IT pros make, plus some tips on how to avoid these errors... Read more
"So far the data has not been found," said Darling. "The police told me there was no reason to believe the discs have fallen into the wrong hands, or been used for fraudulent purposes."
Last week Paul Gray, chairman of HMRC, offered to resign over the matter, and did so formally on Tuesday.
This is the second major data-loss incident involving HMRC to emerge this month. On 6 November, it was revealed that the pension details of 15,000 Standard Life customers were sent to the pension provider by HMRC via an unnamed third-party courier at the end of September. The disc went missing and was not encrypted.
Did you find this article useful?
Share this article:
Alistair Darling 
British Chancellor of the Exchequer Alistair Darling announced to a shocked House of Commons today that two password-protected — but not encrypted — computer disks containing the entire Child Benefit database have been lost in transit between the offices of Her Majesty's Revenue and Customs (HMRC) in Washington, Tyne & Wear and the National Audit Office (NAO) in London, in what has been described as "one of the world’s biggest ID protection failures".

The database contains details of all families in the UK who receive Child Benefit — all families with children up to 16 years of age, plus those with children up to 20 years old if they are in full-time education or training — estimated to contain 25 million individuals in 7.25 million families. Among other items of information, the database contains names, addresses, dates of birth, child benefit and National Insurance numbers, and where appropriate, bank or building society account details.

The discs were created by a junior official at the HMRC in response to a request for information by the NAO, and were sent unregistered and unrecorded on 18 October using the courier company TNT — which operates the HMRC's internal mail system. When it was found that the discs had not arrived for audit at the NAO, a further copy of this data was made and sent — this time by registered mail — and this package did arrive. HMRC were not informed that the original discs had been lost until 8 November, and Darling himself was informed on 10 November.

The violation of data protection laws involved in the creation of the discs has led to strong attacks on the government's competence to establish the proposed National Identity Register, when all UK residents will have an identity card. Conservative Shadow Chancellor George Osborne described the loss of data as "catastrophic" and said "They the government simply cannot be trusted with people's personal information".

The Chairman of HMRC, Paul Gray, has resigned over the affair, and critics are calling for Darling to do likewise.

This is the third data embarrassment for HMRC in recent weeks — earlier this month it was reported that the details of over 15,000 Standard Life customers had been put on disk, and then lost en route from HMRC in Newcastle to Standard Life in Edinburgh — and last month a laptop containing the data of 400 people with high-value ISAs was stolen from the boot of a car belonging to a HMRC official who had been carrying out a routine audit.