---

HM Revenue and Customs

My Lords, with the leave of the House, I shall repeat a Statement made by my right honourable friend the Chancellor of the Exchequer in another place this afternoon. The Statement is as follows: ““With your permission, Mr Speaker, I should like to make a Statement on the breach of procedures which led to missing personal data relating to child benefit from Her Majesty’s Revenue and Customs. ““I shall set out the nature of the data and circumstances relating to how they went missing. However, it might be helpful to the House to set out the background before I do that. ““The National Audit Office, which is independent of government, but answerable to Parliament, has a right to ask for and access data from HMRC in discharging its compliance responsibilities. In March of this year, it appears that a junior official within HMRC provided the National Audit Office with a full copy of HMRC’s data in relation to the payment of child benefit. It is clear that, in doing so, the strict rules governing HMRC standing procedures were not followed. These procedures relate to the security and access to data, as well as their transit, to ensure that data are properly protected. This information should not have been handed over by HMRC in the way that it was. However, I understand that, in this case, the National Audit Office subsequently returned all the information that it received in March to HMRC after auditing it. ““It now appears that, following a further request from the National Audit Office in October for information from the child benefit database, again at a junior level and again contrary to all HMRC standing procedures, two password- protected discs containing a full copy of HMRC’s entire data in relation to the payment of child benefit were sent to the National Audit Office by HMRC’s post system, operated by the courier, TNT. The package was not recorded or registered. It appears that the data have failed to reach the addressee in the National Audit Office. ““I also have to tell the House that, when it was found that the package had not arrived at the National Audit Office, a further copy of this data was sent, this time by registered post, which did arrive at the National Audit Office. However, again, HMRC should never have let this happen. ““Although it is believed that the data were sent from HMRC to the National Audit Office on 18 October, the fact that they did not arrive was not reported to HMRC’s senior management until 8 November—nearly three weeks later. I was informed on Saturday 10 November and immediately instructed that comprehensive searches be carried out of all premises where the missing data might be found. These searches are continuing. ““I asked for an immediate investigation, which was initiated that weekend. I also insisted that immediate steps be taken to prevent this happening again, and action has been taken. On Monday 12 November, HMRC informed me that evidence of the route taken by the data might have been found and that the data were likely to be found. However, by Wednesday 14 November, it was clear to me that HMRC’s searches had failed to find them. I therefore instructed the chairman of HMRC to call in the Metropolitan Police to conduct a full investigation to find the missing package. That investigation is still under way. Our priority was and is to find those data. Searches have been and continue to be carried out, including of HMRC and National Audit Office premises. Staff are being interviewed, but so far the missing data have not been found. The police tell me that they have no reason to believe that those data have found their way into the wrong hands. The police are not aware of any evidence that they have been used for fraudulent purposes or criminal activity. ““Let me tell the House what is missing as a result of this extremely serious failure on the part of HMRC to protect sensitive personal data entrusted to it in breach of its own guidelines. In terms of protecting confidential data, Her Majesty's Revenue and Customs is operationally independent of Ministers. It is established by statute. It is run by its chairman, Paul Gray, and a board of commissioners who are responsible for its operations, but answerable to Parliament through me. ““Last week Paul Gray told me on his own initiative that, given the seriousness of the operational failing, he felt that he should resign. He has now confirmed that intention. I am very grateful to Paul Gray for his contribution to the work of government in Her Majesty’s Treasury, the Department for Work and Pensions and in HMRC. ““The missing information contains details of all child benefit recipients: records for 25 million individuals and 7.25 million families. These records include the recipient and their children's names, addresses and dates of birth, it includes child benefit numbers, national insurance numbers, and, where relevant, bank or building society account details. ““I regard this as an extremely serious failure by HMRC in its responsibility to the public. In making this Statement today, I have had to balance the imperative of informing the House and the public at the earliest opportunity, while at the same time ensuring that when I did so the appropriate safeguards were in place to protect the public, including in relation to bank accounts. Indeed, the banks were adamant that they wanted as much time as possible to prepare for this announcement. ““I discussed this with the Information Commissioner on Thursday who agreed that appropriate remedial action needed to be taken before a public statement was made. That action has now been taken. ““I have also sought the advice of the Financial Services Authority and the Serious Organised Crime Agency. Other government departments have been made aware. ““Mr Speaker, let me set out what we have done. First, the UK Payments Association, the British Bankers’ Association and Building Societies Association have been informed. Through them HMRC informed individual banks and other financial institutions, including building societies and post offices, of affected accounts. Secondly, individual institutions are flagging these accounts, which enables them continually to monitor for irregular activity. They tell me that so far they have found no evidence of such activity. ““Thirdly, they are also tracking back and analysing transactions on affected accounts back to 18 October. They have again so far found no evidence of unusual activity. They will continue to monitor these accounts so that if there is any suspicious activity, action can be taken immediately. ““Fourthly, if someone is the innocent victim of fraud as a result of this incident, people can be assured that they have protection under the Banking Code so that they will not suffer any financial loss as a result. ““The UK Payments Association has confirmed that it is confident that every action has been taken by the banking industry to minimise the risk of any fraud. It has also confirmed that the missing data are not enough in themselves for someone to access a person's bank account for fraudulent purposes, as additional security information and passwords are always required. But we have to recognise the increased risk caused by this missing data, so people will want to monitor their accounts and guard against any unusual activity. ““The advice of banks is that there is no need for customers to ask for a new account or to contact their bank or building society. But they should do what they should be doing anyway: they should check their statement and keep a close eye on their account for any unusual activity; if they see anything in their statement that concerns them, they should then contact their bank or building society immediately; and they should not give out personal or account details requested unexpectedly by phone or e-mail. ““I reiterate: the banks have made it clear that individuals will not have to pay out for any loss in the event that they are innocent victims of fraudulent activity. I can also assure the House that child benefit payments will continue to be paid as before. There are already clear HMRC standing procedures, which appear to have been broken. HMRC has initiated changes to security processes and procedures so that those will now take place only with written authorisation from a senior HMRC manager and with the appropriate protection for the transfer. ““The police investigation continues, though there is also likely to be an inquiry into the missing data by the Independent Police Complaints Commission, which has a responsibility for monitoring HMRC. I have kept the Information Commissioner informed. It is highly likely that there have been breaches in the Data Protection Act. That is something the commissioner will investigate. ““The Government take the protection of personal data, in whatever form, extremely seriously and have therefore put in place and are strengthening the rights and safeguards on use and handling of such data. The Data Protection Act set out the framework enforced by the Information Commissioner and the courts. Departments have specific controls on information sharing and duties of confidentiality that are being enhanced by amending the Data Protection Act to guard against misuse, and by providing further information for citizens about the information that the Government hold. ““Last month, the Prime Minister asked the Information Commissioner and Professor Mark Walport, director of the Wellcome Trust, to carry out a review of the framework in the UK to ensure the security of personal data. That review will look at government departments and other organisations. I can also tell the House that the Comptroller and Auditor-General, Sir John Bourn, has said that the National Audit Office will review its own procedures for requesting data, to confirm that these remain in line with best practice. It will apply any lessons arising. ““In addition, the House will be aware of other data security breaches by HMRC, including the loss in transit at the end of September of the records of around 15,000 people by HMRC’s external courier. In the same month, a laptop and other material containing personal details relating to HMRC customers were also lost. I have therefore asked Kieran Poynter, chair of PricewaterhouseCoopers, to investigate HMRC security processes and procedures for data handling. I have asked for an interim report next month and a full report in the spring. That review will be conducted in consultation with the Independent Police Complaints Commission and a full report will be made available to the Information Commissioner. I express my gratitude to the Metropolitan Police for its investigation, to the Information Commissioner for his advice and to the banks for their co-operation in working with the Government to take steps to protect the public. ““The House will understand that because the investigation is continuing I am not yet in a position to give a full account of what has happened here, but I will continue to keep the House informed. This is an extremely serious matter. HMRC has a responsibility towards the general public who entrust it with highly sensitive personal information. It has failed to meet the high standards that should be expected of it. I recognise that millions of people across the country will be concerned about what has happened. I deeply regret this, and apologise for the anxiety that will undoubtedly be caused. ““Let me reiterate: there is no evidence that these data have reached the wrong hands, and no evidence of fraud or criminal activity. Banks and building societies are putting in place safeguards to protect people’s accounts, and they will continue to monitor those accounts. No one will suffer any loss if they are an innocent victim of fraud and I will, of course, keep the House updated of any further developments””. My Lords, that concludes the Statement.