---

HM Revenue and Customs

My Lords, we thank the Minister for repeating the Chancellor’s Statement on this sorry tale. I am afraid that the Chancellor is not having a desperately good week and we can hope only that tomorrow is a calmer day. When the Bill merging Customs and Excise and the Inland Revenue came before your Lordships’ House, we spent a lot of time scrutinising data sharing between departments—as the noble Baroness pointed out. However, we were less than wholly diligent in our work in that we failed to include a clause which said, ““Thou shalt not simply post the stuff out without keeping any records of where it is going or when it went””. On the specific issues, can the Minister say how many other HMRC CDs have been posted out over the past six months to other government departments and what information they might contain? As the noble Baroness said, we have had several incidents over the past few months that have come into the public domain in this area. Given the clear lack of any rigour on the part of junior staff in this case, it is very difficult to believe that these were completely isolated incidents. It also raises the question of how other government departments operate in similar circumstances. Data are regularly being shared between government departments and in this case they are being shared in the most cack-handed manner possible. What assurances can we have that across government we do not have junior officials simply putting CDs containing other sensitive material in the post? At the end of September, when we were looking at the previous lapse of security in this area, HMRC announced, "““We have also reviewed our arrangements and introduced safeguards to prevent this happening in future””." Given that events since have led to an even more serious breach of security, can the Minister explain what arrangements and safeguards were introduced in September and why they failed so spectacularly in this case? Why on earth is HMRC still using CDs for data transmission at all in this day and age? Does that point out a more fundamental problem in terms of its IT systems? We believe that there are a number of problems related to the Capgemini contract, and that a gateway review has been undertaken to investigate them—a review on which, incidentally, it is alleged that the Chancellor plans to go to the High Court to prevent it being brought into the public domain. Exactly what broader problems are there in relation to IT in this department? Is not the failure a symptom of the consequences of an ill thought-through merger? As the noble Baroness said, we spent a lot of time concerning ourselves about how two large departments with distinct histories and staff were brought together when it was clear that significant training would be required if staff at all levels were to do their new jobs properly. Unfortunately, far from additional resources being made available to ensure that the integration worked sensibly, we had severe staff cuts—25,000—in the department under the Gershon programme. My colleagues in another place have been dealing with the practical consequences of that for months—the increasing difficulty of taxpayers getting a sensible response from the department, in terms of their own affairs. Is not the problem that we are dealing with today yet another symptom of the low morale, poor procedures and inadequate resources that have flowed from the merger and the Gershon programme? The Statement says that the Comptroller and Auditor-General will review the NAO’s procedures for requesting data. I hope that he will also look at its procedures for dealing with data when it gets them. The Statement does not say when it returned the data—earlier in the year, it put them in an envelope and sent them back in the way it got them. For the NAO to request data in this manner—perfectly happily accepting them in a brown paper envelope and not drawing it to the attention of Customs—seems peculiarly dilatory. Finally, there is the question of the increasing responsibilities of HMRC. The child maintenance Bill proposes that additional responsibilities for managing a system are given to it. Given the problems that we have debated today, one wonders whether now is the moment when further responsibilities should be heaped on that department. Leaving them to one side, surely if ever there were an example of why we should be careful and critical about an ID card scheme, this is it, as the noble Baroness said. If such information relating to 25 million people—almost half the population of the UK—can be willy-nilly put into the public domain, so far as we know, because some junior clerk does not follow procedures, how can any citizen believe that they can be secure of their information not being made available under an ID card scheme? Among its other consequences, I hope that this matter sounds the death knell to that scheme.