---

HM Revenue and Customs

My Lords, I am grateful to the noble Lords for the points they have made. The noble Baroness has accurately identified what we said in the Statement; namely, that there was an extensive gap between the disks being sent and lost and senior management being made aware of that loss. The loss was discovered on 24 October and senior management did not know anything was awry until 8 November. We make no bones about it: that is completely unacceptable. When the noble Baroness says that all the individuals who have been close to the operation should examine their role in it, she is right, and I assure the House that others will also examine the role of those officials in this situation. What took place is quite unacceptable. I do not accept the noble Baroness’s suggestion that the problem comes from the merging of two cultures with the formation of HMRC. This kind of mistake and lax behaviour and the failure to observe proper procedures would be unacceptable in any culture. I assure her that the review that is being carried out will be made available to Parliament so progress will be monitored, although HMRC does not make its disciplinary procedures public. This is a severe crisis for the organisation. Its chair has resigned and the impact on all staff concerned with this sorry affair is still to be thoroughly investigated. No stone will be left unturned as we learn what we can from the situation. If people have been remiss, as some clearly have, in fulfilling their obligations, they will face appropriate sanctions, but the inquiry will also be concerned to learn lessons so there is no question of any repetition of such a development in the future. Strict procedures were in place. They were not followed in these instances. HMRC has strengthened its guidelines and will make sure that its data security guidelines are followed meticulously; that will be a clear obligation upon all management throughout the organisation. What does this mean for the Government with regard to data sharing? I am not able to say how many disks have moved between government departments, and I do not think the noble Lord would expect me to be able to answer that question. The question that lies behind that is: ““Is the transfer of such information covered by strict guidelines and secure?””, and the answer is that it is—unless there is a serious lapse of this kind, which has the widest repercussions. My right honourable friend the Chancellor of the Exchequer did not exactly enjoy telling the nation about this lapse, nor can he do anything except apologise for the implications for the large numbers of the public who will be exercised about this problem. All government departments will be well aware of the necessity of following correct procedures, which on this occasion were manifestly not followed. That is why, for instance, the disks had no greater security than passwords—they were not encrypted. I want to reassure the House on that front. The thrust of the noble Baroness’s remarks was about identifying accurately what went wrong. Not only will lessons be learnt from that on how we can improve procedures, but action has already been taken to ensure that existing procedures—which, if followed, would certainly not have given rise to this lapse—will be followed meticulously. On the future of government information, the whole House will recognise that the Government will need to reassure the nation of confidence in data protection, not least because there is no way in which we can serve the community without guaranteeing that confidence to the nation. The noble Lord, Lord Newby, asked about failures in the recent past—which the Chancellor of the Exchequer identified in his Statement. Those were nothing to do with CDs in the post—a stolen laptop was one of the previous lapses, for instance. The subject of today’s Statement was a specific case. The noble Lord said it was due to low morale among the staff. That is an easy thing to assert and difficult to refute. I say that members of the government service—we all meet many of them in our daily lives—carry out their duties with proper attention to their responsibilities, but here was a catastrophic lapse where someone did not. The noble Lord ought not to suggest that the National Audit Office was remiss in the way it requested the information. The National Audit Office asked for the information and it was the responsibility of HMRC to ensure that it was transmitted in a secure fashion—an obligation that was not followed through. I reiterate that the Chancellor of the Exchequer did not make the Statement to the House until he had assured himself of a severe tightening up of procedures within his department. He also set out to make sure that the public was safeguarded by the full co-operation of all those who would be in possession of customer accounts, in order to effect the best possible protection to people with such accounts. On ID, noble Lords will recognise that part of the problem arose because of the limited nature and degree of security involved. ID cards are meant to improve aspects of that. I reiterate, the lapse was unacceptable, but day by day, right across government, such procedures are conducted with care, scrupulously and according to proper procedures. Such a lapse is unacceptable and requires the most immediate and proper action. The Chancellor of the Exchequer has already taken such action, and promised further action to tighten up procedures for the future.