---

Revenue and Customs: Data Loss

My Lords, I beg leave to repeat a Statement made by my right honourable friend the Chancellor of the Exchequer in another place. The Statement is as follows: ““Mr Speaker, with your permission I should like to make a Statement on the progress report by Kieran Poynter, chairman and senior partner of PricewaterhouseCoopers, into the loss of child benefit records at HM Revenue and Customs. Before I turn to that, I can confirm that the police investigation continues. While the searches are drawing to a close, their inquiry is not yet complete. However, the police have reiterated that they have no information or intelligence that the data have fallen into wrong hands. They will keep that under review. ““The banks, too, say that they have found no evidence of any activities suggesting fraud arising from this incident. They continue to monitor closely the accounts concerned so that they can see immediately if there is any unusual or irregular activity. As I have told the House previously, the majority of accounts into which child benefit payments are made are with a small number of banks and these banks have checked them back to 18 October, the date the missing data were posted. There are no reports of any activities suggesting increased fraud attempts deriving from the incident. ““I deliberately gave Mr Poynter wide-ranging terms of reference because of the seriousness of this loss, together with my concern about previous losses of data which I referred to in my statement on 20 November. Mr Poynter started his review on 23 November, just three weeks ago, and as he says his work is far from complete and his conclusions will develop as that work progresses. Inevitably, therefore, this report is short, but I said last month that I would return to the House when it became available. A copy has been placed in the Vote Office in the usual way. ““Kieran Poynter sets out the work he has put in hand. He says that he has given priority to the immediate steps Revenue and Customs must take to protect data security. Revenue and Customs has already put in place a number of measures. Mr Poynter says that these are measures that he would have recommended, and which his report sets out. As Mr Hartnett, the acting head of Revenue and Customs, said to the Treasury Select Committee on 5 December, they include the imposition of a complete ban on the transfer of bulk data without adequate security protection such as encryption, as well as measures to prevent the downloading of data without adequate security safeguards. In addition, Revenue and Customs disabled all the personal and laptop computers it uses to prevent the downloading of data onto removable media. Those computers will only be reactivated at the approval of a senior manager for a specific business-critical purpose. ““Mr Poynter has also begun his investigation into exactly what happened in relation to the loss, but he makes the point that there are more inquiries to be made, more interviews to be carried out and greater examination of the evidence available. As he says, it would be wholly inappropriate for him to draw final conclusions until his work is completed. ““Mr Poynter also draws attention to the general responsibilities and accountability in HM Revenue and Customs. These issues are also referred to in the capability review into HM Revenue and Customs carried out by an independent panel overseen by the Cabinet Secretary. The House will be aware that this review was commissioned as part of a general review, announced in July 2006, of the strengths and weaknesses of all government departments. The Revenue and Customs review is published today, along with that for the Treasury and updates for four other departments. I am also publishing Revenue and Customs’ autumn performance report. ““The capability review identifies a number of important strengths of Revenue and Customs, including a proven ability to bring in the money to fund public services while driving down its own costs and delivering greater efficiency. It refers to committed people with honesty and integrity, and with clear desires to transform and improve. The review also highlights a number of areas where improvements are needed, including the necessity to set up a simpler structure and clearer accountability, improving confidence and strengthening management information. The acting chairman agrees, and is announcing proposals to put in place a simpler organisational structure with clearer accountabilities which, as Mr Poynter says, will make it easier to implement recommendations on data security as his review progresses. ““I said in my Statement that the Prime Minister had asked the Cabinet Secretary to ensure that every government department checked its procedures for the storage and use of data, and to make recommendations on how to improve data handling procedures across government. His interim report is also published today, alongside a Written Ministerial Statement by the Minister for the Cabinet Office. ““The Prime Minister has already announced that the Information Commissioner will have the power to conduct spot checks on departments. There will now also be new sanctions under the Data Protection Act for the most serious breaches of its principles, which will take account of the need not only to provide high levels of data security but to ensure that sensible data-sharing practices can be conducted with legal certainty. We will consult early in the New Year on how that can best be done. The report also sets out a range of other measures. ““Revenue and Customs and, before it, the Inland Revenue and Customs and Excise have served successive Governments well. Their staff are dedicated and hard working. However, the loss of this data was extremely serious and should not have happened; again, I apologise to everyone who has been affected. ““As I told the House in November, the loss of this data together with losses in previous incidents mean that a wide-ranging review is necessary so that lessons could be learnt, procedures tightened and security improved. ““Mr Poynter tells me he expects to conclude his work in the first half of next year and I shall report back to the House when I have his final report. I commend the Statement to the House””. My Lords, that concludes the Statement.