---

Department for Transport Data Storage and Use

With permission, I shall make a statement about measures that I am taking to improve the security of personal data in the context of the Cabinet Secretary's review of data across Government. I also wish to update the House on a particular security breach earlier this year relating to the loss of personal—but not financial—data by a private contractor of the Driving Standards Agency. I shall give the details of that incident later in my statement, but first let me explain some of the background. My Department and its agencies handle hundreds of millions of transactions with road users every year, ranging from the payment of vehicle excise duty to the licensing of new bus or road haulage operators. So that a good service can be provided for customers, personal information needs to be shared between systems. For example, motorists can only renew their car tax online, because the Driver and Vehicle Licensing Agency can check information with the Vehicle and Operator Services Agency and with insurers. As the Cabinet Secretary has made clear in his interim report on data security, the public have a right to expect that the information they provide to Government will be held securely and used appropriately. Let me therefore set out five key actions that I am taking to apply that principle and improve security of information in my Department and its agencies. First, recent events have highlighted the risks associated with the physical transfer of data by disc, tape or hard disc drive. Much data transmission by my Department and its agencies is already, or soon will be, by electronic transfer. For example, driving test results are sent electronically from the Driving Standards Agency to the DVLA and MOT results are recorded on computer by garages and then sent, in bulk, to the Vehicle and Operator Services Agency by secure electronic transfer. I can announce today that the DVLA has created a new link to provide regular information to the police by electronic transmission. After a short period of testing, the present arrangements, which involve the transfer of tapes by secure courier, will cease. I have asked my permanent secretary to work with agency chief executives to accelerate other plans for further transfer of data electronically, wherever that is reasonable and cost-effective. Secondly, I can tell the House that I intend to move forward with plans to merge two separate databases of registered vehicles that are currently held by the DVLA in Swansea and the Driver and Vehicle Agency in Northern Ireland. The vulnerability that that creates was illustrated by the recent loss of two discs in transit from Northern Ireland to Swansea containing the details of 7,500 vehicles and the names and addresses of their owners. We will remove that risk by merging the databases. That will also enable Northern Ireland agencies to offer a better service, such as online car tax, to their customers. Thirdly, my Department will participate fully in the next stage of the Cabinet Secretary's review—in particular, the arrangements in place in private sector contractors, the transfer of data on removable media and procedures for any data stored outside the United Kingdom. My permanent secretary has also agreed with each agency chief executive that any bulk transfer of data not by electronic transmission will take place only by point-to-point transfer by a secure courier. Fourthly, to ensure greater clarity of responsibility, my permanent secretary has today written to senior officials in my Department, including agency chief executives, drawing their attention to current guidance on the application of the Data Protection Act. That includes the main principles of the Act, information on handling personal data appropriately, and the role of the Information Commissioner. Fifthly, in order to increase transparency and in line with the interim findings of the Cabinet Secretary's review, I have decided that my Department and its agencies should cover information assurance issues in their annual reports. That will include a summary of any notifications about data security made to the Information Commissioner. These measures are particularly important in the light of auditing data security in my Department and its agencies in the context of the Cabinet Secretary's review. In the interests of greater transparency, I should like to draw the House's attention to one such breach that affects a significant number of people. In May this year, Pearson Driving Assessments Ltd, a private contractor to the Driving Standards Agency, informed the agency that a hard disc drive had gone missing from its secure facility in Iowa City, Iowa. The hard disc drive contained the records of just over 3 million candidates for the driving theory test. The records contained on the hard disc drive were: the name of the test applicant; their postal address; their telephone number; the test fee paid; their theory test centre; a code indicating how the test was paid for; and, where provided, an e-mail address. The hard disc drive did not contain details of any individual's bank account or credit card. It did not contain their driving licence number, nor their national insurance number. It did mot contain their date of birth, nor a copy of their signature. It did not contain the result of their test. The hard disc drive was also formatted specifically to fit Pearson configuration and as such is not readily usable or accessible by third parties. Pearson has confirmed that there is no external indication of the drive's contents. In the context of the Cabinet Secretary's review of data, I asked the Information Commissioner for his views on this case and, on Friday afternoon, I received advice on his view of the risks to the public. The Information Commissioner has made it clear that he is concerned about any security breach—especially where large numbers of individuals are concerned. However, he recognises that the risks are lower where the personal data do not include banking or credit card details and where security safeguards are in place to protect the data from third-party access. As a result, on the basis of the information received so far, he has indicated that this case does not appear to present a substantial risk to individuals. He has not therefore advised that notification of each individual is needed. Nevertheless, I apologise for any uncertainty or concern that those individuals might experience. The DSA has provided advice on the direct.gov website and has set up a dedicated advice line for candidates who took their driving theory test between September 2004 and April this year. I can also inform the House that Pearson has already removed the specific risk which led to the loss by using electronic transfer in place of hard disc drives. I assure the House that I take the security of personal data in my Department and its agencies extremely seriously. The measures that I am taking, and the actions already under way, aim to ensure that transactions of this nature are conducted more effectively and efficiently in future, and to provide greater assurance to the public. I will, of course, keep the House fully informed of progress. I commend the statement to the House.