---

Data Loss

My right honourable friend the Lord Chancellor and Secretary of State for Justice (Jack Straw), has made the following Written Ministerial Statement. This Statement is to update the House on the loss of sensitive data on a hard drive by electronic data systems (EDS), which became known to Ministers on 6 September 2008. I have now received the results of the internal investigation into this matter, which was undertaken by a National Offender Management Service (NOMS) director with no prior involvement in the incident. The investigation has confirmed that initial reports over-stated the volume of data involved. The hard drive contained 256 items of sensitive personal information that could potentially, if in the public domain, cause damage to that individual; namely, bank details, address details, and national insurance numbers coupled with dates of birth. There remains no indication that this information has entered the public domain. The investigation found that the data had been downloaded to the hard drive so it could be transferred to another site as part of a disaster recovery exercise carried out in July 2007. While no problems arose regarding the implementation of the exercise itself, the disk was not wiped before it was to be removed from the site and thereafter EDS failed to take adequate measures to track or record the location of the hard drive when it was transferred to another site. Although strictly the hard drive was not at that time being removed for other uses, it ought to have been treated as such and EDS’ company policy at that time, requiring a disk to be purged prior to release for any other purpose, ought to have been followed. This did not comply with data protection principles, and also meant that the investigation could not identify precisely when or where the hard drive went missing. The possibility of theft has resulted in this matter being referred to the West Mercia Police. EDS is taking appropriate action, which will include disciplinary action if necessary, concerning the staff involved. The inadequacy of EDS’ tracking systems meant that the data was not missed until 2 July 2008. On 3 July, EDS notified NOMS verbally of the data loss, the possible scope of which was made apparent in a written interim report to the NOMS IT security team on 4 July. There is no evidence of any other communication between EDS and NOMS on this issue until 6 September, when the matter was raised by the press, although EDS were preparing a final report to submit to NOMS. The NOMS IT security team did not take sufficient action following receipt of the interim report, with the result that senior officials and Ministers were not aware of the loss until 6 September, when comprehensive and appropriate action was taken to identify and contact any staff involved and to investigate further the circumstances of the loss. NOMS is taking appropriate action, including disciplinary action, concerning the staff involved. In the context of the Hannigan review and subsequent Cabinet Office guidelines, NOMS and EDS were both actively improving data protection processes before this matter arose. Since 6 September, EDS and NOMS have agreed an additional set of measures to be undertaken, at EDS’ cost, both to reimburse NOMS for its additional expenses arising from the incident and to further develop the security of NOMS’ information assets. These include an exercise to identify all uncontrolled copies of NOMS’ sensitive data and have such copies destroyed in a secure manner, as well as reviewing and strengthening the policies and process controls which govern the transfer of NOMS data. In addition, the number of transfers using removable media will be reduced, and encryption will be introduced on removable media. A further, detailed review will also be undertaken to identify and prioritise any additional security measures to be enhanced. Finally, EDS has committed to the design, development and delivery of appropriate classroom and computer-based training packages for both EDS and NOMS staff. An annual, independent audit of EDS’ compliance with security standards will be introduced with a requirement for EDS to rectify any areas of non-compliance.