When it comes to personal data theft, the Secretary of State said that

“the Leveson inquiry looked into everything in this area, and it was followed by three police investigations…We looked into these things as a society. We had a comprehensive Leveson inquiry.”—[Official Report, 1 March 2018; Vol. 636, c. 974.]

Will he tell me which of the inquiries and investigations that he says were comprehensive surfaced the evidence of the illegal data theft of the personal information of Dr David Kelly, who was very distressed when subsequently a journalist from The Sunday Times turned up unannounced at his home, just a week before he took his own life?

In his non-answer, the Secretary of State has shown that the previous inquiries were not comprehensive. There are still questions to answer, including allegations that at least one senior editor misled the first part of the Leveson inquiry and possibly even perjured himself. In caving in to the press barons, the Secretary of State betrays not just the victims of phone hacking but the promises of the previous Prime Minister. Will he at least have the decency today to admit that he was wrong to tell the House that previous inquiries were comprehensive and got to all the facts of criminal behaviour in our national newspapers?

We are committed including through the National Cyber Security Strategy to making the UK the safest place to live and work online and ensuring all organisations are secure and resilient to cyber threats. A wide range of Government guidance and support is available to help organisations protect themselves online and fulfil their data protection responsibilities. This includes the National Cyber Security Centre’s Cyber Security Small Business Guide, the Cyber Essentials scheme and guidance from the Information Commissioner’s Office. Under the existing Data Protection Act organisations must ensure appropriate cyber security measures are in place to protect personal data. The forthcoming Data Protection Bill will enhance the existing regime by requiring organisations to report data breaches quickly and through the introduction of higher fines for non-compliance.

A range of channels have been pursued by the Government, including direct contact US law enforcement and with Equifax US. In addition, the Government has received regular updates from Equifax. The National Cyber Security Centre (NCSC), the National Crime Agency, the Financial Conduct Authority and the Information Commissioner’s Office are assessing the impact on UK consumers and are discussing the scope of the company’s consumer notifications.

No Government departments have been compromised by the data breach at Equifax Inc., a US-registered company.

The Government has a contract with TDX Group Ltd, a subsidiary of Equifax Ltd. Equifax Ltd is a separate legal entity registered in the UK. The systems and platforms used in the UK by Equifax Ltd are entirely separated from those impacted by the cyber security incident in the US and were not affected.

The Government takes cyber security very seriously: since 2011 we have invested £860 million in a National Cyber Security Programme to protect the UK from cyber attack. Measures have included: setting up a National Cyber Crime Unit, establishing CERT-UK – a computer emergency response team, creating a Cyber Information Sharing Partnership for companies to share information, the Cyber Essentials Scheme for businesses, cyber risk reviews for companies and developing cyber initiatives into the education process.

We will invest £1.9b in cyber security over the next five years to protect the UK from cyber attack. This ambitious level of investment will include: a programme of active cyber defence; creation of a National Cyber Centre and an ambitious skills programme.

I refer the Hon. Member to the answer I gave to the Hon. Member for Sheffield, Heeley on 2 November 2015 to UIN: 13799.