UK data protection minister kept in dark
We are not a laughing stock.
By Tash Shifrin, Computerworld UK | Published: 19:05, 27 November 2007
The UK government's data protection minister did not know about the huge data breach at HM Revenue and Customs until he heard the chancellor's statement in the Commons on November 20, he has admitted.
Chancellor Alistair Darling said he had been told of the data breach - in which CDs containing the details of 25 million people were lost in transit between HMRC and the National Audit Office - on 10 November.
But data protection minister Michael Wills was forced to admit to parliament's joint committee on human rights that Darling's Commons speech was the first he had heard of Britain's biggest ever data breach.
"I'm afraid I learned about it when I heard the statement in the House of Commons," Wills told the mixed committee of MPs and peers.
Wills was mocked by committee members, who asked whether he did not find it "rather surprising" that as data protection minister he had not been notified earlier about the breach.
The data protection minister - who was interrupted and barracked as he spoke - answered: "I think it's perfectly reasonable for me not to be informed the moment something like this happened. I would expect the responsible officials and the responsible ministers first of all to discover the extent of the problem and then do whatever they could to put the problem right immediately.
"At that point comes the task of actually looking to see what can be done systemically to make sure something like this doesn't happen again. At that point I would expect this department [the Ministry of Justice] to get involved."
Under repeated pressure from the committee, Wills said: "My responsibility is not for actually stopping any breaches of data protection personally, individually or even corporately within the department where and whenever they occur." Instead the Ministry of Justice was responsible for setting out a "proper legislative apparatus" for data protection.
A review of data sharing and data protection has been ordered by prime minister Gordon Brown, Wills added.
Wills was also quizzed by sceptical committee members about what the HMRC fiasco meant for the security of data to be held on the national identity register that will underpin the government's ID card program.
"You obviously are going to have to look at the national identity register again in the light of this," he conceded. "Everything will have to be scrutinised."
