HMRC under fire over missing data

News that the details of some 25 million Britons have gone astray in the post due to an error will come as a massive concern to people whose personal data is now in danger of being used fraudulently.

Widely reported this morning, confidential information on two CDs that were not encrypted was posted by an employee at the HM Revenue & Customs office in Washington, Tyne & Wear. The CDs subsequently disappeared and have not been traced.

The child benefit data on them is believed to include names, ages, bank and address details.

Speaking on BBC Radio 4's Today programme, Chancellor Alistair Darling said that his confidence had been 'shaken' by what he described as a 'catastrophic' incident.

He said: ''There's no doubt in my mind there have been very, very serious breaches here.

"People are entitled to trust the government to look after information that is given to it - for child benefit or any other purposes - and that did not happen here.''

He said the information, which was on two CDs, 'should never, ever have left the building in which it was stored'.

Paul Simms, CEO of the 3rd Man, a fraud protection specialist, said: "The extent to which it causes problems largely depends on where the CDs turn up. If they are already below several feet of rubbish then it's unlikely to cause any difficulties, of course. On the other hand, if there were to end up in the hands of organised criminals, this poses serious issues but only to a certain degree.

"There is concern that fraudsters would use the information to attack bank accounts and obtain credit card details to steal from other third parties such as retailers.

"The majority of retailers are well aware of the dangers of fraud, and have been for some time, but it's no longer a massive problem for those who already protect themselves through monitoring schemes. So even if your details have been obtained, the chances are that fraudulent activity will be monitored and prevented, especially if a retailer is part of a monitoring scheme such as SuperSearch.

"The most alarming thing in all of this is that such personal information is available to download from a PC onto a disk. This won't be the last time this happens, I'm sure, so it's important that we're able to deal with the consequences of such idiocy and compromises in security, as well as those which are intended to be fraudulent."

Resignation

Paul Gray CB, the Chairman of HM Revenue and Customs immediately announced his intention to step down from his post.

Mr Gray's decision follows the statement by the Chancellor to Parliament about a loss of data from the Department. He described the development as a serious operational failing by the Department.

In a statement to his staff, Mr Gray added: "Ensuring that our customers and stakeholders can trust how we handle sensitive information is one of our most important responsibilities. Given my overall accountability for the way the Department operates I have concluded that, as a result of the recent failings, it is right for me to decide to stand down."

The Chancellor said: "Last week Paul told me on his own initiative that given the seriousness of the operational failing, he felt he should resign. He has now confirmed that intention. I am very grateful to Paul for his huge role in the successful creation of Her Majesty's Revenue and Customs, and for his contribution to the work of government in HM Treasury, DWP and HMRC."

Secretary to the Cabinet and Head of the Home Civil Service, Sir Gus O'Donnell said: "Paul Gray has made an enormous contribution to the Civil Service over a long period of time and his contribution to the HM Revenue and Customs, first as deputy head and lately as Chairman, has delivered significant benefits for the British taxpayer.

"Paul has accepted that there have been major administrative failings in his department relating to their legal duties to protect personal information, and that he is accountable for these operations. With reluctance, I have conveyed his decision to the Prime Minister.

"It is important we learn the lessons of what happened, but also that we recognise the very real successes of the organisation. HMRC has achieved much under Paul's leadership and I share his pride in the thousands of professional and dedicated staff in the department."

Investigation

The Independent Police Complaints Commission (IPCC) is to use its own investigators to examine the circumstances surrounding the loss of the computer discs.

HMRC referred the matter to the IPCC on November 16. Gary Garland, IPCC Commissioner with responsibility for HMRC, said: "The focus of our investigation will be to identify the causes of this extremely serious failure and consider whether relevant local and national policies and guidelines were complied with. Where appropriate we will identify where lessons can be learned and will make recommendations if further action is required.

"The IPCC's investigation is entirely separate from that being carried out by the Metropolitan Police Service, however, we shall be keeping in close touch with any developments that may affect our investigation."