UK government in massive personal data loss

The UK government has admitted that its Revenue & Customs department has lost the details of 25 million individuals after two disks went missing in the mail.

In a speech to parliament on Tuesday, the chancellor of the exchequer, Alistair Darling, said that two disks containing the details of everybody in the UK who claims and receives child benefits had been lost.

Details on the disks, which were only password protected, included names, addresses, dates of birth, national insurance numbers and bank and building society account details.

"This is an extremely serious matter," said Darling. "HMRC [Her Majesty's Revenue & Customs] failed to meet the high standards expected of it. I recognise that millions of people across the country will be concerned."

The disks were lost during a National Audit Office (NAO) investigation in October. A junior official in HMRC sent the unencrypted disks to the NAO, but HMRC were not informed that the disks had not arrived to be audited until 8 November. Darling himself was informed of the loss on 10 November -- three weeks after the disks had failed to arrive at the NAO.

Edward Leigh, the chair of the Public Accounts Committee, later said that the information the NAO requested had specifically been national insurance numbers, and not other personal details.

HMRC had not followed procedures for data transit, said Darling. HMRC had given the disks to courier TNT, but had failed to record or register the disks. When those disks did not arrive, a further two disks with the same information were sent by registered post; those disks did arrive.

"Again, they should never have let this happen," said Darling.

When Darling was informed on 10 November, he ordered searches for the data. When nothing had been found by 14 November, Darling asked the Metropolitan Police to become involved.

Darling said that there had, as yet, been no evidence of fraudulent activity.

"So far the data has not been found," said Darling. "The police told me there was no reason to believe the disks have fallen into the wrong hands, or been used for fraudulent purposes."

Last week Paul Gray, chairman of HMRC, offered to resign over the matter, and did so formally on Tuesday.