| Previous Section | Index | Home Page |
The Chancellor’s Department at senior level knew about the problem on 8 November. We are told that it was two days before the Chancellor was told, so that shows that he had not told his staff that such things were important or mattered to him—otherwise they would have told him immediately and not taken the risk. It then took him another 10 days, until 20 November, to come to the House of Commons to tell us what had gone wrong. That does not speak well of a Government who believe in Parliament and think it central to our national life; nor does it speak well of a Government who claim to care about people’s data. If the Government knew 12 days beforehand that the data might have been
stolen, and had certainly gone walkabout, why were the public not told and warned then? Why were they not told and warned through the natural route—a full statement to this court of Parliament? That is what should have happened.
The Chancellor’s excuse is that he wanted time to talk to the Information Commissioner. He then tried to blame the banks, although they were told only on the Friday evening. The Chancellor now says that one or two banks wanted a bit more time, but it was hardly sporting of him to take up all the working days of the week, keeping the information to himself, telling the banks only on Friday evening when, no doubt, officials and Ministers wanted to go home and leave the banks with the problem over the weekend.
That reeks of a Government who are after our money but not out to give us service. It reeks of a Government who speak about the importance of democracy but do not treat the House of Commons seriously. It reeks of a Government who claim to value the people of this country but who cannot be bothered to tell them promptly when the Government make a mistake. It is a disgrace and it is high time that Ministers on the Treasury Bench came up with a better defence and some resolute action so that we can be reassured that in future they deserve to handle our data.
3.21 pm
Dr. Nick Palmer (Broxtowe) (Lab): I am aware that a number of Members want to speak so I shall try to be reasonably brief. I shall try, too, to follow the example of the hon. Member for Twickenham (Dr. Cable), who gave a serious speech, in contrast to the one we have just heard and the one from the shadow Chancellor.
This is a serious matter that affects half the country, as we have all repeatedly said, and as other Members have pointed out, it raises issues that affect the public handling of confidential data in general. As my hon. Friend the Member for Wolverhampton, South-West (Rob Marris) said, there is a trade-off in all such situations between considerations of efficiency and considerations of security. That is true, too, in private industry. I was in IT management in the private sector for 18 years and we were constantly confronted with that issue.
The instinct of IT professionals throughout the industry, public and private, is to give the user what he wants and, if necessary, cut a corner. That is human nature and we have to recognise it and deal with it. We need clear guidelines for what IT professionals should do in every conceivable situation and who they should address for advice in cases where something unanticipated arises. If they follow those procedures we should protect them.
There is a tendency in the House and elsewhere to describe all safeguards as red tape until they are actually needed, when they suddenly become matters of life importance. We do not often make speeches in favour of red tape, but sometimes we need to point out that red tape is necessary to slow down the action of people eager to provide information they have been asked for, against the wider interest.
I have a few suggestions about the issues that we should focus on. In exchanges with the hon. Members for Twickenham and for Birmingham, Yardley (John Hemming), I made a point about field-level security.
The hon. Member for Twickenham responded that it was not a question of how many fields were accessed but of the number of records. In fact, there are three axes: the number of people who can access the database, the number of records in the database and the number of pieces of information—fields—they have authority to access.
Let us consider the parliamentary database and our famous expenses, which the press are always keen to study. It is entirely appropriate that the press can see the field showing our expenditure on correspondence. However, it would not be appropriate for the press to be able to access fields showing individual correspondents—the people we have written to and what we wrote about. That would intrude on the privacy of those individuals.
In a sense, it is a red herring to say that the key issue is whether there is greater security in having one huge central database or a lot of distributed ones, and arguing that distributed databases are more secure. That red herring comes up often in the debate on ID cards. As an IT professional, if I have access to 18 databases, bringing them together to produce a single report is a trivial matter—that is not the problem. The problem is not the central database, but access to the individual data items within it. If someone in the health service, or any other body, has too much access to individual pieces of information, the problem needs to be addressed now; it will not get any worse if we add fingerprints. In fact, it would become less intense, because there would be extra safeguards. However, I agree with Members who suggest that there is a problem in the handling of public data generally: because of the sheer volume of data, we have allowed convenience, and even user-friendliness, to take precedence over individual protection.
My second suggestion relates to limits on mass bulk transfer. In retrospect, we can all say that it is self-evidently absurd that the National Audit Office should want 25 million records. In fact, the NAO denies that it made that request, but as it would obviously be impossible to read 25 million records at that point, an alarm bell should have gone off. However, the fact that it did not is not really the point; the point is that there was no bar to the official concerned saying, “Well, let’s make life easy. We’ll answer quickly and download the lot.”
There should be more red tape and greater protection where large volumes of data are involved. In the narrative the press are trying to construct to show that everything is chaotic, cases have been cited recently of constituents receiving letters with information about one, three or five other people. That is bad and should not happen. However, I think that we can all agree that it is a problem on a different scale. It is the sort of problem that happens under every Government and has happened all the time that public data have existed.
The transfer of mass volumes of data, however, should be authorised at a senior level. I do not just mean that a procedure should be in place; I mean that there should be a technological block. It should not be possible for a junior official, or manager—we can argue all day about that—or anyone beyond the most senior people to authorise the transfer of that volume of data as a one-off operation.
A third point, which the hon. Member for Twickenham made much of, relates to routine encryption. Again, it is
a question of convenience versus protection. In view of the shortage of time, I will not go into that in more detail. There is an additional cost if we insist on the routine encryption of everything. There might be a proportionality question, but I am content to leave that to the inquiry.
Fourthly, there should be an escalation of responsibility in exceptional cases. The Government and Parliament should do their best to set criteria for all the situations they can think of, but it should also be part of the standard culture that if someone encounters an exceptional situation they do not say, “I am an IT genius. I know how to get round this.” They should say, “I don’t know what to do in this situation. I’m going to my senior management.” Most IT people accept that culture only reluctantly. The IT instinct is to say, “I can fix it.” That has to be addressed. It is a serious issue at the centre of things.
Finally, as my hon. Friend the Member for Hayes and Harlington (John McDonnell) said, there is the question of staffing levels. We have reduced the staffing levels in HMRC. Her Majesty’s Opposition think that we should reduce them further. It is reasonable to ask whether that process could have gone too far and whether the staffing levels reflect a number more than a detailed assessment and have reached the point at which a certain corner-cutting culture starts to set in. I do not know, because I do not know the detailed operations of HMRC. However, it would be helpful if the people who were looking into the matter were able to comment on that in more detail in the assessment.
I will not go on, simply because of the time limits. I was going to say a lot more, but the House will be relieved to hear that I am going to shut up.
3.31 pm
Sir George Young (North-West Hampshire) (Con): The hon. Member for Broxtowe (Dr. Palmer) will forgive me if I do not follow his argument, but a number of hon. Members have been in the Chamber since the debate began and deserve an opportunity to be heard. I speak as a former Financial Secretary, like my right hon. Friend the Member for Charnwood (Mr. Dorrell), and it is difficult to avoid a twinge of sympathy for the Chancellor of the Exchequer, who finds himself carrying the can for something that happened a few weeks after he entered the Department. In the narrow sense, the Chancellor clearly is not culpable in that he did not put the discs in the envelope. However, the House is interested in the broader questions that have been touched on during the debate and for which Ministers are responsible.
Ministers are responsible for the additional functions that they have placed on the department and the resources that they have given the department to perform those functions. Ministers, who sit at the top of the management chain, are responsible for sending down that chain the right signals to influence morale and performance—a job that they ignore at their peril.
On the first point, Ministers took two decisions. The first was to transfer to HMRC responsibility for child benefit. That responsibility originally rested with the Department for Work and Pensions. The decision gave the Inland Revenue a substantial new management
challenge, as well as a cultural shock, because it found itself paying out money instead of collecting it.
Secondly, Ministers merged the two arms of HMRC: the Inland Revenue and Customs and Excise. My right hon. and learned Friend the Member for Rushcliffe (Mr. Clarke) and I looked at that option in the 1990s and rejected it. The client base and the culture were different, and we were not convinced that the economies were there. The Government came to the same conclusion in 2000. In response to the Treasury Committee’s first report on the matter in 2000, the Government said that they believed that the synergies could
“be achieved without the risks, upfront and opportunity costs and structural upheaval which merger would inevitably entail.”
“Thus, while the Government accepts that merger might bring some of the benefits outlined by the Committee, it believes that they can be achieved without the disbenefits of merger through a dynamic and focused programme of closer working.”
In other words, the Government did not think that it was worth the gamble, but four years later they changed their mind.
The Chancellor and the Prime Minister have asserted that my party is somehow implicated in the rushed and botched merger of Revenue and Customs. I have looked at the record of the debates we had when the relevant Bill was going through Parliament. My hon. Friend the Member for Chichester (Mr. Tyrie), who was the spokesman at the time, said:
“Although we did not oppose the Bill on Second Reading, we had a number of major concerns about it. Merging the departments involved is a major change, and we are not convinced that it was given enough consideration by the Government or that its implementation was properly thought through.”
“worried that the measure might prejudice taxpayer confidentiality.”—[ Official Report, 6 April 2005; Vol. 432, c. 1520.]
“the retention of confidentiality...is at the heart of safeguarding...people’s right to privacy and, therefore...their trust in the Revenue service.”—[ Official Report, 26 January 2005; Vol. 430, c. 396.]
So when the Bill that merged the two departments went through the House, the Government had been warned that confidentiality was an issue.
The tax credit ingredient was then thrown into the pot, on top of the merger and the additional responsibilities. The Revenue had to run the most complicated financial interface between citizen and state—the tax credit system, which has displaced the Child Support Agency as top of the problems that MPs deal with in their advice bureaux. Ministers must take responsibility for the consequences of new responsibilities and the merger.
That leads me to my second point, which is on resources. In the 2004 spending review, the administration budget for all the Chancellor’s departments was flat in nominal terms. A saving of 16,000 posts was pencilled in. Under the 2007 comprehensive spending review, departmental expenditure limits will decline by 5 per cent. a year for the next three years. That is a challenging settlement. The Chancellor had to pencil in those savings to make the sums add up, but I wonder whether they were thought through, and whether they are really
deliverable. The Treasury Committee, which undertook a report on the efficiency savings in the Chancellor’s Budget, concluded:
“Evidence received...shows that the indicators used...to measure the quality of...services are not adequate to assess the experience of service users, and in particular are not adequate to measure the extent to which its services meet the...needs of its...client groups”.
That leads on to my last point about management and morale. There have been all sorts of warnings on that score. The tax faculty of the Institute of Chartered Accountants said:
“We are concerned that post merger the overall management structure of HMRC lacks clarity and focus. The lines of management accountability and responsibility are not always clear, either it seems to HMRC staff or to external stakeholders.”
The Chartered Institute of Taxation gave evidence to the Committee in January, and said:
“we do have concerns about the current position of HMRC and their progress. We see them as an organisation that is under considerable pressure.”
In my view, there is an audit trail involving policy, resources and leadership that leads back to Ministers. They cannot divorce themselves from the consequences of what happened down the line in the post room in Washington.
Finally, what conclusions should we draw? We need to await the inquiry, but I think that we can anticipate what it will say. It will be like other inquiries, such as those on transport or social services: it will say that primary responsibility rests with the individual who breached the regulations, as with the engine driver who went past a red signal, or the social worker who did not insist on seeing for herself the child on the at-risk register. However, those other reports went on to say that the signal was in the wrong place and the driver was not trained properly, and that the social worker had too many cases, but that their manager did not pick up on that. In that way, the trail goes up the management line. My money is on the same type of conclusion being reached in the case that we are considering. The Government have to be cautious about grandiose schemes, pencilling in large savings, major reorganisations, and ignoring warning signals—of which there were many. At the end of the day, the buck has to rest with Ministers, who should not resile from their responsibilities.
3.38 pm
Mr. Adrian Bailey (West Bromwich, West) (Lab/Co-op): Out of respect for other Members, who have been waiting to speak for a long time, I will try to keep my remarks brief. First, I reiterate what other Members have said: we are talking about a hugely serious mistake, and the Government have to take profound measures to ensure that it never happens again. I have to say that I think that my right hon. Friend the Chancellor has demonstrated exactly what good government is by coming to the House and apologising, and by the measures that he put in place to try to prevent any repetition of the problem. I fear that the rather knockabout contributions of Conservative Members, with one or two honourable exceptions, have not done justice to the importance and complexity of the issues.
There is a range of issues underlying the mistake that demands the most serious consideration in the House. The first issue was outlined by the right hon. Member
for Charnwood (Mr. Dorrell), who spoke about culture. Why did the National Audit Office need that information and why did it try to obtain it in that way? There are huge questions about whether information was needed on that scale—I do not think that it was—and whether it was appropriate to deliver a disc from HMRC via a courier. One alternative that has been debated is the electronic transfer of information. I do not profess to understand the technology of the systems, but even the technological transfer of information is not absolutely safe or fool-proof. There is therefore a big debate to be had about the relevance of the information and how Government Departments should share it to guarantee its security as far as is humanly possible.
It is quite reasonable to assume that Government Departments will co-operate to ensure that information is shared if they need it to perform their operations. There is obviously a debate to be had about the proportionality of information sharing and the needs of different Departments.
That leads me to the second issue of systems. As a layman, I find it inconceivable that such important and comprehensive information should be stored and transported in that way. We have been assured—and I have no reason to believe otherwise—that it was against correct operational procedure, so it is important to ensure that Government Departments are security compliant with the provisions of the Data Protection Act 1998, and that the Information Commissioner operates effective monitoring systems. That appears not to be the case in this instance.
Thirdly, the balance of independence and responsibility is important. My right hon. Friend the Chancellor has accepted responsibility because the buck stops with the appropriate Minister. We have had a long debate about the appropriate scale of delegation, but HMRC is operationally independent and is headed by the chair of the trustees—the extent of his competence has drawn compliments from Members on both sides of the House—yet things went wrong. Ultimately, is it right for the Chancellor of the Exchequer to be expected to supervise and micro-manage an officer who is generally regarded as highly competent and capable of carrying out those functions? There is whiff of humbug about the contribution of some Opposition Members. I have been a Member of the House for many years, and have heard accusations levelled at the Chancellor, and the previous and present Prime Ministers for micro-managing and interfering in Government Departments. However, when they stand aside and let the professional run those Departments they are criticised for the mistakes that have been made.
The hon. Member for Twickenham (Dr. Cable) highlighted the wider issue of data protection and whether changes need to be made in the light of technological developments in the Government’s delivery of services. What new level of protection, if any, is needed? The hon. Gentleman gave the example of someone who wanted to gain access to their central medical records. The logic of his argument was that if we wanted to guarantee that those records went to the appropriate person, a biometric ID card would be the best way of ensuring that. There is an element of contradiction in the hon. Gentleman’s position.
| Next Section | Index | Home Page |