Select Committee on Home Affairs Minutes of Evidence

Examination of Witnesses (Questions 400 - 415)



  Q400  Bob Russell: So I can be satisfied that I as the technology challenged Member of Parliament for Colchester will not be discriminated against?

  Mr Suffolk: Absolutely.

  Q401  Bob Russell: Thank you. How does the CIO Council ensure that where possible technology-based systems are not duplicated? How is information on the development of systems shared across government?

  Mr Suffolk: One of the processes I have put in on the CIO Council is a process called the champion/challenger process. It is fair to say that the public sector has vast amounts of technology and we do not always see where that great technology is and we run the risk of reinventing the wheel which increases risk, increases cost, and slows our time from a citizen outcome perspective. The champion/challenger process is a very simple process. Anyone can nominate a champion. Let me give you an example. The Government Gateway, where we have 12 million citizens and businesses registered so they can get access to government services—someone can come along and say, "I believe that is a champion asset." Anybody can come along and say, "No, I think I have got a better one," and therefore it is quite democratic in terms of the way we do this. An evaluation process occurs and the best product will commence. The rule is quite simply this: if you cannot beat it, you should join it. It is a peer-based review, it is very democratic, it does not take a long time to do, but the objective is to begin to coalesce the systems and technology that we have already in the public sector that we can continue to invest in and protect and support without having to go through connecting 23 different systems together. That is a long-term activity but it is also the right way of doing things. The CIO Council runs that process.

  Bob Russell: Thank you, Chairman.

  Chairman: Thank you very much, Mr Russell. Gwyn Prosser?

  Q402  Gwyn Prosser: Mr Suffolk, one of the strands of the Transformational Government Strategy, as you know, is shared services and common infrastructures, which includes a reduction in the number of computers storing data and networks, et cetera. It seems on the face of it perhaps a logical progression but we have heard from a committee of Dutch experts that their recommendation in their country to move towards a single clearing house for data was met with huge opposition on the grounds that greater centralisation could result in a greater threat to security. What is your view? Where is the balance to be struck?

  Mr Suffolk: I think you are absolutely right; there is a balance to be struck. First of all, I think it would be nonsense to assume or even think about a central database and a central clearing house. The UK public sector is more advanced than many countries because we have been doing joined-up technology for years. The oldest computer system that I know in the public sector is 33 years old on 1 April 2008, which is the Police National Computer, and therefore we work at a national scale, and when you work at a national scale I think to continue to put more eggs in a single basket is a foolhardy approach. You are absolutely right when you say that some of the best ways of protecting data are to say that this data has a specific purpose, the purpose is clear in terms of all parties, and therefore we can put protection around that specific purpose in terms of only the people that need legitimate access to that data can access that data. The more and more we put it into large databases where more and more people have access to it, it becomes more complex. I think there is a balance to be struck, but clearly what we want to avoid doing is creating yet another large-scale citizen database when we have a number of those already because that would not be a wise thing to do.

  Q403  Gwyn Prosser: Ms Moriarty, the passage of the Serious Crime Bill represents a good example, some people say, of cross-government working on data-sharing. If that is your view, what was done right during that exercise which made it such a success and what could the Ministry of Justice learn from the exercise?

  Ms Moriarty: It is a very good example because fraud as a crime is obviously an area where information sharing can be of great benefit. What was specific about the Serious Crime Act was that the information that needed to be shared was relatively sophisticated and relatively sophisticated arrangements were needed because of the nature of fraud as a crime, and that meant the protections that needed to be in place were also more complex than in some areas. What happened with that piece of legislation was the Ministry of Justice worked very closely with the Home Office in framing the legislation which provides a legal gateway through which public authorities can share data in order to prevent fraud. There was a lot of discussion between the two departments and with the Information Commissioner on exactly what was the best way of achieving the policy objective. As the legislation went through Parliament there were a number of changes made, particularly the introduction of the requirement for a Code of Practice. It is a good example of spotting the issue, working together between departments and with the Information Commissioner to find the best way of addressing that issue, making sure that we have the right powers in place to do it and also listening to the views of Parliament and being prepared to make amendments as the legislation goes through.

  Q404  Gwyn Prosser: How will the Ministry of Justice work with the Information Commissioner to take forward the Framework Code of Practice for Sharing Personal Information?

  Ms Moriarty: The Information Commissioner has published the Framework Code of Practice and we very much support that as a way of encouraging public authorities to develop Codes of Practice and giving them a template to work with. We will be working with him and with the public authorities as they develop their Codes of Practice.

  Q405  Margaret Moran: You will be aware that the Varney report referred to engaging citizens, businesses and the private sector in both the design and delivery of services. Referring specifically to Clare at this moment, how can you assure citizens that the data-sharing that requires is done in such a way that gives them confidence to be able to access those services? Is it not true to say that a great deal of what is good in Transformational Government is data sharing by stealth, in other words local authorities, for example, are doing some of this Transformational Government public service delivery but they do not want to tell anybody because the data-share rules are so obscure?

  Ms Moriarty: To take the first part of the question, public trust and confidence is one of the biggest challenges that we face. We know from research which Ipsos MORI did that the vast majority of people want to see more sharing of information in order to produce better and more joined-up services, provided that the right controls are in place around the data. The Information Commissioner published his tracker survey last week and that showed us that people are very concerned that their data is properly protected and they are very concerned about the sorts of things that might happen to it. We are not seeing a huge groundswell of people who are really concerned that organisations are not looking after their data properly but they do feel they are losing control over their data and they want more reassurance that the legislation and the operational practices are going to provide, and are going to continue to provide, adequate protection. That is why, while we are confident that the basic architecture of the data protection, data-sharing system is robust, we have to keep looking at it as the technology moves on, as people's expectations move on, so we need to be making sure that it is constantly up-to-date. That is something we do all the time internally and we have also recognised the need to have some independent input to that process and that is why we have set up the independent review which Richard Thomas[2] and Mark Walport[3] are going to lead looking at the use of information in both public and private sectors.

  Q406  Margaret Moran: I also mentioned the fact that people are doing data-sharing by stealth in the public sector.

  Ms Moriarty: I am not aware of any detail about that.

  Q407  Margaret Moran: Local government?

  Ms Moriarty: Broadly speaking, as I said, the Framework is that there has to be a purpose in order for data-sharing to take place, there have to be the correct powers in the place, there has to be an assessment of the proportionality and the data has to be properly protected. As long as all of those things are in place then it is reasonable for people to share data, but if they are sharing data without the powers then that is something which is an issue that we need to take up with them and the Information Commissioner.

  Q408  Margaret Moran: Perhaps you would like to comment on that, John, but can I ask you particularly, what is your role in ensuring that government departments do engage with the public when they are developing Transformational Government services and sharing personal data? Could you comment on the fact that when we spoke to the head of the Social Inclusion Unit recently she made the comment that the issue around data-sharing and privacy is very much a middle class concern rather than a concern of those who need those services at the frontline.

  Mr Suffolk: Thank you. There are three points there. The first one is that I am not aware of anyone sharing data on stealth. The question was asked if we sometimes get in and arbitrate deals with departments and the answer is, yes, we do and frequently that comes around people's interpretation of "Do I have the powers to data-share?" All of my experience when I work across local and central Government is that people are very conscious in terms of data-sharing, very conscious in terms of do they have the powers and do they have a legitimate purpose. I am absolutely not aware of anything occurring by stealth, as Clare has already said. If we knew that then we would go in and work with the teams and understand why that has happened.

  Q409  Margaret Moran: Do you talk to SOCA teams?

  Mr Suffolk: I am very happy to talk to SOCA and I will take it up with our colleagues in SOCA. In relation to the second point, which was engaging citizens to understand what they want, as part of the Varney work in terms of Transformational Government, which is putting the citizen at the heart of what we do, we have created a thing called the Customer Insight Forum and the objective there is to share information about what citizens' wants, needs, likes and dislikes are because, of course, citizens come to us in different guises and that is why we have created things like Customer Directors, one for old people, one for farmers, and of course you could be an older person and a farmer. The purpose there is to say, "Let's look through the eyes of the citizen and understand what their need is and what the best way of delivering that need is." It is fair to say historically that we have not always been as good as we could have been in terms of sharing that insight, hence why we created the Customer Insight Forum and why we have positioned that knowledge, that information, at the heart of the way that we do service design. We are absolutely conscious in terms of we have to look at it through the eyes of the citizen and we have the processes on board in terms of doing that. Your point about data-sharing and security being a middle class view, I have heard that said before and those who want a benefit would say, "Guys, share my data to give me the benefit". Our starting point is really quite simple: what is it that we are trying to do with the citizen, what is their need? If their need, for example, is giving benefits quickly then the systems and the programmes that we have designed are around fulfilling that requirement. We never look at this from a one-size-fits-all point of view in terms of, "Here is an approach which will apply to all walks of life", it fundamentally does not work that way. Customer insight mapped on to what is the purpose and what problem are we trying to overcome from the citizen's perspective should drive whatever solution and technology that we put in place.

  Chairman: The final question is from James Clappison.

  Q410  Mr Clappison: Could I ask you both if you would comment separately from your points of view to tell us if you track trends and new developments relating to data-gathering and data-sharing? One example which has had a bit of publicity in the past is the use of loyalty cards which give businesses a great deal of personal information about shopping habits and, perhaps even more topically, the growth of social networking websites, which the younger generation know all about but I have got to say I do not know all that much about.

  Ms Moriarty: From the Ministry of Justice, we work with all government departments who in turn work with the various sectors that they connect with, so within each sector departments will be gathering information and looking at trends. We also work closely with the Information Commissioner. We have complementary roles. We are in charge of setting the Framework, he is in charge of regulating it and, obviously, as the regulator he can gather evidence about all the sorts of issues that are coming up, and certainly social networking forums is one of the issues that he has identified and he is working on guidance to make sure that people understand the basis on which they are giving their consent, that they know what might happen to the data. It is something where we work, as part of our work across Government, with departments and the Information Commissioner.

  Q411  Mr Clappison: From your point of view, given the difference of roles between yourself and the Commissioner, have you seen anything in trends in the social networking sites, some of which are obviously well-known, which concern you or are of interest to you?

  Ms Moriarty: It is one of the issues that make us aware that we constantly need to be looking at the Framework to make sure that it is up-to-date, and that is something we would expect the Thomas / Walport review to be looking at because it covers the crossover between the public and private sector.

  Mr Suffolk: We certainly do track all of the social networking and the trends in terms of what people are doing and we do this for a number of reasons. The first reason is in terms of what are people's perceptions in terms of security and personal privacy. We ran the Get Safe Online Week last week and all the research is telling us that still we have 20% of people who use technology on the Internet who do not have basic protection. Of the 80% who do, 50% do not keep it up-to-date. When you translate that on social networking, those behaviours are often translated as well, so people do give out their date of birth and personal information which, of course, is a primary cause and stimulus from an identity theft perspective. Often we track the technology from the basis of how are people using those technologies and what does it tell us in terms of their propensity to secure themselves or not to secure themselves. Also, if you take something like mySpace, one of the bigger social networking sites, the amount of users on that is equivalent to the eleventh largest country in the world. It fundamentally begins to tell you how the world is shifting in terms of how people treat technology and how they expect service providers and governments to deal with them from a technological perspective, and we track it in that context in terms of what is the norm in terms of the way we are doing business and what are the consequences of doing business in that way.

  Q412  Mr Clappison: Could I ask on a slightly separate subject if there are any lessons you think the Government can learn from the private sector in terms of harnessing IT capability?

  Mr Suffolk: We partner extensively with the private sector and much of what we do from a technological perspective is outsourced to the private sector. Clearly we are working at a scale which is much bigger than the private sector from the number of countries that we deal with, because we operate in 148 countries now, and we work at a level of security the private sector would not need to worry about because we have to protect loss of life, witness protection, domestic violence, et al. Where I think the private sector is exceptionally good is how do you create customer facing worlds that absolutely map on to their hopes, their aspirations and their requirements in a quick way and, therefore, there is always learning that we look to take from the private sector. We also work extensively with every major supplier from around the world because, rightly or wrongly, I have a belief that somebody somewhere in the world has cracked most of the problems, we just do not know where they have cracked them. One of the roles that I am more used to is to act as a kind of data agent where someone says, "I have a particular problem, do you know somebody with a solution?" and often those solutions exist somewhere under a different banner in health or education and we try and match those two up.

  Q413  Margaret Moran: A small but practical question. I recently visited my CCTV hub in Luton and they have been the subject of some publicity because a beating up in the town centre was relayed on to YouTube, I believe. What mechanisms are there to retain the privacy of that data through the whole process so that both the victim and those who are the alleged perpetrators are not identified and, indeed, the integrity of the criminal justice system is not jeopardised?

  Ms Moriarty: That is obviously a misuse of data because the data collected by the CCTV cameras is not intended to be used for those purposes, so there is a breach of data use there. We have a system for regulating compliance with the Data Protection Act. One of the things we have recently done is to change the penalties for wilful misuse of data because the Information Commissioner gathered evidence that the penalties were not—

  Q414  Margaret Moran: I am talking about the process, the trail of that.

  Ms Moriarty: The trail of process?

  Q415  Margaret Moran: The data is shared across a number of actors within the criminal justice system from the CCTV operator to it ending up on YouTube, but there were a lot of actors in-between.

  Ms Moriarty: It depends on what data-sharing arrangements are in place, but the data-sharing arrangements all have to be governed by the provisions of the Data Protection Act, so there has been a breach and if it is a breach which is significant then that is something which needs to be investigated and, if necessary, prosecuted.

  Mr Suffolk: If I could just come in there. It really comes down to what Richard Jeavons said this morning. The more and more that the technology becomes sophisticated, we absolutely will be able to find people who are getting access to systems and using information illegally. In that instance where clearly they have breached the Data Protection Act by taking data and using it for a purpose that it was not intended, there will be audit logs in terms of who had access to those systems. My belief is that we have to execute that review process to find out what went wrong in a situation like that and learn those lessons because it is clear that is not what should have occurred.

  Chairman: Mr Suffolk, Ms Moriarty, thank you very much for giving evidence today. We have almost concluded our evidence for our report into the Surveillance Society. Our next evidence session on this will be on 11 December when ACPO and the Minister at the Home Office, Tony McNulty, will be giving evidence.

2   Note by Witness: Richard Thomas is the Information Commissioner. Back

3   Note by Witness: Dr Mark Walport is the Director of the Wellcome Trust. Back

previous page contents

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008