Appendix: Government response
Thank you for the Justice Committee Report on the
Protection of Private Data. It is an interesting Report that raises
important issues about data security and associated issues.
The Government takes data protection seriously and
we have considered the Report carefully. As you know, we have
launched a number of measures to explore how we can improve data
protection and still secure the benefits of data sharing so I
am afraid this can only be an interim response. I will keep the
Committee informed of developments as they occur.
I attach a copy of the response and I should be happy
to answer any further queries that you have on this matter.
Government Response to the Conclusions and Recommendations
of the Justice Committee Report on Protection of Private Data:
1. The Government thanks the Committee for its report
on Protection of Private Data. We take data protection seriously.
2. Reconciling the benefits of data sharing with
data protection present a challenge to Government. Personal data
is a valuable resource and the proven benefits of data sharing
in the public sector must be balanced against ensuring that an
individual's right to the appropriate level of protection for
their data is maintained. Information sharing delivers key benefits
for the citizen, from protecting society as whole from harm, to
more efficient and tailored public services. However, Government
recognises that having appropriate security measures in place
to protect personal data is central to securing the benefits of
data sharing.
3. Given continuing legal and technological developments
the Government recognises the need to review routinely the statutory
framework for data protection to ensure that personal information
is afforded the most robust protection. In October 2007 the Prime
Minister set up an independent review chaired by Dr Mark Walport
of the Wellcome Trust and the Information Commissioner, Richard
Thomas, to look at how personal information is used and protected
in both the public and private sector. The review is considering
the operation of the Data Protection Act 1998 and the options
for implementing any such changes; it will provide recommendations
on the powers and sanctions available to the regulator and courts
in the legislation governing data sharing and data protection;
and provide recommendations on how data sharing policy should
be developed in a way that ensures proper transparency, scrutiny
and accountability. The Review issued a consultation. The Review
is due to report in the first half of 2008.
4. We note the conclusion of the Committee that there
is evidence of a problem relating to data protection systems in
the public sector. As a result of data loss incidents since November
2007, there has been a wide range of work across Government looking
into data handling within Government. All work has been undertaken
in parallel with the Thomas/Walport Review.
5. On 21 November the Prime Minister asked Keiran
Poynter, the chair of PricewaterhouseCoopers, to lead a review
on what led to the loss of confidential personal information,
including national insurance numbers and bank account details,
of Child Benefit recipients and the lessons to be learnt from
the incident. An Interim Report was published in December 2007
which set out the work Kieran Poynter has already put in hand.
It makes recommendations as to the immediate steps that Revenue
and Customs must take to protect data security. It has already
put in place a number of measures.
6. These measures include:
- the imposition of a complete
ban on the transfer of bulk data without adequate security protection,
such as encryption;
- measures to prevent the downloading of data without
adequate security safeguards; and
- Revenue and Customs disabling all the personal
and laptop computers it uses to prevent the downloading of data
on to removable media. These will only be reactivated with approval
of a senior manager, and for a specific business-critical purpose.
7. A full report is due in Spring 2008.
8. In addition to the Kieran Poynter Review, the
Prime Minister commissioned a Cabinet Office Review led by Sir
Gus O'Donnell, with the advice of security experts, to work with
Departments to ensure that all Departments and all agencies check
their procedures for the storage and use of data.
9. The terms of reference for the work are to examine
the procedures in Departments and agencies for the protection
of data; their consistency with Government-wide policies and standards;
the arrangements for ensuring that procedures are being fully
and properly implemented; and to make recommendations on improvements
that should be made.
10. The first stage concluded on 10 December 2007
and involved Departments undertaking an analysis of their systems
and procedures for complying with policies and standards on data
protection, including making recommendations for practical improvements.
11. On 17 December 2007 the Sir Gus O'Donnell Review published
Data Handling Procedures in Government: Interim Progress Report
which set out the findings of the review so far, provided an update
of the progress and detailed the next steps. In particular, the
Review indicated that legislative steps should be taken to enhance
the ability of the Information Commissioner to provide external
scrutiny of arrangements by considering the options to extend
the spot checks of Government Departments to the entire public
sector and introducing a new sanction under the Data Protection
Act for the most serious breaches of its principles. Stage two
of the Review will look collectively at improved standards and
procedures across Whitehall which is due to be completed in early
2008.
12. The Committee also raised concerns over the level
of funding for the Information Commissioner's Office. The Commissioner's
Office receives a grant in aid to cover only the Commissioner's
FOI responsibilities. His data protection work is currently funded
by notification fees paid by data controllers under section 26
of the DPA, which his office retains with the agreement of HM
Treasury. In 2006-07 this was £10,200,000. We are currently
considering the Commissioner's case for increased resources.
13. In addition to the reviews, the Prime Minister
asked the Information Commissioner to carry out spot checks on
the compliance by Government Departments with the Data Protection
Act. This does not entail any legislative change. The proposed
spot checks will initially be focused on Whitehall Departments
and will start in early 2008.
14. The outcome of the reviews will help the Government
to understand how to move forward with data handling following
recent security breaches. All of the reviews and actions outlined
above were either in place or making progress whilst the Justice
Committee were gathering evidence for the report on Protection
of Private Data. We will continue with the actions that have been
outlined and await the final recommendations so that we can take
a considered view of the range of measures necessary to strengthen
the protection of personal data.
Michael Wills MP
Minister of State
Ministry of Justice
29 February 2008
| 
