Examination of Witnesses (Questions 1-19)
MR DAVE
HARTNETT CB AND
MR NICK
LODGE
17 DECEMBER 2007
Q1 Chairman: Good afternoon. Welcome
to the Committee of Public Accounts where today we are considering
the loss of child benefit data by HM Revenue & Customs. We
welcome Dave Hartnett, who is Acting Chairman of HM Revenue &
Customs. Could you introduce your colleague please, Mr Hartnett?
Mr Hartnett: Yes, Chairman, and
good afternoon. To my left is Nick Lodge, who is our Director
of Data Security, recently appointed.
Q2 Chairman: What day were you appointed,
Mr Lodge?
Mr Lodge: 21 November.
Q3 Chairman: So this was after the
statement to the House about the loss of this data?
Mr Lodge: Yes.
Q4 Chairman: Did you have a predecessor
who was responsible at the time of this incident?
Mr Lodge: I did not have a direct
predecessor, no.
Q5 Chairman: Why not?
Mr Lodge: There was no direct
predecessor in that post. It was a new post created.
Q6 Chairman: Why not? Why was there
no person in HMRC in overall charge of data security before this
incident? Why did this incident have to take place with the loss
of the details of 25 million people before you appointed a head
of data security?
Mr Hartnett: Chairman, I will
take this if I may. There was no single person responsible and
that is one of the issues that Mr Poynter brings out and that
we have recognised. When I became Acting Chairman, I felt a need
for a director in that position immediately, and it was one of
a number of steps I took on assuming my role.
Q7 Chairman: Is Mr Lodge at board
level?
Mr Hartnett: No.
Q8 Chairman: Who is responsible at
board level?
Mr Hartnett: I think a number
of people are responsible at board level and that has been one
of the lessons we have learned. There are three or four different
people—the Director General for Compliance, because it was
his people who were involved in managing disks; our CIO; and the
Director General responsible for benefits.
Q9 Chairman: You do not think it
is sufficiently important to have a single person at board level?
Mr Hartnett: Chairman I do, and
that is why I have appointed one.
Q10 Chairman: But Mr Lodge is not
on the board.
Mr Hartnett: I am sorry, Mr Lodge
reports to me.
Q11 Chairman: Right, thank you. Who
was the senior manager responsible then at the time who would
have been responsible for ensuring that procedures were followed
correctly? Who would that have been?
Mr Hartnett: Had the process owner
for child benefit been fully involved in this he would have been
the senior manager responsible.
Q12 Chairman: And the process owner
for child benefit was not consulted?
Mr Hartnett: The process owner
for child benefit does not seem to have been fully consulted.
He features in one email I have seen from March and features in
a couple of emails in October.
Q13 Chairman: Is this Mr Nigel Jordan?
Mr Hartnett: That is Mr Jordan.
Q14 Chairman: He figures in the email
on 13 March; it was copied to him?
Mr Hartnett: He does figure in
that email.
Q15 Chairman: This incident took
place some time ago, presumably you have had a chance to talk
to Mr Jordan about what happened, have you?
Mr Hartnett: No. As soon as the
police and other agencies became involved the HMRC enquiries stopped.
I gather that one or two of my colleagues have spoken to Mr Jordan.
Q16 Chairman: Presumably you have
been briefed about that?
Mr Hartnett: I have been briefed.
Q17 Chairman: So when Mr Jordan was
copied in on this email of 13 March, this was an email, was it
not, where the National Audit Office requested this information
but said they did not want to have all of the personal bank details.
That is right, is it not?
Mr Hartnett: He was copied into
those emails but, Chairman, at that stage—
Q18 Chairman: Having been copied
in, what did he do with that information?
Mr Hartnett: Mr Jordan was not
available, as I understand it, when the email was sent to him.
What is important here is that at the time Mr Jordan was copied
in there was no suggestion that I have seen or my colleagues have
seen that this data was to be removed from Waterview Park where
the NAO were working on it.
Q19 Chairman: We have this email
and we can consult it, can we not; it is in our bundle here.
Mr Hartnett: Yes you do.
| 
