Examination of Witnesses (Questions 120-139)
MR DAVE
HARTNETT CB AND
MR NICK
LODGE
17 DECEMBER 2007
Q120 Chairman: A what?
Mr Hartnett: A Polylope bag. That
is the technical term for the bag. I have only learned this recently.
Chairman: Thank you very much. Don Touhig?
Q121 Mr Touhig: Before I come to
HMRC can I ask Sir John, what has the National Audit Office done
now to ensure its procedures are robust enough to avoid this sort
of thing happening again?
Sir John Bourn: Well of course
since this difficulty has arisen by the failure to get to us the
material which we had asked for, it does not lie within our power
to find the solution to this problem. We had asked for the material,
it was sent to us, but it did not arrive, so we cannot guarantee
for the future that that will never happen again. What we can
do—and what I would be glad to do is when Mr Poynter asks
me to collaborate in his work I said I would do my very best to
assist and help him. We have also commissioned ourselves an inquiry
about procedures for handling secure data to make sure that our
handling of material protected by the Data Protection Act is good
procedure and in line with best practice. So our response to this
has been full-scale collaboration with Mr Poynter, a review of
our own data security handling procedures, but since it was not
an act of the NAO that caused the material to go missing, that
is not something that lies within our power to deal with.
Q122 Mr Touhig: So really in one
word nothing has changed in terms of your approach—because
if I understand what Mr Hartnett said earlier there was a failure
to follow the protocols in requesting this information?
Sir John Bourn: As Mr Hartnett
has said, this is one of the issues that Mr Poynter is discussing.
From our point of view we asked for the data, the request was
accepted, and an attempt was made to send it to us.
Q123 Mr Touhig: So can we be clear
then, was there a failure of the protocol, Mr Hartnett, because
I thought that was what you implied in answer to Mr Hill earlier.
Mr Hartnett: My understanding,
Mr Touhig, is that the protocol did not work as it should have
worked.
Q124 Mr Touhig: It was not followed
or did not work? It was not wound up like a clockwork toy or something?
Mr Hartnett: Certainly it was
not followed by the officer involved but it may not have been
wound up properly. As Sir John has said, he is looking at this
and Mr Poynter is looking at this too.
Q125 Mr Touhig: And it was not followed
by the NAO is what you are saying?
Mr Hartnett: That is my understanding
on the basis of the partial evidence we have so far, but I accuse
the NAO of nothing. We need to understand what is happening here.
I would just draw your attention though back to the letter of
9 November. That is the letter from the Second Director where
his opening words go to the very point you raise.
Q126 Mr Touhig: So clearly, Sir John,
HMRC think there was a failure on the part of NAO to follow a
protocol. Whether that is accepted by the NAO or not, does that
not mean alarm bells should be ringing to ensure in future rather
than the one word "nothing" that I summarised your response
as, that the NAO should ensure that the proper protocols are being
followed?
Sir John Bourn: As Mr Hartnett
was careful to say, he does not actually say that there was a
failure on the part of the NAO to follow protocols.
Q127 Mr Touhig: Sorry, Sir John,
I thought that was what he did say. Am I missing something here?
Mr Hartnett, you said there was a failure of the part of the NAO
to follow the protocols.
Mr Hartnett: On the basis of the
evidence I have seen, which is partial, it seems like that to
me but I do not accuse the NAO of anything because I have not
got the evidence.
Q128 Mr Touhig: You are clear as
far as you are concerned that the NAO failed to follow the protocol?
Mr Hartnett: As did the HMRC not
do things properly.
Q129 Mr Touhig: So we are clear precisely
what Mr Hartnett is saying, Sir John.
Sir John Bourn: Yes, I heard what
he said. But, as I say, as far as we are concerned although, just
like Mr Hartnett, I am anxious to get to the bottom of this matter
and we will work with Mr Poynter to do so, the essence of the
matter is that we requested this information, the request was
accepted, it was not questioned.
Q130 Mr Touhig: I fully accept that,
Sir John, you did make that very clear at the beginning, but what
I am trying to establish is at the moment there has been no change
to the NAO's approach to these matters although the HMRC think
there was a failure to follow protocols in the first place.
Sir John Bourn: There has been
no change in the approach since what we are engaged in is seeing
whether the approach does need to be changed.
Q131 Mr Touhig: Can I come to you
then, Mr Hartnett, in the letter that you referred to of 9 November,
the writer of this letter says: "We do take seriously our
data protection responsibilities and I recognise that the security
incident that has arisen here has occurred solely as a result
of the data request that we initiated and I accept responsibility
for that." Do you think that means the NAO is taking responsibility
for the start of this debacle?
Mr Hartnett: I think the NAO is
saying there—and I surmise Mr Touhig—
Q132 Mr Touhig: Tell me what you
think it means.
Mr Hartnett: I think it means
that the Second Director of the NAO is saying we asked for the
data and that was the start of the process. I would like to know,
but others are talking I imagine to the Second Director of the
NAO whether it means—and I use the terms I used earlier
on of our own people—we did this thing of actually asking
for a full data set, we emailed you, we told you to send it to
us carefully, but we asked. I do not know the answer to that question
until I and others have the opportunity of asking the Second Director
what he meant.
Q133 Mr Touhig: I will have to read
the transcript to decipher exactly what your answer was, I am
afraid.
Mr Hartnett: I am really sorry.
Q134 Mr Touhig: The letter goes on
to say: "In this case, having redefined the direction of
our audit approach for child benefits, I should have personally
ensured that as data owner you were apprised of what we planned
to do." Does that imply, does that state that the NAO did
not tell you precisely what they planned to do with the data?
Mr Hartnett: I think that is the
Second Director saying to our child benefit process owner, "I
should have talked to you about the approach we were taking in
this audit. You are the process owner and I am sorry I did not
do it." I do not think I read into that anything in particular
about disks and the provision of data.
Q135 Mr Touhig: No, I will come on
to disks. So if we accept your definition, this is one official
to another saying: "I should have briefed you on this",
but does this letter state—and is it a fact—that your
Department had no idea about the new audit approach or is this
just a rather courteous response and taking responsibility for
something?
Mr Hartnett: I have not read it
like that. I have read this as meaning that this relatively senior—Sir
John, I am sure, will correct me if I have got this wrong—Second
Director in the National Audit Office had not discussed this with
the child benefit process owner but his people may have discussed
it lower down in the organisation.
Q136 Mr Touhig: Do you know?
Mr Hartnett: I do not know.
Q137 Mr Touhig: The NAO were telling
us there was a new approach to this audit. Did your people actually
know that?
Mr Hartnett: I do not know the
answer to that.
Q138 Mr Touhig: Why do you not know
the answer.
Mr Hartnett: I know that the child
benefit process owner did not know the answer to that. In order
to know there was a new approach my people would have had to have
talked to people. Our investigation has halted while the other
investigations take place, so I have not been able to and my colleagues
have not been able to ask our people.
Q139 Mr Touhig: So you do not know
that there was a new approach because presumably there was nothing
in writing or there was no discussion?
Mr Hartnett: There are emails
which tell part of the story, which Miss Mawhood has explained
earlier on, that HMRC had taken a different approach to monitoring
claimants' compliance with the rules for child benefit and that
the NAO were testing that in a different way, so we knew there
was a different approach to the audit happening but it had not
been explained, as I read this.
| 
