Examination of Witnesses (Questions 20-39)
RT HON
ED MILIBAND
MP, SIR GUS
O'DONNELL KCB AND
MR JOHN
FIENNES
16 JULY 2008
Q20 Mr Prentice: I do not want to
take the Committee off at a tangent, but Poynter, looking at everything
that happened in Revenue & Customs, said that there was an
"unsuitable organisational design" of Revenue &
Customs. I went back to the Capability Review, which was published
in December. Re-reading that, knowing everything we now know,
it is appalling that we spent £6 million to bring in McKinseys
to redesign—and I am quoting from the Financial Times—"The
architects of the structure for the mergered organisation ...
they were McKinsey, the consultancy firm, which was paid £5.5
million for its advice on the new organisational model".
That is the matrix management model, which has been comprehensively
slagged off in the Capability Review. You, Gus, were very closely
involved in the merging of the two departments.
Sir Gus O'Donnell: Yes. Could
I answer that?
Q21 Mr Prentice: Yes.
Sir Gus O'Donnell: Clearly, if
you look at what Poynter says about the merger, you will see that
he is strongly in favour of it. I will quote from Poynter. "The
decision to merge (Inland Revenue) and (HM Customs and Excise)
was the right one, for the reasons set out at the time, and I
support it." This was not anything to do with the merger.
Let us be clear about that. The issue post-merger was that David
Varney decided to introduce a matrix model of management. He was
trying at that time to address a number of issues that he regarded
as being quite siloed within the department; and, yes, he used
some consultancy support for that organisational redesign. The
issue that the Capability Review picked up was the question about
whether—and Poynter also refers to it later, but the Capability
Review was there first—that trade-off had been put in the
right place. As you move to matrix management, you make accountabilities
slightly less clear, and basically the Capability Review was saying
that actually it would be better to strengthen the accountabilities
in a certain way. That is what we have done. Since then, we have
acted on that and the new chairman, Mike Clasper, is working on
implementing changes following on from the Capability Review.
Q22 Mr Prentice: I understand and
I listen carefully to what you have said, but the Capability Review
makes pretty devastating reading. I have to say that. I do not
want to tire the Committee by reading chunks of it but, believe
me—
Sir Gus O'Donnell: I would strongly
back the Capability Review report, and these were the things that
I implemented.
Q23 Mr Prentice: I have just one
or two other questions before I hand over to my colleagues. Revenue
& Customs has made it its target to deliver a reduction of
12,500 full-time equivalent posts. Is the work that these people
are doing just being outsourced or what? That is my first question.
Then it says that Revenue & Customs " ... has already
met its Gershon efficiency targets of saving at least £507
million"—half a billion—"in annual running
costs (including IT ... )". I suppose my question is what
are the savings in running costs of IT, given what we now know
about data loss and so on?
Sir Gus O'Donnell: On how they
are managing to reduce numbers, basically this is the application
of lean techniques to the processes undertaken by Revenue &
Customs. They are actually improving the efficiency with which
they can manage paper. For example, I mentioned the 30% increase
in online handling. Every single self-assessment form that you
get online saves you a vast amount of time, because it has already
been checked on the computer. You cannot put the wrong thing in,
for example, in some of the boxes. There were a lot of people
who were spending their time dealing with the paper documents,
which took a lot of time. Now, as we are moving to something like
over three million people doing that online, there are dramatic
savings. There are dramatic efficiency savings for these very
large employee organisations through applying new techniques.
This is certainly true for DWP; it is also true for HMRC. On the
IT point, as we improve the IT systems—which is what we
are doing—again, we can improve efficiency and reduce numbers.
It is true that HMRC has a very large number of legacy, different,
IT systems. It is a bit of a hotchpotch. Therefore, there is scope
for further improvement there and that is what they are working
on.
Q24 Paul Rowen: Do you not find it
concerning, taking a question that was asked earlier, that the
Cabinet Secretary cannot reassure us that, if we go to the website,
the people responsible in each department for managing the risk
are actually named? When are you going to have a timetable that
will say, "These are going to be implemented and we can guarantee
that the procedures are in place"?
Mr Miliband: There is a timetable
at the back of the O'Donnell report on when the changes that are
being made will be implemented. On page 34 of Gus's report there
is a very clear timeline about what departments are doing. For
example, it says that by October 2008, " ... Information
Asset Owners will have their controls operating for their information
assets; and mandatory training for data users and senior managers
will have commenced, with its first cycle to have been completed
within 12 months". As to who the SIROs are, I do not know
if it is public information, but I am sure that we could get you
a list of who the SIROs are in each department, if that would
be of help to the Committee.
Sir Gus O'Donnell: We know who
they are. Alexis Cleveland for the Cabinet Office. There is a
list and we can give you a list for all the departments, but I
would stress that that is one person. If our response to these
issues is just to say, "Oh, well, we've got a SIRO"
and that is it, I do not think it would work—let me be honest.
It is about changing the culture of all of the staff within the
organisation and the way they all handle personal data. It is
not just about having one person and one board member.
Q25 Paul Rowen: I accept that but
it was the fact that you were not clear about who was responsible
for what.
Sir Gus O'Donnell: I am clear,
and they are named.
Q26 Paul Rowen: Following that up
then, the Poynter review said that, " ... as a general rule,
staff below the Senior Civil Service level prioritise operational
delivery over information security in the execution of their day-to-day
roles". I presume that if we applied that measure across
all departments we could probably say the same. What are you actually
doing to ensure that, below that senior level, information security
is prioritised?
Sir Gus O'Donnell: That is precisely
why you should not rely on just SIROs being appointed. It is why
the training has to go much lower. With Poynter, when you read
through all the detail, you will see these things were taking
place at levels well below the Senior Civil Service. That is why
we have to train everybody and that is why it is really important
that we have induction processes that explain to people the importance
of data. However, I stress again that we can give them training
manuals; we can explain about what technically you can do; you
can ban non-encrypted data—you can do all of these sorts
of things. The biggest challenge for me—and in a recent
conference on all of this it was agreed by both public and private
sectors—the challenge we face is in changing people's culture
actually to make them feel that personal data is as valuable as,
say, money, and that they need to protect it in exactly the same
way as we will protect money.
Q27 Paul Rowen: Should you not have
been doing that while you were introducing these new systems?
Gordon quoted your report from four years ago. Should this not
now be in place? Is it acceptable—it is not good governance
surely?—to say a very blasé way, "Well, staff
don't prioritise personal information"?
Sir Gus O'Donnell: What I am saying
is that if there is a mistake we made it was in relying too much
on guidance, as the Chairman pointed out, and not enough on testing
the compliance with that guidance. Certainly my report really
concentrates on making sure that not only have we got the right
guidance but that everybody implements it, and that we have methods
of scrutinising whether they are doing that. So there will be
lots of scrutiny. It is now very important for the accounting
officers, because it will be in the Statement of Internal Control;
so they will need to check within their departments, and actually
we will have trained every individual to regard this as really
important.
Mr Miliband: I would just add
that Gus and I are not blasé about this. Let us be clear
about this. HMRC, the MoD stuff and the other things that the
Chairman talked about, are damaging to public confidence—of
course they are. That is why Gordon asked Gus to have this review
across government. It is also worth saying—and again this
is not a sort of alibi, but it is important to say—the Walport/Thomas
review was commissioned before all the data losses. In a way,
that was a sort of acknowledgement that, across the piece, there
were issues about data-sharing that needed to be looked at. Specifically,
we are not blasé about this. This is very important and
very high priority.
Q28 Paul Rowen: Have you done an
estimate of the cost? We are told that for HMRC it is £115
million. What will be the cost over the next few years across
government, if you are going to implement all of these recommendations?
Sir Gus O'Donnell: We will fold
it into our training programmes. Basically, departments will re-prioritise
their training programmes so that this comes first. It certainly
will be costed. We do not have an estimate of it by department.
This is a kind of sine qua non; so, when you come to think
about training and development, this is the thing you will have
to do first.
Q29 Paul Rowen: You mentioned earlier
on that every laptop now has to be encrypted if it has sensitive
information on it. Does that include ministers and advisers?
Sir Gus O'Donnell: Well, (a) they
should not be moving around with large, personal, sensitive databases;
so you would not do that in the first place, I would hope; (b)
with respect to personal laptops, if they have got confidential-or-above
data on, yes, I would expect the hard drives to be encrypted.
Q30 Paul Rowen: So you could guarantee
us now that every minister's laptop, if it has got sensitive information
on it, has been encrypted?
Sir Gus O'Donnell: I would like
to think that there are no ministerial laptops that have large
personal databases on them.
Q31 Paul Rowen: Have we had an investigation
into the loss of Hazel Blears's laptop?
Sir Gus O'Donnell: That is being
investigated by the police and we are looking into that. The departments
are looking into that, certainly. I have suggested to all permanent
secretaries, as Ed will know, that the private offices of all
ministers talk to them about security of their computers, PCs
and laptops. Actually, I think this was not a laptop; it was a
PC.
Q32 Paul Rowen: An important part
of this is the resources for the Information Commissioner. Are
you going to make available additional resources for him to carry
out his duties?
Sir Gus O'Donnell: There is a
10% increase in his budget this year. At a time when public spending
is being tightly controlled and where HMRC, DWP, Cabinet Office,
Treasury—to name but four—have minus-five real every
year, he is getting a 10% increase in his resources.
Q33 Paul Rowen: Finally, one of the
recommendations of the Thomas/Walport report as to the Criminal
Justice and Immigration Act with regard to his powers, is that
the new fines are brought in by 8 November. Is the Government
going to do that?
Mr Miliband: I think that there
is going to be a consultation. MoJ is going to be consulting before
the summer recess, I am told, on that specific recommendation
or the issue of fines; so, I think, watch this space.
Q34 Paul Rowen: When do you expect
that to be implemented?
Mr Miliband: That is a matter
for the Ministry of Justice. What I do know is that they are going
to be consulting on that question before the summer recess; so
you will not have long to wait.
Q35 Paul Rowen: Does that not again
say, "We're taking all these reports seriously" but
we do not have a date when this power is going to be introduced?
Sir Gus O'Donnell: There is a
short consultation and then the question is that it is really
for the business managers to sort out how it can be done. I do
not think there is any dispute whatsoever about the issue. We
are quite keen to go there.
Mr Miliband: We clearly take the
issue of the Information Commissioner's office having the proper
resources very seriously. As Gus has illustrated, he has had a
10% increase in his budget in the last year. That is not happening
in the rest of government.
Q36 Chairman: These are not new powers;
these are powers that Parliament has already passed in an Act
of Parliament. The only question is when they are going to come
into force. I think that all Paul was asking was, when they are
going to come into force?
Mr Miliband: Why do we not write
you a note about that?
Sir Gus O'Donnell: As soon as
possible. Obviously there is no question on our side to delay
this at all; but there is just a question that there are some
things we need to consult on.
Q37 David Heyes: We know that it
will be very expensive as far as HMRC are concerned to improve
data security, because Alistair Darling has told us it is going
to be £155 million over the next three years. Yet I think
you said that you did not know how much it would cost for the
same exercise right across government. Is that right? Do you have
any idea of the likely total cost across government?
Sir Gus O'Donnell: In the light
of my report, departments are analysing precisely what they need
to do. For example, the training requirements will be slightly
different in different departments, depending on the nature of
their personal data holdings. They have not yet estimated precisely
how much this will cost for each of the departments; so I cannot
give you an aggregate total yet. What we have all agreed, is that,
whatever that is, departments do have reasonably large training
budgets and so they will prioritise this, as their first activity
in those training budgets.
Q38 David Heyes: Is that the case
in the £155 million that Alistair told us about? That includes
existing budgets for training, does it, or is that additional
funding?
Sir Gus O'Donnell: The HMRC have
their overall budget set in the Comprehensive Spending Review
and this, to the best of my knowledge, is from within that budget;
but I think that you would have to check with the Chancellor,
because he is the only one who could give himself a reserve claim;
so he is in a slightly different position. I assume that it is
from within their existing budget.
Q39 David Heyes: Let me press you
a bit further on this. Do you know how that £155 million
is to be allocated? Clearly a substantial chunk of it on training,
maybe changing the culture. What is the balance between that kind
of work and the work that we have also talked about, on changing
and improving systems?
Sir Gus O'Donnell: There are many
aspects to this. There will be culture change things, which, by
their nature, are about training; they are about induction. These
things are not very heavy on capital costs, but there are issues
to do with, say, encrypting various services; making sure that
data sticks, for example, are all encrypted; in some cases, changing
IT systems and improving IT systems, because what we would like
to be able to do is do data transfers through encrypted computer-to-computer—so
you do not ever go through having to download data from a device
to something encrypted that you would actually send through the
post, for example. I think that the most secure system is if we
can encrypt the data at origin, send it to an encrypted receiver,
and then it does not ever go through the post. It is just a purely
electronic transfer of encrypted data.
| 
