Examination of Witnesses (Questions 60-79)
RT HON
ED MILIBAND
MP, SIR GUS
O'DONNELL KCB AND
MR JOHN
FIENNES
16 JULY 2008
Q60 Paul Flynn: From what to what?
Sir Gus O'Donnell: I have not
got the figures with me.
Q61 Paul Flynn: The figure was in
The Observer, and it suggested it was £10,000 per
civil servant.
Sir Gus O'Donnell: Definitely
not £10,000 per civil servant.
Chairman: The comment in The Observer
will probably be on the same level as your comment in the Financial
Times.
Paul Flynn: Oh, surely not.
Q62 Chairman: More or less.
Sir Gus O'Donnell: No, no. You
started off by saying "per public sector worker and per civil
servant". There are half a million civil servants and there
are five million in the public sector so there is a huge difference
there.
Q63 Chairman: Let us move on.
Sir Gus O'Donnell: I could look
at those numbers. As the person responsible for the Civil Service
I can tell you the amounts we are spending on consultancy are
diminishing and I would be very happy to supply more information
on that. I think it is important. As we do this, you are absolutely
right: to my mind the key to this is for us to do it ourselves.
This is about training civil servants. We may need some outside
help at the start but I would see that outside help being a temporary
matter of us training ourselves in order to have the right skills
in-house so that we can do all that training in-house.
Mr Miliband: I am not sure the
incubus you are referring to, but the thing we are doing is saying
that the Information Commissioner should have the power to conduct
spot checks on the way data is being handled, which I think is
a sensible form of external scrutiny that would take place.
Q64 Paul Flynn: But he is talking
of a large expansion in his budget if it takes place, that is
the incubus, and it does seem to me that, while it might be reasonable
to have another department to check now and again, to have another
empire being built on the back of the Civil Service should not
be necessary.
Sir Gus O'Donnell: There is this
whole question of how do you want us to do scrutiny of departments?
What the Information Commissioner is suggesting is that there
should be external scrutiny of these whole procedures. To pick
up what the Chairman was talking about, we have issued this guidance
but is it being implemented in practice? What he has said, is
that he wants to have the right to go in and do spot checks, and
those spot checks will be paid for by the departments.
Q65 Paul Flynn: You are pretty positive
about the fact that there has not been a collapse of public confidence
in the figures in this, but surely there must have been an effect
when we look towards ID cards and the National Health Service
database. Does this not put these in peril?
Mr Miliband: No, I do not think
it does that but I think it reinforces on us a big responsibility
to show that we can manage people's personal data securely. If
you take the ID cards specifically, why are we embarked on the
process of ID cards? Because I see fraud as a big issue in our
society in many different ways and it will become an increasing
issue unless we do something about it. We are putting in place
high level protections in relation to the ID card system. The
ID card system will have its own scheme commissioner. At the moment
we have got the Information Commissioner for the whole of the
public and private sectors. ID cards will have their own scheme
commissioner looking at the security of the system, but it is
also the case that for ID cards to become compulsory for all citizens,
it will have to come back to Parliament, and Parliament will then
have to make a judgment about whether, among other things, the
right controls are in place. I think what you are saying to me
is that we have a job to do to convince people of the security
of data generally, absolutely right, and future projects will
need to command public confidence.
Q66 Paul Flynn: And there is a job
to do in public relations in convincing them of the value of having
all this information anyway?
Mr Miliband: Generally?
Q67 Paul Flynn: Yes.
Mr Miliband: Yes, I think you
are right. You make a fair point about us always explaining to
people: why are we collecting this information? Why is it going
to help to deliver public services? That is something that we
absolutely have to do, particularly in the light of the events
that have happened.
Paul Flynn: I am grateful to you; thank
you.
Q68 Chairman: Just on one of Paul's
questions, I have a friend who used to be a probation officer
who, when all these stories were blowing up, told me that any
probation officer who took material home, private material on
clients, was instantly dismissed. It was just an instant sacking
offence, and yet Paul can tell these stories about the Chief of
Staff at Number 10 riding round with all this classified stuff
in his rucksack, people leaving laptops all over the place with
highly confidential stuff on them, and nothing seems to happen.
Sir Gus O'Donnell: It is not true
that nothing happens. The person who left the laptop, as I have
said, has been censured and the military are looking into the
whole process there. As for the person from the Cabinet Office
that left material, that is being investigated. That individual
has been suspended and we are in the middle of an investigation
which could lead to disciplinary proceedings. I cannot say more
because the investigation is still under way but it is the case
that we will look at these issues and there will be responsibilities.
In the case of Paul Gray, there is the head of the department
who basically said, "Look: this is a very serious matter
and I am standing down as a result of this".
Q69 Chairman: But, leaving aside
the question of the gap, as we have established and you have conceded
really, between the guidance and the practice that is revealed
by this. Is it not also the case, and reading the report suggests
to me that it is the case, that there is a lot of excitement about
transformation of government and with that—and we have heard
it today—the benefits of data sharing and getting away from
paper and going on line and all that, and the system got engaged
with that? It also was getting engaged in responding to the new
era of freedom of information and gearing the systems up to deal
with that, but it took its eye off this rather basic ball of data
security, did it not?
Sir Gus O'Donnell: I would add
a third change that was going on at the same time, which was movement
to more flexible working, so you will find that people are working
from home more and so we need to establish which departments are
required to have very secure computer links, for example, so that
you can work with them, and the truth is that society is moving
towards more use of laptops and more use of data on the move.
This is something that is going on in general and we need to be
able to respond, alas, in this world 24/7 to various things, so
we need to be able, wherever we are, to get access to some of
these systems. All of those trends just underline the importance
of us being able to do these things highly securely.
Q70 Chairman: But while we were all
getting excited by the up side of the IT revolution for public
services, the down side was that if you lost a file in the old
days you just lost a file. Now you can lose 25 million files,
as it were, in one press of a button. Not to have paid serious
attention to that—
Sir Gus O'Donnell: I think that
is important but, picking up Paul Flynn's point, there is a massive
up side to this, that because of that ability—you know,
the Tell Us Once pilot that I visited—to talk to people
and say, "Can we share your data?", so when an individual
phones up and says, "One of my parents has died", we
can adjust their benefits, so that they are not overpaid in certain
cases for someone that has died, and we can help them with their
own issues to do with handling that bereavement. Sometimes there
is medical equipment that that person had which we can now get
back into the system, thereby improving public services. There
are vast unspoken benefits. Unfortunately, neither the FT
nor The Observer will write articles about this. I wish
they would, but there are massive gains from this.
Q71 Mr Prentice: I thought the negatives
outweighed the positives though. That is the point.
Sir Gus O'Donnell: Absolutely,
and my point is, let us try and get both. Let us try and keep
all of those positives but you are absolutely right: in order
to keep the positives we do need to improve our ability to protect
and share appropriately the data. That is the whole thrust of
what my report is about.
Chairman: It is a great misfortune in
public policy that up sides normally come with down sides, and
we were getting so excited about the up sides I just think that
we seem to have taken up a pretty big down side.
Q72 Mr Prentice: I think there would
be a lot more attention on data security if permanent secretaries
were thrown in jail for breaches. I have got the Justice report,
which came out earlier this year on the protection of private
data, and it tells us that there is currently no criminal offence
of a data controller intentionally or recklessly disclosing personal
information. Then it goes on to tell us—this is the Justice
Committee—that government departments or agencies cannot
be held criminally responsible for data protection breaches. I
suppose my question is this, and perhaps this is one for you,
Ed: should we bring the criminal law --- Gus is laughing, you
see, here.
Sir Gus O'Donnell: I might be
in jail at the end of this. I am not laughing.
Q73 Mr Prentice: But people take
the loss of all this personal data very seriously. I would not
trust the electronic patient record with medical details of Gordon
Prentice out there, I just would not. My question to you, Ed,
is, should there be punitive criminal penalties for people who
recklessly, wilfully, knowingly, whatever the term is, allow data
to be compromised?
Mr Miliband: On the specific point,
the idea that we are going to criminalise the Civil Service for
the handling of personal data I have to say does not strike me
as a way to achieve the ends that we want, to be completely blunt
and honest with you. We have said at this session that it is important
that it is taken much more seriously than it is, it is important
that we change the culture. It is easy to say let us throw some
civil servants in jail, but, frankly, Gordon, I really do not
think it would achieve very much.
Q74 Mr Prentice: No, I did not say
that for effect, because Gus told us half an hour ago, that data
should be regarded like large sums of money, or something like
that. When someone steals large sums of money or loses large sums
of money there are consequences.
Mr Miliband: To be fair, Paul
Gray, who was running HMRC and was a long-time civil servant and
by many accounts, including my own because I worked with him in
the Treasury, was a very capable civil servant, resigned from
his post as a result of what went wrong. Gus has talked to you
about what happened in the MoD case. He has said something about
what has happened in the other one.
Q75 Mr Prentice: Disciplinary action,
but you have answered my question: you just do not see a role
for criminal penalties?
Mr Miliband: No.
Q76 Paul Flynn: One final question—there
seems to be a division between members of the Committee on this—just
to ask you, if any of you have ever seen a newspaper headline
that said "Nobody harmed by Government data losses",
or a newspaper headline that said, "Government data losses
no worse in the public sector", or one saying, "Huge
advantages in development of hi-tech amongst the Civil Service".
Has anyone seen that, and if you have not, should we see those?
Sir Gus O'Donnell: No, nor have
I seen one which said, "MP's life saved by electronic transfer
of health record", because that is exactly what could happen.
Mr Miliband: I think that is life,
Paul. That is the media we operate in. Associated Newspapers had
a data loss. It was not on the front page of the Daily Mail.
That is the world that we live in. I am just trying to make the
point that I think criminalising civil servants is not going to
achieve anything.
Q77 Chairman: Just following on Gordon's
question, once upon a time, it was the practice for the Public
Accounts Committee to dock the salary of permanent secretaries
on certain occasions, and maybe that is the way forward.
Mr Miliband: I will put it to
Gus's Wednesday morning permanent secretary group.
Sir Gus O'Donnell: Since permanent
secretaries' salaries are currently a third of their market comparator,
it will make life more difficult for me in terms of recruitment
and retention.
Mr Miliband: I think there is
a serious point, that by the changes that Gus has made in relation
to the statement of internal control which is the responsibility
of the Accounting Officer, that will be one of the judgments that
is made about the way a department is being run.
Q78 Kelvin Hopkins: First of all,
apologies for joining the meeting late, but this is a subject
I am very interested in. I am, unlike many of my contemporaries,
a great admirer of bureaucracies. I think bureaucracies are very
important, but there are two types. There are ones which are very
disciplined and very precise and work well and there are sloppy
ones. Is there not a sense in which the Civil Service has moved
from being a disciplined to a sloppy Civil Service, not on your
watch, I may say, but has moved in that direction?
Sir Gus O'Donnell: I really do
not think so. I think this is harking back to a golden age. You
remember in those days that a lot of what the Civil Service were
operating, if we are talking 20 years ago, would have been paper
records. I have no idea what percentage of those paper records
was lost. There were no compulsory reporting requirements for
losses, so I have no idea if it is better or worse now. What I
do know is that we are dealing with vastly more data, much more
complex systems that policies by successive administrations have
required us to implement. We are doing things now that we could
not have done 20 years ago. We are trying to improve services
in the sense of offering people things that we could never have
done before because we simply could not have got the data sharing.
The technology would not have allowed us to do it. For example,
you could not do your car tax when the post office was not open.
You could not have got it renewed if you could not find your MOT
certificate or your insurance certificate. Now, about half of
the people that do it, do it outside normal office hours. That
is a huge improvement for customer service but it is only possible
because of data sharing and big IT systems.
Mr Miliband: There is a point
covered by large organisations. If I knew Max Faber better than
I do I would be able to quote him on this, but the point is that
if you are a three-person organisation, a small business, it is
in a way easier to understand what the rules of data security
are and spread them throughout your organisation than it is in
the vast organisation that is the Civil Service. That is not an
excuse but it is in a way saying that culture change, whether
it is to do with data security or the relationship with the Third
Sector, which is something I have come to this Committee before
and talked about, takes time in large organisations. It is the
hardest thing to do in a way in a large organisation so if there
is a relevance to the fact that the Civil Service is a large bureaucracy
organisation that is the relevance that I see to it.
Kelvin Hopkins: I appreciate that we
live in the electronic age and things are different than they
were 30 years ago, but I have worked in two bureaucracies for
large parts of my life which were very different. One was very
disciplined, lots of rigour, great precision, historic records
going back, everything on tap immediately and with disciplined
staff. Another one was chaos. It was all spontaneous, no systems,
lots of very fine people but it did not work.
Chairman: Which was the Labour Party?
Kelvin Hopkins: Neither of them was the
Labour Party, I may say, but I will tell you later what they were.
I tried in my second employment to suggest some systems and I
was accused of being—"authoritarian", which was
the least of the words, I remember we had a letter from Denis
Healey when he was Chancellor of the Exchequer, and I said, "Where
does this letter go? We have a significant historic letter"—it
was about the European Monetary System; you remember the EMS—"Should
we have a file to record this piece of history? Where does it
go?". I let it rest on the floor and no-one knew where to
put the letter because there was no system. We are all infected
by 1960s anarcho-liberalism these days, but did we not make some
fundamental mistakes and should we not start to re-impose the
kinds of disciplines we used to have, even in the electronic age?
Q79 Chairman: I do not see either
of you as an anarcho-liberalist.
Sir Gus O'Donnell: I think we
have got the systems. Certainly in terms of record management
and the like we try very hard to improve on the systems of the
past rather than just keep them, and I think when people come
to analyse our records, as they do on occasion for things like
Prime Ministerial Memoirs, in general they will say that there
are very good Civil Service systems. We do try and build on those
traditional values. It is quite important within our system, and
I keep on about this, that those traditional values of the Civil
Service, which I hope you will implement in the Civil Service
legislation, are very important to us and it is very important
that we do those traditional things well and keep clear records
and clear records of submissions and in those submissions we lay
things out very clearly. In that sense I am quite traditional
like you. I favour all of that.
| 
