Intellectual Property Law

Continuing Data Loss Debacle Creates UK Government IT Circus

By IBLS Editor

In a seeming unending series of lost data blunders creating the distinct impression of British Government technological incompetence, analysts are now debating methods to stop the private information hemorrhage. In late 2007, Her Majesty's Revenue and Customs admitted to losing the private ID and financial details of 25 million individuals.  Another information loss was revealed soon after, coming in December that the Government did not alert the public when three million files were misplaced by Britain's Driving Standards Agency, angering the public and suggesting a cover-up may have been afoot. This news comes on the heels of other significant data disasters, such as the recent disappearance of pensioner information and the cyber-attack upon the Land Registry that ended in millions of pounds of thefts and lost properties, just to mention the most recent private data exposure scandals. Labor's Chancellor of the Exchequer Alistair Darling has been ridiculed as incompetent while the Government has been accused of reckless disregard and refusing to properly protect the private information of its citizens.

In the driver's information debacle, Transport Secretary Ruth Kelly explained a disk with names, addresses, phone numbers and email addresses disappeared from the American company being used to run the "theory section" of UK driving tests. It turns out the data was lost six months before its disappearance was finally revealed. Ms Kelly told the Parliament there was "no substantial risk to individuals" since bank or credit card details, dates of birth, driving license numbers or national insurance numbers were not included with the lost information. The information had been emailed to the States, was put on a hard-drive in a computer and subsequently lost.

Ms. Kelly's admission came the same day Chancellor Alistair Darling announced that the two computer disks lost by HM Customs and Revenue containing information on 25 million child beneficiaries was still missing. The discs contained the details of every person in the U.K. who claims and receives child benefits, went missing in the mail during a National Audit Office investigation in October. The information was sent by a junior official in HMRC as unencrypted discs to the NAO, but HMRC was not notified till November 8 that the discs never arrived for auditing. Darling was informed of the loss on November 10, three weeks later. Darling stated in a speech that little progress had been made recovering the discs, despite an offer for a £20,000 reward for their return. Most troubling was a report claiming basic rules and laws for the care of private data were not followed.

What can be done to avoid future data losses of private citizens? Chancellor Darling has announced new security measures to guard against repeated data disasters. These include a reiteration and renewed enforcement of rules already established: a ban on bulk data transfers and on careless downloads of data, without safeguards. Added is a HMRC rule that would disable user laptops to completely remove the risk of accidental loss or theft of removable media.  Darling has asked for "simpler organisational structure with clearer accountability" for such protocols, and an increased transparency at the HMRC. In the wake of these highly embarrassing mistakes, Prime Minister Gordon has decided to create new punishments under the Data Protection Act for serious breaches to ensure better methods and habits.

Yet, this response has not satisfied critics. For example, Jamie Cowper, director of marketing at the data protection company PGP Corporation said, "the real key to effective data protection is the managed enforcement and automation of security policies, because it's unrealistic to expect civil servants to safeguard data simply on their own initiative."

Another area of dispute is the Government's "transformational agenda," and associated efforts to remove sharing barriers between government departments. In response, the Foundation for Information Policy Research (FIPR), claims that Government is being willfully careless in data care, stating "their refusal to abandon the headlong rush towards Transformational Government?the enormous centralised database being built to regulate every walk of life?is not just pig-headed but profoundly mistaken." The FIPR is alarmed at the Government "putting all of the eggs into the one basket," making it easier than ever for data to be compromised from a central location.

Full post as published by IBLS Internet Law Blog on December 19, 2007 (boomark / email).