Systemic failure blamed for HMRC data loss

A report by the Independent Police Complaints Commission states that systemic failure was behind the loss of 25 million child-benefit details by HM Revenue & Customs.

At the time that the data loss was reported in November, the chancellor of the exchequer, Alistair Darling, blamed a junior official for the breach. However, a statement published on Wednesday by the Independent Police Complaints Commission (IPCC) concerning the data loss found that the processes for handling data at the HMRC offices in Washington were "woefully inadequate", and that individual members of staff were not to blame.

"There was a complete lack of any meaningful systems, a lack of understanding of the importance of data handling, and a 'muddle-through' ethos [at HMRC]," stated the IPCC.

The IPCC particularly criticised how inadequately secured child-benefit claimant data had been sent to the National Audit Office (NAO) a number of times.

In December 2006, to check the levels of accuracy of child-benefit data, the NAO requested relevant data of claimants from HMRC. The NAO specifically requested that personal data, including names, addresses and bank account details, be stripped out.

To cut costs, HMRC gave the NAO all of the data, without stripping out those personal details. The details were sent on unencrypted discs. Those discs were returned in April 2007.

However, a repeat audit was undertaken in September 2007. As before, unencrypted discs were sent via courier. The package was not tracked or sent by recorded delivery. This time the CDs did not arrive, and so copies were made and sent again in exactly the same way (successfully, on this occasion).

A second report on the HMRC data loss was published on Wednesday by PricewaterhouseCoopers (PwC) chair Kieron Poynter. The Poynter Review also blamed systemic failure for the loss of the HMRC details.

"The loss was entirely avoidable and the fact that it could happen points to serious institutional deficiencies at HMRC," wrote Poynter. "The two major institutional deficiencies from which many of the more detailed issues flow were: information security simply wasn't a management priority as it should have been; and HMRC had an organisational design which was unnecessarily complex and, crucially, did not clearly focus on management accountability."

Acting head of HMRC Dave Hartnett said in a letter to the Treasury on Wednesday that, while no evidence had been found of criminal behaviour related to this case, the incident remained "avoidable".

"While the IPCC found no evidence whatsoever of misconduct or criminality by any member of HMRC, the two reports make clear that the data loss was avoidable and a result of serious failings within HMRC," wrote Hartnett. "In short, it should never have happened."

In a speech to Parliament on Wednesday, Darling said that it was clear that the incident had been "entirely avoidable".