Ministry of Justice loses four CDs of personal data
The Ministry of Justice has lost four CDs containing personal data.
The government department responsible for UK courts, prisons, probation, criminal law and sentencing would not confirm or deny — due to an "ongoing investigation" — internet reports that the missing data included sensitive information such as the names and addresses of alleged victims of crime and witnesses.
An investigation is being undertaken by HM Inspectorate of Court Administration (HMICA), headed by chief inspector Eddie Bloomfield.
A spokesperson for Bloomfield confirmed that four CDs containing data were lost in the post on 15 December, in transit between the Ministry of Justice and an unnamed recipient. The spokesperson declined to comment where the discs had been sent or whether they were encrypted.
"HMICA confirms that four CD-ROMs are missing," said the HMICA spokesperson in a statement. "[The discs] were sent [by] recorded delivery. Ministers and the information commissioner were notified immediately [when] it was recognised that personal data had been lost. An investigation is underway, so it would be inappropriate to comment further at this stage".
The Information Commissioner's Office (ICO), which is responsible for enforcing data-protection legislation, confirmed that the Ministry of Justice had lost the discs. The ICO said it was waiting for the results of Bloomfield's investigation and indicated that it may take further action.
"We have been informed of the loss of four discs containing personal information which were sent by HMICA," said the ICO statement. "Recent security breaches have reinforced the need for all organisations to take the security and protection of personal information seriously. HMICA is conducting an investigation into this data loss and we have requested a copy of their report. We will be looking for answers to searching questions about the security procedures which HMICA have in place to protect personal information and the safeguards that have been introduced to prevent a reoccurrence of this type of incident. Once we have HMICA's report, we will decide what further action to take."
The Ministry of Justice incident joins a steadily lengthening list of reported government data loss within recent months, including the loss by the MoD of three unencrypted laptops containing sensitive information on over 600,000 actual and potential servicemen, and the loss by HM Revenue & Customs of 25 million details of those claiming and receiving child benefits.
A question mark hangs over which postal carrier handled the discs. A Ministry of Justice spokesperson told ZDNet.co.uk on Wednesday that the discs were sent via Royal Mail recorded delivery. However, Royal Mail cast doubt on its involvement. "We have not been given any indication by the Ministry of Justice that [the data loss] has anything to do with Royal Mail," said a Royal Mail spokesperson.
Royal Mail recorded delivery is treated as standard post, and is not tracked by the Royal Mail.