MPs warn on data protection

MPs have expressed serious concerns that there are more cases involving the loss of personal data by the government which have yet to come to light.

The Commons justice committee said the loss of the entire child benefit database - containing the personal details of 25 million people -  had created "major risks" for identity fraud.

In a report published on Thursday, it warned that sending 7.25 million apology letters to the wrong addresses posed a "grave risk" for identity theft.

"We are gravely concerned that this incident is not an isolated example - except, perhaps, in terms of the scale of its impact, both because of the number of people involved and the sensitivity of the data," the report said.

"We are extremely concerned to hear from the information commissioner that there are more cases involving the loss of personal data which have not yet fully come to light."

The commissioner, Richard Thomas, told the committee there was "no doubt that everybody concerned recognises the seriousness of [the] situation".

"It is unprecedented, in our experience," he said. "From what I know so far, [it is] a really shocking example of loss of security; the scale of it, I think, is well beyond anything we had considered before."

The MPs acknowledged that the use of personal data "is increasingly a feature of modern government", but said it must only be held where there are proper safeguards in place.

And the report warned of a "widespread problem within government" relating to data protection systems.

It called for the information commissioner to be given strengthened enforcement powers, and said that there should be new requirements making it compulsory for companies to report any data loss.

It also recommended that legislation be introduced to make significant security breaches a criminal offence.

Committee chairman Alan Beith said: "The scale of the data loss by government bodies and contractors is truly shocking but the evidence we have had points to further hidden problems.

"It is frankly incredible, for example, that the measures HMRC has put in place (as described in the chancellor's statement of December 17) were not already standard procedure."

A Ministry of Justice spokesman said a review of data protection laws had been commissioned in October, before the loss of the child benefit discs.

"Parliament is currently considering proposals to amend section 60 of the Data Protection Act through the Criminal Justice and Immigration Bill," she said.

"This will provide a custodial sanction as well as the existing fines for those found guilty of unlawfully obtaining or disclosing personal data."