Page last updated at 12:02 GMT, Friday, 22 August 2008 13:02 UK

Firm 'broke rules' over data loss

Jacqui Smith says she is extremely concerned

Home Secretary Jacqui Smith has blamed a private contractor for losing the details of thousands of criminals, held on a computer memory stick.

Ms Smith said the government had held the data securely but PA Consulting appeared to have downloaded it, contrary to the rules of its contract.

She told the BBC it was "completely unsatisfactory" and an inquiry was under way. The firm had no comment.

The Tories have accused ministers of a "massive failure of duty".

Speaking from her constituency, Ms Smith said she was "concerned and disappointed" that the memory stick had apparently been "mislaid"

Risk assessment

"This was data that was being held in a secure form, but was downloaded onto a memory stick by an external contractor," she said.

"It runs against the rules set down both for the holding of government data and set down by the external contractor and certainly set down in the contract that we had with the external contractor."

Nov 2007: 25m people's child benefit details, held on two discs
Dec 2007: 7,685 Northern Ireland drivers' details
Dec 2007: 3m learner drivers' details lost in US
Jan 2008: 600,000 people's details lost on Navy officer's stolen laptop
June 2008: Six laptops holding 20,000 patients' details stolen from hospital
July 2008: MoD reveals 658 laptops stolen in four years

A risk assessment was being carried out about the data that was missing, alongside the internal inquiry into what had happened, she said.

And no more information was being passed to the firm while the investigation continued and the government was "reviewing the terms of that contract and other contracts" with PA Consulting.

The memory stick contained un-encrypted details about 10,000 prolific offenders as well as names, dates of births and some release date of all 84,000 prisoners in England and Wales - and 33,000 records from the police national computer.


The Conservatives say the Home Office appears "incapable" of keeping data secure and warn criminals may seek compensation.

PA Consulting has searched its premises and looked at CCTV recordings in an attempt to recover the missing memory stick - a commonly used portable storage device for computer files.

The company was handed data as part of a research project on tracking offenders through the criminal justice system.

Also called USB sticks or flash drives
Have almost completely replaced computer disks
Used to carry and transfer data easily
Data stored on tiny chip instead of magnetic disk as with hard drives
Holds up to 32 gigabytes of data, equivalent to 32,000 large books
A 1 stick could hold more than 10 pages of data on each prisoner

Government departments were ordered to tighten up their security procedures after the loss of two discs containing personal details of every child benefit claimant in November.

But shadow home secretary Dominic Grieve said the latest data loss showed the Home Office was "entirely incapable of keeping it secure".

And he said there was a serious risk that if criminals' details were found by a third party, they could sue the government for compensation.

"It is ultimately the Home Office's responsibility to maintain the security of this material," he added.

Adequate safeguards

PA Consulting is one of the companies that has been involved in developing the government's controversial ID card scheme - opposed by the Conservatives and Liberal Democrats.

Lib Dem leader Nick Clegg said: "The government will no doubt seek to blame private contractors, but the rash of data losses over the last two years confirm that there is something much more worrying at stake: this government cannot keep any information safe."


David Smith, Deputy Commissioner in the Information Commissioner's Office, said the latest loss showed that personal information could be a "toxic liability" if not handled properly.

"It is deeply worrying that after a number of major data losses and the publication of two government reports on high profile breaches of the Data Protection Act, more personal information has been reported lost," he said.

Labour MP and chairman of the home affairs select committee Keith Vaz told BBC Radio 4's Today programme he hoped the government had put adequate safeguards in place.

"If you hand out memory sticks almost like confetti to companies and ask them to do research for you, then you have to be absolutely certain... that the company concerned has put in practice procedures which will be just as robust as the procedures that I hope the government has followed," he said.

A spokesman for PA Consulting refused to comment.

Earlier this month the BBC apologised after a memory stick containing the personal details of hundreds of children who had applied to take part in a TV show was stolen from a vehicle.

On Tuesday, a BBC analysis found sensitive data potentially affecting more than four million people had been lost by government departments in the year to April.

When financial data goes missing
22 Aug 08 |  Business
Extent of data losses is revealed
19 Aug 08 |  UK Politics
Discs loss 'entirely avoidable'
25 Jun 08 |  UK Politics
Tougher data rules for Whitehall
25 Jun 08 |  UK Politics

The BBC is not responsible for the content of external internet sites

Has China's housing bubble burst?
How the world's oldest clove tree defied an empire
Why Royal Ballet principal Sergei Polunin quit


Americas Africa Europe Middle East South Asia Asia Pacific