Data breaches systemic in public sector

Report finds that government cases of data loss are symptomatic of ineffectual policies

Recent government lapses in data protection are not unfortunate one-offs, but “symptomatic” of the government’s failure to implement proper safeguards, a report has concluded.

The report from the select committee on human rights said the data protection lapses could contravene the Human Rights Act and recommended that the government foster “a culture of respect for personal data within the public sector”.

“Human rights are far from being a mainstream consideration in government departments,” the report said.

The committee said it had repeatedly expressed concerns ­ mostly rejected by the government ­ about the adequacy of safeguards on the sharing of personal information in specific bills.

Reviews of the legislative framework are now under way.

The committee’s recommendations include expanding the role of the justice minister after it emerged that the minister, who has responsibility for data protection, had no foreknowledge of the loss of child benefit data that affected 25 million people.

Brian Spector, general manager for content protection group Workshare, said: “Today’s report must act as a wake-up call to a government which continues to disrespect the importance of protecting personal data. Unless the public sector can clearly demonstrate it takes data protection seriously, incidents such as the HMRC data breach will remain fresh in the public’s mind.”

However, not all experts are convinced that the problem is about a lack of safeguards. They point instead to weak enforcement.

Craig Whitney of Tumbleweed Communications said: “The problem is the ability to implement, monitor and enforce guidelines. It’s like an alligator without teeth. As a result they haven’t yet placed a high enough value on digital assets.”

The damning report may further dent confidence in the government attempts to introduce ID cards.

Spector added: “Government plans to collect data for the national identity register scheme will continue to face considerable opposition unless data sharing and protection policies are put in place.”