It always seems that government agencies don't prioritize citizen data privacy - here we have the big case where the UK (Britain) tax office LOST two CD discs with privacy data on 7-million UK citizens by sending them in internal email without any receipts or controls.
It also turns out that the intended recipient, the National Audit Office, had specifically requested a version of the data that was "de-sensitized" where private bank data and other data would be removed. The tax agency didn't want to pay the extra processing fee by the outsourced data managers (EDS - the firm founded by Ross Perot - remember them?), thus they sent all the data without removing the sensitive data.
Now, as political investigations start up, there is an accusation that high level tax agency managers approved the uncontrolled process, and it was not just a mistake by a junior level employee (whose name has not been released yet.
Finally, my experience is that if they could put the data on a CD, then many intermediate level professionals could have opened the database, filtered out the sensitive data, and THEN sent the CD out. Which brings up another issue - many government employees do NOT teach themselves how to use computers, data, etc. but only do so if they are given a class, or they rely on separate IT departments or outsourcers (like EDS). In contrast, businesses will not hire or promote employees who do not understand how to use computer software, data and implement security controls. Even in the 1980's, it was not uncommon for most business professionals to spend individual time to learn how to work with spreadsheets and databases and be able to manipulate data in them.
vj
===================================================
from http://news.independent.co.uk/uk/politics/article3182302.ece
Nov. 22, 2007
The Inquiry: Senior officials are blamed for loss of discs
By Cahal Milmo and Colin Brown
Published: 22 November 2007
The head of the (UK) National Audit Office, Sir John Bourn, locked horns with Her Majesty's Revenue and Customs and the Chancellor last night when he said the decision to post two computer discs containing the bank details of 7 million families was taken by senior HMRC officials and not, as Alistair Darling claimed, by a junior employee.
A public row broke out between the HMRC and the NAO over who was to blame for the blunder after Sir John launched a scathing attack on the former, saying high-ranking civil servants at the HMRC ordered the data – which the NAO had not requested – to be sent to his department. His comments contradicted Mr Darling's explanation to MPs on Tuesday.
The entire child benefit database was sent via internal mail by a junior official from HMRC in Washington, Tyne and Wear, to the NAO in London via courier TNT on 18 October.
Mr Darling said the civil servant broke the rules by downloading the data to computer disc and sending it by unrecorded delivery.
Edward Leigh, the Tory chairman of the Commons public accounts committee, said the NAO had asked only for basic details about child benefit recipients, without information on personal bank accounts, but was told by "high level" at the HMRC that it would be "too burdensome" to separate this data. He said he had been given a copy of a briefing note written by Sir John for the Chancellor, which suggested that senior HMRC officials authorised the release of the sensitive information.
The note says that the NAO requested data on child benefit claimants in a "desensitised" form, with bank accounts and other personal data removed, in March but an email from a senior business manager at HMRC stated that the data would not be desensitised.
Mr Leigh said the reason given for turning down the NAO's request was that desensitising information would require an extra payment to the HMRC data services provider EDS.
The disclosures will add weight to Tory claims that systemic failures at HMRC led to the worst loss of data in British history and cast doubts on the assurances by both Mr Darling and the Prime Minister that government bodies can be trusted to keep records safe.
It also raises suspicions that an office junior at the HMRC is being made a scapegoat for failures by more senior managers. That worker, who remains unnamed, was in hiding last night as the police search for the missing discs continued and the HMRC confirmed he was facing the sack. The man, who is understood to work in the IT department of the Child Benefit Agency, has been put up in a hotel with a minder to protect his identity as the clamour for his name to be published intensifies.
A spokeswoman for HMRC said: "His future is part of the investigation that is taking place. When that is completed disciplinary proceedings will follow. One of the outcomes of those proceedings is dismissal."
Senior civil servants are concerned that there should be no repeat of the public scrutiny and humiliation faced by Dr David Kelly, the government scientist who took his own life after he was exposed as a BBC journalist's source in the row over the "dodgy dossier" produced in the run-up to the Iraq war.
Mr Leigh's committee is launching an investigation into the lax data handling systems at the HMRC. It will summon Paul Gray, the department's former chairman who quit over the scandal on Tuesday, to answer MPs' questions.
Scotland Yard said officers from its specialist economic crime unit were helping to co-ordinate the investigation on Tyneside.A spokesman said: "Our inquiries will continue for the rest of the week."
It emerged yesterday that an almost identical breach rules governing the transfer of sensitive data took place in March. The NAO received discs from the Child Benefit Agency containing its full set of data on three occasions – yet none of its officials queried the decision to send out the data in an unfiltered form.
