Alistair Thomas

Worcs, UK

Concerned citizen

Every government agency that keeps sensitive data should have a robust policy in place to keep it safe. If breaches occur then if the policy is found wanting (or completely lacking) then the most senior people should be held accountable. Fines, demotion, loss of job, restricted from working with sensitive data for a time (dependent on the level of complacency / incompetence involved).

If policy is robust but procedures to implement it are lacking or not practiced then accountability lower down the chain of command has to be enforced. Until data protection is taken seriously with serious consequences for its mismanagement then we can expect leaks on an ongoing basis.

There seems to be no joined up thinking. One agency gets caught out, hopefully sorts it self out (Public review at HMRC to ensure lessons learnt / roadmap & timescale for data to be secure?), then we just wait for the next agency to screw up and realise that data security applies to them too.

Every agency with data should do a review. If the data in this case was paper based in a cabinet, PA would not have been allowed to copy it and remove it. If data is not 100% secure then it should only be viewed in a secure location with access properly authorised for limited use according to need. Data should only be released when roaming is 100% secure. Provate companies that are granted access should be as accountable as civil servants with severe penalties for failures.