Government breached personal data security 9,000 times in year, watchdog reveals


Personal data security was breached nearly 9,000 times by the Government in a year, the National Audit Office (NAO) has found.

The watchdog revealed the 17 largest departments recorded 8,995 data breaches in 2014/15 - but that only 14 were reported to the Information Commissioner (ICO).

Whitehall departments can decide which personal data breaches to report to the ICO, in line with the requirements of the Data Protection Act.

But the NAO said it was impossible to determine how serious the thousands of incidents not disclosed to the commissioner were.

Its report said: "The lack of detail in the self-reporting data means it is not possible to determine how significant any of the 8,981 incidents (not reported to the ICO) were.

"The data reflect public reporting as signed off by accounting officers and highlight major variations in incident reporting processes across departments."

HM Revenue and Customs, Britain's tax authority, recoded the most breaches with 6,041, three of which were reported to the ICO.

Almost all of those not reported were "minor" breaches that "potentially had an impact on customers but were not managed centrally by the department".

Along with the Ministry of Justice, with 2,801 breaches, three of which were reported to the ICO, HMRC made up the majority revealed in the report.

But "chaotic" mechanisms for recording breaches makes departmental comparisons "meaningless", the NAO said.

Sir Amyas Morse, head of the National Audit Office, said: "Protecting information while re-designing public services and introducing the technology necessary to support them is an increasingly complex challenge.

"To achieve this, the Cabinet Office, departments and the wider public sector need a new approach, in which the centre of government provides clear principles and guidance and departments increase their capacity to make informed decisions about the risks involved."