Foreword
Jump to
I am laying this report before Parliament under section 10(4) of the Parliamentary Commissioner Act 1967.
Over a period of four months last year I received 449 individual complaints from prisoners and former prisoners about the loss by the Home Office of sensitive personal data about them on an unencrypted data stick. Over 240 Members of Parliament have referred those complaints to me, and this report explains why I have decided not to investigate them.
In August 2008, a contractor working for the Home Office lost the data stick containing personal data of at least 84,000 prisoners, including names, addresses and some offence codes. The complainants have expressed their shock and anxiety about the data loss and said that this was compounded by a lack of helpful information provided by the authorities. They have asked for a compensation payment for the fear, inconvenience and risk to their own and their families’ safety that they say has occurred.
In this report I explain my approach to assessing complaints and deciding whether I could and should investigate them. One aspect of my approach is to assess whether there is some evidence of maladministration. I have seen clear indications of maladministration surrounding the circumstances leading to the loss of the data by the Home Office. However, I have not seen any indication of maladministration in the way the Home Office responded to the data loss.
If I see indications of maladministration, I assess whether there is unremedied injustice as a consequence of that. Much of the information that was on the data stick is already in the public domain. It seemed to me, therefore, that complainants could not reasonably claim to be worried about its contents being made public and I find it difficult to see any merit in a compensation claim for additional anxiety resulting from the loss. Moreover, the Permanent Secretary of the Home Office has asked me to pass on his apologies for this loss of data and for any loss of public confidence in the security of Home Office systems that contain personal data. The contractor has publicly apologised. Overall, therefore, I am not persuaded that there is unremedied injustice as a consequence of the loss of the data stick.
My report highlights the need for public bodies to consider proactive and timely communication with individuals if their data has been lost, particularly in advance of likely media reporting. In the case considered here, the Home Office decided not to contact the majority of those affected in advance, but to let them learn about the loss through press reporting. It is clear that those who complained to me do not feel that they received sufficient information or reassurance. A different, more proactive, approach might have avoided these complaints coming to my Office.
I know that part of the reason the complainants are concerned about the data loss is because they do not feel that they have been fully briefed on the information contained on the data stick. However, the Home Office have set up arrangements to ensure that any individual who considers that his or her data may have been lost as a consequence of the loss of the data stick will receive a written response from the Home Office setting out the data fields in which the individual may have been included. The solicitors representing the vast majority of the complainants were given information in April last year and the information I provide in this report should go some way to ease the complainants’ outstanding concerns. As I have said, I have not seen any indication of maladministration in the way the Home Office responded to the data loss.
This incident of data loss has already received significant public attention, both at the time of the loss and in the months since. Many MPs have been involved in referring complaints to me. While it is unusual for me to lay a report before Parliament outlining my decision not to investigate complaints, I hope that this report will provide a detailed response to those MPs who have represented the complainants, and place on the record my reasons for not investigating on this occasion.
Ann Abraham
Parliamentary and Health Service Ombudsman
March 2010
