Loss of UK child benefit data
“I remember the Chancellor of the Exchequer said to me: “Mr Thomas, we’ve lost two unencrypted disks with the entire child benefit database on them – lost in the post. Can I ask you to keep it quiet for two days while we hopefully locate them?” ... Government losses of databases were on the front pages for at least the next six days and in the next couple of years, there were 515 breaches by the Government involving the loss of data. All of that led directly to the 2009 Act which gave us new, stronger powers of investigation and, for the first time, fines were made available to us.”
Richard Thomas, former Information Commissioner, 2002-2009.
In October 2007, HM Revenue and Customs lost two CDs containing the personal information of all UK families claiming child benefit. The government department sent the CDs unregistered in the post. The information included names, addresses, children’s dates of birth, parents’ National Insurance numbers and bank and building society details.
The data loss affected approximately 25 million people, nearly half of the UK’s population at the time. It resulted in the resignation of HMRC’s chairman and saw repeated calls for the Chancellor of the Exchequer to resign.
Public concern at the time over the breach was mocked by Jeremy Clarkson who called the incident a “palaver over nothing”. To prove his point, he published his bank account and sort code details in his column in The Sun, saying people could only use the detail to put money into his account. Someone used his details to set up a £500 direct debit to a charity. In a subsequent Sunday Times column, he wrote: “I was wrong and I have been punished for my mistake”.