Patrick Wintour
The Guardian
The government needs to review the scale of its plans for identity cards in the wake of the release of 25 million names and addresses on government child benefit records, the information commissioner, Richard Thomas, told the justice select committee yesterday.He claimed the government remained confused about the role of identity cards, and accused ministers of putting too much faith in the value of information sharing.
Thomas said: “Any massive collection of information like the identity card carries risk … We still have some uncertainties about what the primary purpose of the identity card is … Is it to improve policing, to fight terrorism, to improve public services, to avoid identity theft? I think there is a lot of thinking still to be done on its primary purpose.”
He added: “Keeping this massive database with records of every time the card is swiped through a terminal is distinctly unattractive and would increase the risks.”
He also questioned whether information on ID cards needed to be kept indefinitely. He disclosed that a stream of organisations in the public and private sectors had come to his office “on a confessional basis” in recent weeks to reveal that they had problems with losing data.
He added that Revenue and Customs’ loss of data “has been a massive wake-up call to the top of organisations”. Chief executives and permanent secretaries were now at long last asking if the proper procedures were in place.
He disclosed he had put in a request for a substantial increase in his £10m annual budget, as well as new criminal sanctions against a data controller who knowingly or recklessly loses data .
None of the £10m comes from government, but from fees for inspections.
Commenting on the HMRC fiasco, he said: “Searching questions need to be answered about systems procedures and human error. I would question whether anybody should be allowed to download an entire database of this scale without going through the most rigorous pre-authorisation checks. One would want to question why software was not in place to be prevent the entire database being downloaded.”
Thomas, who is responsible for data protection as well as freedom of information, reiterated his call for powers to allow the Information Commission to make spot checks so it could go into private companies, as well as government departments, to inspect data security arrangements without permission.
The prime minister is reluctant to give the commissioner powers to enter private companies without permission.
“We have been dissatisfied for some time that we only have limited powers of scrutiny,” said Thomas. “I find that a very bizarre situation, which is unlike virtually all the other data protection authorities around the world and most other regulatory bodies, such as the Financial Services Authority”.