Timeline: Child benefits records loss

A junior official at HM Revenue and Customs gives the National Audit Office a full copy of HMRC's child benefit data, in breach of security procedures. That information is later safely returned.

Records of about 15,000 people's details go missing after being sent by HMRC to Standard Life. Also in September, a laptop containing around 400 ISA (individual savings accounts) customers' details is stolen.

Child benefit data is again sent to the NAO by a junior official, using the courier company TNT, which operates the HMRC's post system. The package containing two CDs, containing details of 25 million individuals, is not recorded or registered and fails to arrive.

The NAO tells HMRC it has not received the package. An HMRC spokeswoman said the official believed it may have been delayed by the postal strikes or in the NAO's office move and did not report it. A second copy is sent, again in breach of procedures, but this time it is sent by registered post and arrives safely.

Senior HMRC management are informed that the 18 October package is missing.

Alistair Darling is informed and tells Prime Minister Gordon Brown. Mr Darling orders an immediate investigation and searches of all premises where the package might be, as well as action to ensure it does not happen again.

Mr Darling is told by HMRC that evidence has been found which might help to find the missing package.

The chancellor decides the HMRC searches have failed and tells HMRC chairman Paul Gray to call in the Metropolitan Police.

The chancellor goes to Information Commissioner Richard Thomas, who agrees that remedial action must be taken before a public statement is made.

Mr Gray tells Mr Darling he feels he should resign. The chancellor seeks the advice of the Financial Services Authority and Serious Organised Crime Agency, while banks are alerted by HMRC.

Mr Gray resigns following an announcement that Mr Darling is to make a statement to the House of Commons. The chancellor outlines what has happened and announces an investigation of HMRC's security procedures by PricewaterhouseCoopers chairman Kieran Poynter, alongside the Independent Police Complaints Commission, which monitors the HMRC.

Prime Minister Gordon Brown apologises for the "inconvenience and worries" caused and orders security checks on all government departments. The Conservatives produce e-mails they say show senior HMRC officials approved the downloading of the entire Child Benefit register - including bank details - on to discs to save cash.

HMRC writes to seven million families to reassure them that the missing data is "likely to still be on government property". The government denies the personal data was put on to discs at the request of senior officials.

Lib Dem acting leader Vincent Cable says the two missing computer discs could be worth up to �1.5bn to criminals. He says he understands that on the black market one identity was worth "something in the order of �60". Ministers say there is no evidence they have been intercepted by criminals.

Paul Gray, who quit as HM Revenue and Customs boss over lost data discs, is back working for the government. Channel 4 News reports that he has begun a short-term Cabinet Office post and is still paid more than �200,000.

Several firms admit security failings in the wake of HMRC's loss, MPs are told. Information Commissioner Richard Thomas tells the Commons justice committee that public and private sector bodies have come forward "on a confessional basis". He says they are not on the scale of the HM Revenue and Customs mistake, but more would "come out in the wash".

Transport Secretary Ruth Kelly is set to give details to MPs later about the loss of personal details held by the Driver and Vehicle Licensing Agency. Her statement will come straight after one from Chancellor Alistair Darling on an interim report into the HMRC's lost discs. The head of HMRC, and its data security chief, are also to be probed by MPs.

The loss of the discs was "entirely avoidable," a report by management consultant Kieran Poynter concludes. It blames serious flaws in the management structure at HMRC, poor communication and low morale. Chancellor Alistair Darling accepts its findings and promises reform. He says the discs have still not been found. A separate report, by the Independent Police Complaints Commission, highlights "woefully inadequate" processes and a "muddle-through" culture at HMRC in which staff were not properly trained in data security.

E-mail this to a friend

Printable version