Report on RPA lost data incident fuels claims of cover up
DEFRA is facing renewed accusations of a cover up, after it emerged that Rural Payments Agency (RPA) tapes potentially containing farmers’ personal data have been lost.
A report on the incident published by Defra yesterday afternoon (Wednesday, November 4), revealed that Department officials were first notified about the loss of the tapes on July 23.
The RPA discovered independently in a separate audit in September that the tapes were missing.
Yet Defra Secretary Mr Benn and Farming Minister Jim Fitzpatrick said they were only informed on October 28 last week, after whistleblowers went public on the data loss.
While Mr Benn sought to reassure farmers that ‘there was only a low risk that any usable personal data had been lost’, the revelation sparked accusations of a cover up by Defra and the RPA and raised further questions over the competence of the RPA.
Shadow Defra Secretary Nick Herbert said the failure of officials to inform Ministers or the public ‘looked increasingly like a cover up’.
He also attacked what he described as the ‘deliberate stalling’ by Ministers this week in publishing the report on the incident and in answering a string of questions he had tabled on the incident, including ‘when Mr Fitzpatrick was made aware of the data loss’.
Liberal Democrat Shadow Defra Secretary, Tim Farron said it ‘beggars belief that civil servants took six months to inform farmers affected by this staggering loss’.
NFU president Peter Kendall said farmers would be ‘horrified’ about the incident and ‘extremely worried about the vulnerability of their data and in particular their bank details’.
“We also want to know why this was not reported to the Secretary of State and to the industry as soon as the tapes were known to be missing,” he said.
The loss, initially of 38 RPA back up tapes and one CD, was discovered during routine checks in the spring by IBM, which had used the tapes in a data centre providing IT services to the RPA.
Three tapes and the CD remain unaccounted for, including two tapes potentially containing farmers’ data, such as bank details.
Defra’s report on the data loss said Department officials decided formal reporting was ‘not warranted’ after they were informed because the ‘balance of probability’ was that both missing tapes likely to contain personal data had been destroyed. It was also established that ‘a combination of several low probability events’ would have had to arise for the information to be ‘misused’.
Notifying farmers whose data might have been on the tapes ‘would cause unnecessary alarm and would be disproportionate’, they concluded.
Prior to the publication of the report, Mr Benn said the decision by officials not to inform Ministers was made ‘in accordance with Cabinet Office guidelines’ because the investigation showed the data was ‘in code that cannot be read’.
RPA data – some questions answered
Who knew what when?
An IBM audit between March 19 and May 7 revealed that 39 RPA back tapes and one CD could not be located. It was quickly discovered that 19 had been transferred to an Accenture data centre.
On July 23 Defra officials were informed that 20 tapes and one CD were still missing. “Delays appear to have occurred within Defra in reporting the incident to Dera security,” the report concluded.
The RPA was not informed but the agency discovered during its own routine audit of IBM in September.
More tapes were accounted for in September leaving ultimately three tapes and one CD unaccounted for. It was ascertained that one tape and the CD did not hold protected personal data. The other two tapes were ‘likely’ to.
The Defra and RPA Senior Information Risk Owners were informed on October 7. They agreed on October 7 the incident ‘did not warrant further reporting’.
Defra Secretary Hilary Benn and Farming Minister Jim Fitzpatrick were informed on October 28.
What information did the tapes contain?
Defra’s report into the incident admits two unaccounted for RPA back up tapes ‘potentially contained some sensitive’. But IBM and Accenture have been unable to identify exactly what data was on the missing tapes.
Could farmers’ details get into the wrong hands?
Highly unlikely, according to Defra. Although there is no documentary evidence to prove it, both tapes potentially containing personal data have probably been destroyed. One was defective and ‘suitable for destruction’, Defra’s report said.
It added that the nature of back up tapes is such that ‘specialist equipment, significant detailed knowledge and significant effort’ would be required to access the contents of the tapes.