Kramer vs. Kelly over DVLA

5.41.00pm GMT Tue 18th Dec 2007

• [Dec 17] Susan Kramer (Richmond Park, Liberal Democrat): I thank the Secretary of State for giving me half an hour's advance sight of her statement. The DVLA has form on mishandling data.

In June 2006, it was caught selling data to private companies without adequate scrutiny, and in December this year, not only were confidential details sent to the wrong car owners as part of a survey, but the addresses, names and car particulars of nearly 8,000 owners from Northern Ireland were lost in the post on two uncoded discs.

We now hear the mind-bending news that the records of 3 million candidates for the driving test are missing on a hard drive from what is interestingly called a "secure facility" belonging to a company in Iowa. If that happened last May, why was the Secretary of State-never mind this House-not informed? Is it not outrageous that the victims have not been informed? I challenge the idea that this is not substantial-an e-mail address was included among the information. One can only imagine the e-mails to people saying, "Excuse me, but your payment for your driving test did not clear, so could you please resend the details?" Will the Secretary of State confirm that the information was sufficient for fraudsters to use to create false identities? Does she know, or has anyone checked, whether any of the data have been used fraudulently? What information has been passed to the people involved so that they can put in place some kind of protection?

The Secretary of State said that the information was outsourced in the spirit that it should be taken care of, but surely much more than that is involved. The message is clear: the culture must change. She has been saying that electronic data transfer will provide adequate protection, but even the Pentagon has been hacked, so surely that would just change the method by which data are either lost or stolen. Does she not agree that the Government should be minimising data holding and that rapid destruction of data should become part of their culture?

While she is at it, will the Secretary of State be kind enough to tell me when she will answer the questions on data handling that I asked her Department on 27 November? Perhaps those questions were the reason why she got the information about Pearson on 28 November. Because I have received no answer, I would be interested to know what other information has gone missing that would be exposed by those questions.

The magnitude of the loss that the Secretary of State announced will not be obscured by the measures that she mentioned, worthy though they might be, or those that the Chancellor announced a few moments ago. If my bank behaved like this, I would change it. Is not that an important message for the Government?

• Ruth Kelly (Secretary of State, Department for Transport): I draw the hon. Lady's attention, yet again, to the facts of the case. She talked about her bank, but there were no bank details involved in this instance. The data lost were the names of individuals, their addresses, their telephone numbers and, where provided, their e-mail addresses. I take every instance of data loss seriously, which is why I asked the Information Commissioner to review the entirety of this case, how it had been handled, what security measures had been put in place and to assess the risk to the public. He made it clear that he did not think that the facts as he knew them meant that the loss represented a substantial risk to a significant number of people. I apologise to those who have concerns as a result of the loss, which is why I thought it also appropriate that the Driving Standards Agency develop an advice line, to which people can turn if they are worried about the data loss and, indeed, to ensure that direct.gov.uk, the website, had information for those people.

The important point is whether we have put the matter right and whether we are learning the right lessons for handling data both in the Department for Transport and its agencies, and across Government, so that we can share information appropriately and ensure that it is adequately protected. The hon. Lady suggests that we should minimise the handling of personal information and not have large databases of personal information, but if people are asked whether they want to sort out their MOT or their tax affairs online, they probably would do so. Data handling is becoming more complex by the year, and indeed by the month. The important point is achieving the correct balance between the need for personal privacy and the desire and expectation on the part of the public that we provide a top-quality service.

The hon. Lady also mentioned specific cases that have come to attention in the last couple of weeks. It is true that there was an incident concerning the DVLA and the details of just over 1,000 individuals, which was due to a manual error. Procedures have been put in place that will minimise the risk of that occurring again. It is also the case that the Northern Ireland Driver and Vehicle Agency sent information by post that was subsequently mislaid by Parcelforce. I have asked my officials to examine whether plans to merge the two databases in Northern Ireland and Swansea could be accelerated in the light of the recent incident. The important point is that Ministers and the Government learn the lessons and ensure that people are appropriately protected in future.