A hard drive containing the personal details of 5,000 prison staff has been lost after being sent to IT contractor EDS, it has been revealed.
The hard drive was lost in July 2007, but the prison service was not informed until 12 months later when EDS sent a letter to the Ministry of Justice explaining the situation. Data lost included prison staff names, dates of birth, National Insurance numbers and employee numbers.
The news broke yesterday when The News of the World reported that it had obtained the EDS letter, and sent a copy to justice secretary Jack Straw.
"I am extremely concerned about this missing data. I was informed of its loss yesterday lunchtime (Saturday) and have ordered an urgent inquiry into the circumstances and the implications of the data loss and the level of risk involved," said Straw.
IT security specialist Workshare said the incident highlighted the need to enforce strict rules on public bodies to minimise data loss, and suggested the government review its policies for passing on personal details to third parties.
"This latest data blunder yet again highlights the risks associated with contractors handling sensitive data and demonstrates how vulnerable information becomes once it is handed over to third parties," said Matt Brown, VP Product, Workshare. "Questions must be asked as to why this incident happened and more importantly why the government was only informed about it months after the computer hard disk was lost.
"Ministers can talk about protecting data all they like but unless words are followed up by action how can the government honestly say it is doing everything it can to keep data safe?"
The loss will bolster the support for Information Commissioner Richard Thomas' calls that the government needs to strengthen data sharing rules, and that his office needs more effective powers to enforce data protection.
Thomas recently served enforcement notices on HMRC and the MoD for their data losses, insisting they report regularly on their data handling.
With additional reporting from Leo King, Computerworld UK