Electoral Commission: Data Breaches

Baroness Ludford Excerpts

Monday 4th September 2023 Lords Chamber

[Baroness Neville-Rolfe (Con)]

That is a point well made. In a sense, the noble Baroness’s question is about why this took so long, especially in relation to the Electoral Commission. The Electoral Commission made a statement on this—it is, as I had to emphasise right at the beginning, independent and accountable to Parliament through the Speaker’s Committee—in which it said that it needed to take several steps to remove the hackers and that it was necessary to do that before making a statement. It also said that it was determined to protect against future hacking and that by making a public statement that would have been more difficult. However, the noble Baroness’s point is well made; being transparent with the public is an ambition that we all share—subject, of course, to security needs.

[Baroness Ludford (LD)]

My Lords, may I follow that up with the Minister? Is she certain that the data breach notification requirements under data protection law were followed? As I understand it, the Electoral Commission said that it knew about this in October 2022, and yet the Information Commissioner’s Office appears to have been told only a month ago, and there are requirements—certainly there are under GDPR—for the public to be told, normally within 72 hours. What have the Government ascertained about whether these requirements were followed?

[Baroness Neville-Rolfe (Con)]

I thank the noble Baroness for her point. I will write to her, if I may.