Electoral Commission: Data Breaches

Baroness Ritchie of Downpatrick Excerpts

Monday 4th September 2023 Lords Chamber

[Baroness Neville-Rolfe (Con)]

I described the new, more resilient system that we have got. There is a big focus on cyber and cyberattacks; individual Government Ministers take that very seriously. We have set up a new system called GovAssure, which the Deputy Prime Minister announced in the spring, to make sure that different parts of the public sector are better prepared and able to deal with these points. The National Cyber Security Centre has been much strengthened—actually, it also does a very good job for outside organisations, as I remember from when I was involved in an NGO and on the Back Benches. We are making progress with these things. It is important that we use electronic data, as has already been said by several noble Lords. The key is to make people take the necessary steps—often personal steps—to ensure that systems are not opened up to hackers, attackers and hostile states.

[Baroness Ritchie of Downpatrick (Lab)]

My Lords, we all know that this incident happened in August 2021. It was brought to the attention of the Electoral Commission in October 2022, which made it public in August of this year. As a follow-on to my noble friend Lady Smith of Basildon’s question, could the Minister indicate why political parties and the public were not informed of this data breach that would impact all the public throughout the UK? Why did that not happen? In Northern Ireland, we have had the PSNI data breach, which impacts all the workforce, both service personnel and civilian staff. Maybe whenever she talks to the Cabinet Office, she could impress on it the need to ensure that political policing is ended.

[Baroness Neville-Rolfe (Con)]

That is a point well made. In a sense, the noble Baroness’s question is about why this took so long, especially in relation to the Electoral Commission. The Electoral Commission made a statement on this—it is, as I had to emphasise right at the beginning, independent and accountable to Parliament through the Speaker’s Committee—in which it said that it needed to take several steps to remove the hackers and that it was necessary to do that before making a statement. It also said that it was determined to protect against future hacking and that by making a public statement that would have been more difficult. However, the noble Baroness’s point is well made; being transparent with the public is an ambition that we all share—subject, of course, to security needs.