Home Office: Data Breaches

Baroness Williams of Trafford Excerpts

Tuesday 5th June 2018 Lords Chamber

[Lord Kennedy of Southwark]

To ask Her Majesty’s Government what action they are taking to ensure that documents sent to the Home Office are not lost; and what plans the department has to refer itself to the Information Commissioner’s Office when data breaches occur.

[The Minister of State, Home Office (Baroness Williams of Trafford) (Con)]

My Lords, following the implementation of the General Data Protection Regulation on 25 May, the Home Office has appointed a data protection officer who is reviewing the data breach reporting arrangements across the Home Office. This autumn, the Home Office will begin the rollout of a more complete service that will see customers enter and leave a commercial partner facility in possession of their documents, having had them scanned.

[Lord Kennedy of Southwark (Lab Co-op)]

My Lords, repeat examples of personal documents being lost by the Home Office are unacceptable and distressing and potentially devastating for the individuals who have had their papers lost. I am pleased to hear of the action being taken by the noble Baroness, but this is not a new problem. It was raised as far back as 2012 in the other place by my right honourable friend the Member for Cardiff South and Penarth. So can the Minister give us further assurances about what is happening about personal papers and things? We cannot have a situation where papers are lost and people are potentially put in devastating situations. I did not quite catch what the Minister said. Can she confirm that in future, if there are any data breaches, the Home Office will refer itself to the ICO?

[Baroness Williams of Trafford]

I thank the noble Lord for asking that question about clarity. He is absolutely right to be concerned about lost documents. It can be devastating for people, particularly for immigration or visa purposes. Following a spike last November, UKVI formed a lost documents working group to identify methods of preventing lost documents. From October 2018, the majority of customers will complete their visa application, for example, at front-end service points in the UK managed by our new commercial partner on behalf of UKVI. The noble Lord asked about breaches. They are normally reported to Home Office security and to the data protection officer.

[Baroness Hamwee (LD)]

My Lords, the fact that there has to be a specific lost documents working party says a great deal about organisation in the Home Office. I dare say that there are many millions of EU citizens who will be delighted to know that their documents will be handled with care. I should not be so cynical. If personal information is to be dealt with more reliably within the Home Office, can we expect a reduction in the percentage of successful appeals to the tribunal, which currently stands at 40%?

[Baroness Williams of Trafford]

The noble Baroness raises a point that the Home Office itself acknowledges. Documents have on occasion been lost—a minute proportion of the total number of documents that it deals with, I have to say, but lost nevertheless. As I say, moving to a digitised system should help in huge part to guard against that. The reporting of data breaches in future should also help not only to highlight what has happened but, hopefully, to prevent stuff from happening in future.

[Lord West of Spithead (Lab)]

My Lords, when I was at the Home Office we were moving towards digitising all this documentation. From what the Minister says, we do not seem to have achieved that. What level of digitisation of documents and the like have we got to in the Home Office? It was very low when we started in about 2009. What level have we got to now?

[Baroness Williams of Trafford]

As an example, paper documents that previously had to be submitted by hand can now be scanned and sent without the need for documents to actually change hands between the individual and the office to which they are applying for whatever purpose.

[Baroness Ludford (LD)]

My Lords, could I ask the Minister about the related issue of record keeping? I understand that there are other groups of people who may have similar problems to those we have seen in the Windrush cases. We have discovered that the Home Office is very poor at keeping records of, for instance, people who have indefinite leave to remain. Is that issue being examined? I have seen it stated in an Amnesty publication that Chilean refugees who came in the 1970s may be encountering a problem, while a Liberal Democrat councillor who has been here for decades recently had a problem when she applied for British citizenship because there seemed to be no record of her ILR from 1979. What is being done about that?

[Baroness Williams of Trafford]

I think the noble Baroness will recognise that for the last few weeks we have recognised some of the problems faced by people who came here before 1973 but for whom there is no formal documentation. She talked about certain individuals—indeed, she mentioned a whole host of cases—but I hope that she will recognise from the statutory instrument that the Home Secretary laid last Friday that on the issue of the Windrush generation and all those individuals who were here before 1973, every effort is now being made to regularise their status. As for her assertion of ILR, I cannot comment on the case, but if she would like me to write to her on a particular case, I will certainly look into it.

[Lord Elystan-Morgan (CB)]

My Lords, is there any reason why the ordinary law of the land should not apply here? Could not proof of the contents of a lost document be established by way of affidavit or statutory declaration?

[Baroness Williams of Trafford]

The noble Lord goes a bit above my pay grade, but I am sure that he is right. The Question today refers to lost documents—that is, documents that are sent in good faith and then lost, and then the individual who has sent the document has great difficulty in obtaining whatever service it is that they wish to complete. As I say, the presence of a data protection officer and some of the digitisation that the Home Office is undertaking should help to alleviate this.

[Lord Griffiths of Burry Port (Lab)]

My Lords, in answer to a previous Question, the noble Lord, Lord Ashton of Hyde, made ample reference to the secure keeping of people’s data. In reply to this Question addressed to the Home Office, we have heard pretty good evidence of anything other than the security of people’s personal data. Will the Home Office be subject to the same scrutiny, supervision and possible sanctions that small clubs will be subject to as a result of the misuse of people’s data in this way? Might it be appropriate to ask the noble Lord, Lord Ashton, to reply?

[Baroness Williams of Trafford]

The simple answer is yes—every public body will be under the same obligation.

[Lord Trefgarne (Con)]

My Lords, is this confined to the Home Office?

[Baroness Williams of Trafford]

I do not know whether my noble friend means lost documents or data protection, but I am sure that other departments have similar procedures for lost documents.

[Lord Clark of Windermere (Lab)]

My Lords, the noble Baroness correctly referred only to the Home Office, but a lost document from any government department could be critical. Will the Minister assure us that she will draw to the attention of other departments the need to ensure the safety of documents submitted to them?

--- Later in debate ---

[Baroness Williams of Trafford]

The noble Lord is absolutely right to raise this: it applies not just to the Home Office and all government departments but to all public bodies.