Last week I blogged about the release of the highly critical Poynter Report into the HMRC data breach;what I didn't also blog at the time was the localised blizzard of other public-sector-data-custody-related reports which, fortuitously, just happened to be released at the same time.
- The Coleman Report (Nick Coleman, formerly of IBM), Cabinet Office-commissioned report on Government Information Assurance - 31 pages;
- Sir Edmund Burton's (MoD) report into the loss of 600,000 personal records on a laptop in January 2008 - 76 pages;
- IPCC (Independent Police Complaints Commission) report into the HMRC data breach - 61 pages.
The timing of their release means that all these can be conveniently offset against the publication of:
- Sir Gus O'Donnell's long-anticipated report into Government Data-Handling - 46 pages.
The web page for this report also has a link to a document which sets out "mandatory minimum measures" for improved data-handling and access control, here. It relates only to central government departments and agencies. Regrettably, this linked document is missing some useful things - such as a title page, author, date, document reference number, index, table of contents, overview or summary of recommendations... but the contents themselves look interesting, so in the interests of public service, here's what the Table of Contents would have contained:
Document Title: Cross Government Actions: Mandatory Minimum Measures
Section 1 - Process measures to manage information risk
Section 2 - Specific minimum measures to protect personal information
Section 3 - Minimum scope of protected personal data
Annex - external access by impact/eGIF level
This last part, the Annex, sets out a matrix classifying kinds of data (from 'public domain' up to 'violent/sex offender and witness protection information') and sets out the network and terminal access which is to be allowed for each classification.
It all looks commendable, but I wonder if the technical and procedural implementation work can succeed in "delivering against the vision", as they say.
It sounds expensive... which will doubtless raise the question: is this expenditure paying off in a way which is visible to the voter and quantifiable to the government? If not, it will be interesting to see how long the resolve to continue funding it persists.


