Hansard

I welcome the opportunity to make a statement to Parliament on the loss during transit of a data disk containing information relating to emergency contacts that had been made with the Scottish Ambulance Service since February 2006. My statement will cover the detailed timeline of events from the point at which the package that contained the disk was passed to the courier, TNT; the processes that the Scottish Ambulance Service followed to ensure the security of the data in transit; and the action that the Ambulance Service and TNT took in their combined efforts to find the disk from the point at which it became evident that it was missing.

I believe that my statement will assure members and—more important—the public of the robustness of the security practices that the Scottish Ambulance Service adopted. Those safeguards were implemented to minimise any risk of the information being accessed by people who do not have the appropriate authority to access it. The situation contrasts starkly with the situation at HM Revenue and Customs, where data were not protected in that way. I also plan to comment on the Scottish Government's data handling report, which was published earlier today and which offers best-practice guidance for all public bodies that are involved in collecting and managing data.

Late in the afternoon of Thursday 19 June, the Scottish Ambulance Service alerted my officials to the fact that a disk containing data relating to contacts with the emergency service was missing in transit. I was alerted to the loss shortly after 6 pm that evening. The following day—Friday 20 June—the Scottish Ambulance Service confirmed the sequence of events from when the decision was taken to download the information on to a portable hard disk. At that time, the Scottish Ambulance Service also advised of the processes that were applied to ensure the security of the information prior to its being passed to TNT for delivery.

I reassure the people of Scotland that the Scottish Ambulance Service, in preparing for the transfer of the data, took every possible effort to ensure the security of those data. Ambulance Service staff who were preparing the disk for transit sought advice from their data protection officer about the procedures to be followed to ensure the security of the information, which included the full range of data that were stored on the command and control system. Those data related to 894,629 call contacts with the Ambulance Service, including the details that would be conveyed in the course of such calls, such as the location and nature of the incident, the names of callers and patients if available, patients' details, such as their age or date of birth and gender, and contact telephone numbers. If a patient's on-going medical problem was known, the record might also refer to it. Actual medical records were not included in the data. Last night, the Scottish Ambulance Service advised me that the disk also contained necessary operational details, including contact details for staff.

The service has assured staff, as I have assured the public, about the steps that were taken to secure the information before transit. All other information on the disk—for example, contact details for general practitioner practices and other agencies, such as social work departments—is already in the public domain.

The data were exported from the Scottish Ambulance Service's command and control database and encrypted on to a portable hard drive using an encryption tool. That drive, or disk, as I will refer to it, was then sealed in a box with a covering letter that said that if the box was found, it should be returned to the Scottish Ambulance Service. The box was in turn put into another package with a similar covering letter, and the package was handed with a signed receipt to TNT on Monday 9 June 2008. That afternoon, an e-mail was sent to MIS Emergency Services Ltd in Manchester, which is the information technology company that was waiting for the disk in order to upgrade the Ambulance Service information system. That e-mail advised the company that the disk was in transit and that it should expect to receive it the following day, Tuesday 10 June 2008.

Daily contact followed over the next few days, but, by Thursday 12 June, TNT accepted that the package was missing and instigated a search in order to find it. The search continued until Thursday 19 June, when the Ambulance Service was first advised that TNT could not find the parcel and TNT invited the Ambulance Service to set down the details of the loss as part of a loss claim process. Later that same afternoon, the Scottish Ambulance Service alerted the Scottish Government to the loss.

On Friday 20 June, TNT further escalated its search procedures, advising both the Scottish Ambulance Service and the Scottish Government that it believed that those searches would result in the disk being traced over the weekend. However, shortly after noon on Monday 23 June, TNT confirmed that, although its searches continued, the leads that it had been pursuing over the weekend had not been successful. At that point, the Scottish Government and the Scottish Ambulance Service decided that the loss of the data disk needed to be made public.

I welcome the decision of the Scottish Ambulance Service to provide a helpline for members of the public who have questions relating to the incident. As of noon today, there had been 21 calls to the helpline, of which 13 were from members of the public. I hope that that reflects the reassurance that both we and the Ambulance Service have given to the public and to staff.

I have had the process by which the Scottish Ambulance Service handled the transmission of the data analysed by the Scottish Government's chief information officer. She has reported that the Scottish Ambulance Service followed good practice by conforming to NHS Scotland information security policy and ensuring that the sensitive personal data on the disk that was entrusted to TNT were protected to the appropriate standard. There are three levels to that protection. First, the data are encrypted. Secondly, they are protected with a 15-character randomly generated password. Thirdly, even if those two barriers were overcome, the data would be a meaningless jumble without the file structure that is necessary to recombine them. That is in complete contrast to the loss of 25 million child benefit records by Her Majesty's Revenue and Customs. Those personal data, which included bank account details, were not similarly protected.

Recent problems, both in Scotland and at a United Kingdom level, have highlighted the importance of ensuring that all those who are charged with handling sensitive public information adhere to the highest standards. In November 2007, we ordered a review of data handling procedures across Government to address justified public concern and to identify any areas in which we needed to improve. By coincidence, that review has published its findings and recommendations today. The data handling review shows that public bodies throughout Scotland generally have high standards of data handling. Data security is being taken seriously across Government, but there are still areas in which improvements can and will be made. There is, of course, absolutely no room for complacency.

I do not believe that, in the case of the loss of the Scottish Ambulance Service data disk, there could be any suggestion that the service was complacent in the way in which it sought to protect the data against their possible loss in transit. The Ambulance Service considered whether there were other means of transmitting the data that might eliminate all prospect of human error. In this case, it was clear that the size of the data file far exceeded the limit of an e-mail that would be allowable via the national health service network.

TNT has acknowledged that the package remains missing and has recognised the seriousness of the issue. I know that it is continuing its efforts to trace it. I know, too, that the Scottish Ambulance Service took all reasonable steps to protect the data against the possibility of loss. It is clear to me that we would be having a very different exchange today had that not been the case.