Enforcement Notices
The O’Donnell and Burton reports did not mention the Data Protection Act (DPA) by which private organisations are held accountable. That was left to Information Commissioner Richard Thomas. “The reports show deplorable failures at both HMRC and MOD,” he said. “I will be taking formal enforcement action against [both] following the serious data breaches that have occurred.”
Thomas said his office will require progress reports to be published after 12, 24 and 36 months, documenting how the recommendations have been, or are being, implemented to improve data protection compliance. Failure to comply with an Enforcement Notice is a criminal offence.
Too much data?
Further outsourcing opportunities were revealed when The Independent reported on Sunday that HMRC has admitted its lack of in-house ability to develop an effective VAT fraud, tax evasion and money-laundering detection system, or even to handle the massive amount of data any such system requires.
Accordingly, HMRC will hand over the data to the US Immigration and Customs Enforcement agency (ICE), to process through its own multi-million dollar Data Analysis and Research for Trade Transparency System (DARTTS).
It’s possible that Cabinet Secretary O’Donnell's “necessary measures” might include the humility to recognise that Whitehall should restrain its insatiable demand for data until it can handle it properly. Until that happens, however, it looks like more and more of those measures will need to be executed by the private sector.
Another by-product of this data addiction is that the larger companies that usually get this kind of work, such as EDS, PwC, Logica CMG, etc – often referred to as the Alphabet Club – already have their hands full with various other major public sector IT projects.
This, combined with the fact that individual departments often have quite specific requirements, should mean that there are plenty of opportunities for smaller SIs and VARs to pitch for what should be a considerable amount of work.
