Left Holding the Baby (but not the CDs)

[major_clanger]

More from The Guardian on the Great Missing CDs Fiasco:

"A spokesperson for HMRC said: "This individual should not have been involved. It was none of their business. They should have forwarded it on to someone else - another group of civil servants at a more senior level ... The individual in question had nothing to do with that team and it was completely outside their job remit."

Ooh, do any other legal types out there detect the phrase "a frolic of his own" winging its way inexorably towards this sorry mess? It would be very, very convenient for HMRC to be able to deny vicarious liability for this person's mistake, wouldn't it?

Comments

[purplecthulhu.livejournal.com]

I get the sense of someone being hung out to dry...

BUT if it was beyond their remit to do this why was the system set up to allow them to? That is a flaw in the system which whoever set it up and maintained the system, ie. HMRC, has to be liable for.

[andrewducker]

Yup. How the hell did they get access to a disk with 25 million bank accounts on it? Why weren't procedures in place to stop that? I work in a financial company and _I_ sure as hell can't just grab that data from the production tables.

[timill]

You can't, I can't, but there are people who can. And if they get a request passed down and assume it's all authorised already, Interesting Things can happen.

[andrewducker]

Yes. It's a failure of procedures. But setting those procedures properly and making sure they get followed is a strategic issue, stemming right from the top of an organisation.

We're having a _big_ push for security at work at the moment, and all of our procedures are being looked at. At the very least, everyone is terribly aware that the data we hold is _secret_ and nobody should be seeing it without all sorts of clearance. If there isn't that kind of culture amongst the people in these departments then it's the fault of senior management.

[timill]

Presumably the job that was run was a standard extract job that's used all the time to pull data off the mainframe for internal HMRC purposes. That, I suspect, was within this person's usual remit; what was outside that remit is, I suspect, "talking to other Government Departments", not "extracting data".

[hfnuala.livejournal.com]

If it was outside his remit how could he get the data? I can't get at people's bank account details.