Bank details of 10,000 on stolen laptops

BANK DETAILS and in some cases PPS numbers and addresses of up to 10,000 public servants were contained on laptops stolen from the office of the Comptroller and Auditor General.

A briefing note to the Committee of Public Accounts (PAC) from the office of Comptroller and Auditor General (CAG) John Buckley outlines new details relating to three of 16 laptops stolen from CAG employees since 1999.

It discloses that two laptops contained payroll data with employees' names and PPS numbers, and bank account details in some cases. "One laptop contained the PPS numbers of staff from five entities, ranging from a sample of eight for one entity to approximately 6,700 from another.

"For a sixth entity there were PPS numbers and bank details for 51 staff. The second laptop contained copies of payslips for 25 employees and name and bank details (but no PPS number) for 2,568 employees," it states.

The briefing paper, which was submitted to the PAC yesterday, does not divulge the State departments or agencies involved or when the laptops were stolen.

However, it does explain why such sensitive data on payroll information was downloaded on to its laptops. It said that it needed to have access to either partial or full databases in order to conduct its audits.

"Payroll constitutes a major portion of expenditure in the public sector and is, therefore, of critical importance in the context of the audit. Each audit is concerned with gaining reasonable assurance that amounts reported for pay are complete and accurate."

The briefing paper also disclosed that a third stolen laptop - containing personal information on 380,000 social welfare recipients - was actually taken from the headquarters of the Department of Social and Family Affairs (DSFA).

The laptop, which went missing on April 12th, 2007, had been left on the fourth floor of Oisín House overnight, it states.

According to the briefing paper, the DSFA offices had security at its entrance and visitors cannot generally gain access to the fourth floor. However, there was no lock on the door of the office. A lock was put on the door some time later (by the DSFA).

PAC chairman Bernard Allen expressed surprise at this development, saying that an impression had gone abroad that the laptop was stolen elsewhere.

"The impression I got at the time was that it had been left in a public place and that the department did not become aware of the thefts for some time.

"Interviews given on behalf of the DSFA at the time certainly never clarified that it had been stolen from its own office," he said.

When it became known last month that the laptop had been stolen, Minister for Social and Family Affairs Mary Hanafin said that the department was aware of the theft but voiced concern that 15 months had elapsed before her department was made aware of the data stored on it.

The CAG has introduced encryption to much of its data and has established what it says are strong protocols to protect data.