Debate contribution: Personal Independence Payment Applications: Data Breach

Debate contribution by Mr Gordon Lyons on 22 September 2025.

MLA

Mr Gordon Lyons

Party at the time

Democratic Unionist Party

Date

22 September 2025

Type

Debate contribution (made as a minister)

Business

Questions for Urgent Oral Answer

Heading

Personal Independence Payment Applications: Data Breach

Assembly identifier

Official Report component 5123970

Read the official Assembly record

Text

First, I fully acknowledge that even one incident in which personal data is compromised is unacceptable and can have a serious impact on the individuals involved. In this case, investigations by my officials have determined that the breach was due to human error. It has been established that, in this instance, checks to verify that outgoing mail is directed to the correct address and that each envelope contains only the pertinent information for the designated customer were not completed fully. The data in question was retrieved promptly, a data protection incident was raised, and an early referral was made to the Information Commissioner's Office (ICO) while the investigations were under way. My Department continues to work through its established data incident reporting process, and I can advise that, as part of the major incident reporting process, officials will contact the ICO to close the case with it, given that the information has been retrieved and that the information disclosed is not likely to present a high risk to the data subjects. All PIP staff have been advised of the incident. There will be renewed focus on the control measures that are in place and on the importance of the security of personal customer information. In addition, in conjunction with the Department's data protection officer, a compliance audit will be initiated as a matter of urgency on the personal independence payment centre's document handling approach. It is expected that that will take four to six weeks to complete, after which learning will be shared across teams to identify areas where improvements to data handling processes can be made.

We have not had any correspondence with the people whose correspondence and data was shared in error. It has been agreed not to do so as the information that was disclosed is not sensitive and that to advise the data subjects may cause unnecessary or disproportionate distress. That is line with the approach outlined in the ICO's guidance.

First, it is important to note that that distress has not occurred because of what I outlined in response to the previous question. The information is not disclosed, but we understand the potential for distress, especially if what is considered to be sensitive information is leaked. We want to do everything that we can to make sure that this does not happen again. The error here was not in payments made; rather, information was disclosed that should not have been. Of course, we will take all steps that we can to be as transparent about this as possible. That is why I am here today answering the questions and, hopefully, giving people confidence that we will learn from this and put measures in place so that it does not happen again.

Yes, of course. Training and procedures are in place so that something like this should not happen. Unfortunately, it has happened, which is why we are going to put those extra steps in place. In conjunction with the Department's data protection officer, the compliance audit will be initiated as a matter of urgency. That will take a few weeks to complete, but it is important that we do that and share the learning not only within the individual team involved but with everybody.

The Department for Communities has over a million customers, some of whom receive correspondence monthly or even more often than that. That gives some indication of the millions of pieces of correspondence that we send out in a year. I have been informed that the number of major breaches in a year numbers under 20 and that referrals to the Information Commissioner's Office are required only once or twice a year. I am not sure what the exact maths is on that, but 20 breaches out of millions of documents sent out is a relatively small proportion. However, that does not mean that we are complacent. As I said in my opening response, one is too many, and we will take all the steps that we can to make sure that the process is more secure.

I am always happy to take the Member's advice on these things, but we are also guided by the approach of and guidance given by the ICO. That is what we are following in this instance. I am more than happy to hear from her if she has any alternative views on that, but that is the information that I have been given, and that is the approach that we are following.

As I outlined in my original answer, a process is in place that will mean that the sharing of such documents is not left to one person. There is meant to be a checking process in place. Unfortunately, due to human error, that did not take place in this instance, and that is why the mistake happened. I hope that it will not happen again. In conjunction with the Department's data protection officer, a compliance audit will be done to see what, if any, improvements can be made to our data-handling approach. As I said earlier, the learning from that will be shared across teams to see where improvements in data-handling can be made.

I will certainly take those points on board. This incident was slightly different, however, in that extra information was provided. I will need to check the processes to make sure that those who were supposed to get the information that was sent elsewhere can get it. If the Member is hearing about individual issues, I am content to look at them. I would be surprised, however, if the Department were to take a heavy-handed approach to one piece of correspondence that has not come through. Often, people repeatedly say that they have not got letter after letter, which sometimes stretches credibility. Of course, if the Member knows of specific instances that he wants me to look at, I am more than happy to do so. We need to make sure that we have a system in place that does what it is meant to do, is accurate and in which people can have confidence, and that is what I want to achieve.

1,023 words. Text as published by the Northern Ireland Assembly.

Assessment

Not flagged

Jev’s structured answers

Assessed 21 October 2026 at 13:13 UTC by jev-1.13.0 (requested as typesafe/jev) under rubric 2026.10-r9, methodology 1.9.

Disagree with this assessment?

Classifications can be challenged. A person reads every challenge, and any change is recorded publicly above with its reason.

Challenge this classification