Conclusion 4

The Department failed in its responsibility to enable effective scrutiny by the Public Accounts Committee and the National Audit Office. Ministers decided who should be informed about, or ‘read in to’, the super- injunction, balancing the need to know against further increasing the risk to the lives of those affected. The data loss was not publicly disclosed in the House of Commons, nor reported in the Department’s Annual Report and 4 Accounts for 2023–24. Nor did the Department inform the Chair of the Public Accounts Committee or the Comptroller and Auditor General in confidence. The Department’s Permanent Secretary told us that, from an accounting officer perspective, the period in question had been “deeply uncomfortable”. The Department did brief the NAO audit director at the time of auditing the 2023–24 accounts that there was a secret matter that could not be shared, and it meant there was a data breach that had not been included in the governance statement in the accounts. There was no briefing of the NAO about the operational consequences, the number of people affected, or the likely cost. The audit director was told that they could not pass on any information to anyone else at the NAO. This was not sufficient to enable the NAO to do its job, which is to support the C&AG to provide assurance to Parliament on the Department’s use of public money. recommendation a. The Department should agree with the Committee and the Comptroller and Auditor General how it will ensure they have sufficient and timely information to enable them to undertake their roles in the context of any similar situations in the future. b. The Treasury Officer of Accounts should issue new guidance on how Accounting Officers should act in the event of super-injunctions.