NO2ID

If the NAO had indicated that it did not need the personal, sensitive information, which HMRC apparently included in the missing discs and the discs which were successfully sent to the NAO, is it possible that a criminal offence was committed by reason of sections 17 to 23 of the Commisioners of Revenue and Customs Act 2005 and section 8 of the National Audit Act 1983?

Section 18(3) of the 2005 Act allows HMRC to send information permitted by statute, but section 8 of the 1983 Act only allows the NAO to require the transmission of information which is reasonably necessary. If the NAO did not need the information, it is hard to see how it satisfied the test in section 8.

Or is there other legislation which permitted HMRC to transmit the information?

NAO did indicate that they didn't need all the information. They only wanted name, address, NI number and Child Benefit number, but it was deemed "too expensive" to sift the database to retrieve just this, so HMRC bunged the whole bloody lot on the discs instead. Twice.

If anyone is in the wrong, it is HMRC, on several counts. And Alastair Darling for lying about it and blaming some little peon rather than the senior officials whose authorisation would have been necessary to access the data in such a large amount. Sir John Bourn might have had a few too many junkets and lunches at public expense, but at least he could do his job properly.