A missing computer hard drive reported missing last week may have contained details of 1.7 million people, a government minister has revealed.
The unencrypted drive went missing from the premises of contractor EDS in Hampshire. The drive's loss was revealed last week, during an audit that was ordered by the Cabinet Office as part of an investigation into data security.
Defence Minister Bob Ainsworth told MPs the hard drive was "unlikely" to have been encrypted "because it was stored within a secure site that exceeded the standards necessary for Restricted information".
Initial reports on the loss of the drive said the drive contained the names, addresses, passport numbers, dates of birth, next-of-kin and driving licence details of up to 100,000 military personnel and up to 600,000 potential recruits.
But Ainsworth said, in a written statement to parliament, the drive "may, in the worst case, contain details relating to 1.7 million individuals who have enquired about joining the armed forces".
In some cases, only the name and contact numbers are likely to have been recorded, said Ainsworth. But for those who went on to apply to join up, the drive could include more extensive data, including next of kin details, passport and National Insurance numbers, drivers' licence, bank details and NHS numbers.
The minister said that the incident "illustrates the need continually to review and enhance our arrangements for personal data".
The department has been dogged by data loss scandals. In July, the Ministry of Defence admitted that 1,405 laptops and 121 USB memory sticks, some containing sensitive information, had been lost or stolen since 2004. In January, 600,000 unencrypted records went missing when a laptop was stolen.
The Burton Review into the loss of a Ministry of Defence laptop, published in June, found the agency was "not treating information, knowledge and data as key operational and business assets".
In his statement, Ainsworth acknowledged the review's findings:
"As a result of the review conducted earlier this year by Sir Edmund Burton, the Ministry of Defence is clear about the crucial need to implement wholesale improvements in how we store, protect and manage the use of personal data. We are also clear that we need to effect a significant behavioural change among our people at all levels. We are currently engaged in a comprehensive programme to do all of this. The MoD is a large department operating many complex data systems world-wide, often at very short notice and under extreme conditions. This presents additional challenges and risks in the implementation of rapid change – however we are determined to ensure that we effect that change."
In April, the Cabinet Office made new proposals that would see government ministers to be held personally responsible for any data losses within their department.