(1) how many staff of each organisation authorised to use the national DNA database have been (a) investigated, (b) disciplined and (c) dismissed for unauthorised or improper use of that database in each of the last five years;
(2) whether loss of data obtained from the national DNA database has been reported by any organisation which has access to (a) the database and (b) data from the database.
Direct access to information on the National DNA Database (NDNAD) is restricted to a limited number of designated personnel under the control of the National Policing Improvement Agency (NPIA), either directly, or under a contract awarded to the Forensic Science Service (FSS) for operation and maintenance of the NDNAD and development of its IT systems. Throughout the lifetime of the contract, the FSS are required to demonstrate compliance with specified security requirements. Police and law enforcement personnel do not have access to the information on the NDNAD, but receive reports from the NDNAD Delivery Unit of matches between DNA taken from crime scenes and that taken from individuals.
In relation to those NPIA and FSS staff, there has been one instance of unauthorised use of the database during the last five years. This involved a contractor working for the FSS who was found to have used an administrator account on the IT system rather than his own. Following an investigation by the NPIA, no evidence of any improper access to database records was found. However, as use of the administrator account was in contravention of security procedures, the individual was removed from further work on the database. No incidents of unauthorised or improper use of match reports by police and law enforcement personnel have been reported to the NDNAD in the last five years.
Since the NDNAD was set up in 1995, two instances of loss of data have been reported. These took place in February 2009 when the FSS faxed DNA reports intended for two police forces to incorrect fax numbers. In both instances, the faxes were either retrieved by the police or destroyed within 36 hours of the event. A thorough investigation was undertaken by the NPIA and reported to the Home Office. No evidence was found of any malicious intent by any individual.
As a result of the investigation into this incident, an existing project to replace use of fax was accelerated. As from