IBM moves access to UK drivers' private data offshore to datacentre in India

The UK government is to allow IBM to have access to the personal data of the UK's 43 million drivers from an Indian datacentre to cut costs.

The UK government has agreed to allow IBM to move access to personal data of the UK's 43 million drivers to an Indian datacentre to cut costs.

IBM runs London's congestion charge system.

The secret move comes after IBM lobbied Transport for London (TfL), the Observer revealed. IBM has been fined repeatedly since it took over the contract from Capita in 2009, making the £60m deal less profitable than it had hoped.

Driver and Vehicle Licensing Agency (DVLA) data includes addresses, car registration numbers and credit card details. The data will be accessible to staff outside the UK for the first time, the paper said.

The move has not been publicly announced, and Public and Commercial Services (PCS) union sources cited by the paper said it appears neither IBM nor DVLA were planning to tell anyone about it.

The move was approved despite the fact that an IBM risk assessment warned of the risk to the security of sensitive data and a potential threat to London's reputation if the changes reduce the ability of staff to deal with problems in the congestion zone IT systems.

The Observer said the move also appears to contradict ministers' recent insistence they would resist any work on government contracts going abroad.

The transition to a datacentre in India is scheduled for completion by 18 May. TfL stressed that the data will still be stored in the UK.

The paper quotes Labour MP John McDonnell as saying the decision to offshore access to this sensitive information database will not only cost jobs, but it will also open up vast opportunities for fraud.

Offshoring the congestion charge operation just ahead of the Olympics also risks making the UK the "laughing stock of the world", he said, as the new system inevitably experiences teething problems.

A DVLA spokesperson said: "All IT systems must be managed to the same standard as if they were in the UK. We will ensure that all appropriate controls for data protection are in place."

Responding to the revelation, PCS general secretary Mark Serwotka called for an immediate halt to a consultation by the DVLA to close its 39 registration and enforcement offices in the UK, to centralise operations in Swansea.

"We're doubtful it's a mere coincidence that this comes as the DVLA is planning to close these offices and we fear it could pave the way for further privatisation and offshoring of DVLA services," Serwotka said in a statement.

Plans to close the 39 offices, threatening 1,200 jobs, were announced by the DVLA in the run-up to Christmas. The consultation is due to end on Tuesday 20 March.

The government should call an immediate halt to the DVLA's plans and ministers should explain to MPs and the public exactly what has happened and what are the implications, said Serwotka.

"As well as the threat to people's jobs and livelihoods, there are serious questions about the security of the personal information the company holds and has access to, and if the transport secretary has indeed signed this off we need to know why, given it appears to be at odds with the commitment his cabinet colleague Chris Grayling gave to parliament," Serwotka said.

In November 2011, after the PCS union fought off an attempt by Hewlett Packard to offshore sensitive data it holds about people entitled to benefits and pensions payments, employment minister Chris Grayling told parliament:

"We have a policy to control contracted work being offshored. Our suppliers are required to seek approval before they offshore any contracted work. Those approvals are predicated on their meeting stringent guidelines. 

"I should also say that, as a team of ministers, we have indicated very clearly to our suppliers that we will not countenance seeing existing UK employment offshored."

Read more on Offshore IT services