A D Cunningham suggests that HM Revenue & Customs is not aware of encryption technology (Letters, December 5). The immediate risk of bank fraud would have been reduced if the lost CDs had been encrypted; that they were not was clearly reckless. But encryption is not the real problem.

Eight basic data protection principles, enshrined in the Data Protection Act and enforced by the under-resourced Information Commissioner's Office, place obligations on processors of personal data. Personal information must be fairly and lawfully processed; processed for limited purposes; adequate, relevant and not excessive; accurate and up to date; not kept for longer than necessary; processed in line with individuals' rights; secure; and not transmitted to other countries without adequate protection.

Even if the data on the CDs had been secured, the transfer of the data would still have failed most of the remaining tests.

The National Audit Office had no interest (legitimate or otherwise) in people's bank details. The people to whom the data related had a right to expect that the information would not be transferred outside HMRC or used for purposes other than payment of Child Benefit. Consequently, the data should not have been transferred by any medium - encrypted or not.

Fundamentally, the problem is that the civil service holds more personal information, and shares personal data more widely, than is necessary. Government has no respect for privacy. That must change.

Geraint Bevan, NO2ID Scotland, 3e Grovepark Gardens, Glasgow.