It is a fundamental duty of government, public sector bodies and bodies in receipt of public funds to keep safe the data they hold on citizens. This duty has not been consistently upheld in the UK for some time. An Information Security Review, whose existence was - seemingly unnecessarily - kept secret until our intervention, examined a series of public sector data breaches, painting a picture of institutional failure and an incoherent approach to data hygiene. (Conclusion, Paragraph 44)