Unlike shriller voices, this newspaper has always taken a measured view on the collection and storage of personal data. We see no inherent threat to personal freedom from the introduction of identity cards, in the storage of financial records or in the aggregation of information on a person's health, income or social security payments to help government to keep better records and make more accurate assessments of need. The proviso has always been, however, that the more sensitive the information entrusted to official agencies, the greater their responsibility to ensure its safekeeping and appropriate use.

The admission yesterday that Revenue & Customs (HMRC) has lost two discs containing the names, national insurance and bank details of 7.5 million families receiving child benefit is therefore extremely alarming. In all, some 25 million people are affected. It is an appalling blunder likely to undermine trust not only in this troubled agency but in the ability of government to follow its own security procedures. Alistair Darling minced no words in calling it a “deeply regrettable” affair that should “never have happened”. Nevertheless, his apology, though necessary, and the abrupt resignation yesterday of Paul Gray, the head of HMRC, will do little to assuage the widespread anger at what has happened and the ridicule for a government agency, now the largest in the country, that has suffered three serious security breaches since September.

Mr Darling tried to reassure the millions of people worried at the prospect of their bank accounts being raided and their identities stolen. He detailed the procedures belatedly taken after the discovery that the disks supposedly had gone missing. These were the minimum necessary: the police have been brought in, banks and building societies have been warned, internal security procedures tightened and a guarantee given that no one will suffer financially. He has also announced, as he was obliged to, a full inquiry.

There are many lessons to be drawn. The first is an honourable one: Mr Gray's resignation was entirely appropriate, although he was not directly involved in the loss. The second is that no junior officials should have been in a position to respond to a request for data, nor should their handling of it have been sanctioned at a higher level. The third is that Whitehall must devise a better way of exchanging information with other bodies. The National Audit Office routinely requests information. It should, itself, be far more aware of the sensitivity of what it requires and insist on a more reliable way of transferring data than an unregistered commercial courier.

Beyond this, the Government needs to look again at the recent merger that has created this unwieldy department. A report by the Institute of Chartered Accountants in England and Wales paints a damning picture of a floundering agency whose disorganisation, lack of clarity and poor accountability would inflict “irreparable damage” on any normal commercial body. It says the dual targets of cutting costs and increasing efficiency are incompatible, with large job cuts leaving the HMRC reliant on untrained staff. It is little wonder that security breaches occurred. Mr Darling has had to make two awkward parliamentary statements within two days. It is, as the Conservatives taunted, time to get a grip — on the Treasury, on HMRC and on the issue of data protection. It is not only the issue of ID cards that will suffer the inevitable fallout; so too will the Government's reputation for competence.