An investigation into how personal information about the judiciary came to be sent by post began last night as further details emerged about lost discs containing taxpayers’ details.

The Times has been told that at least ten discs holding personal information about millions of people — not two discs as originally suggested — have yet to be accounted for after they had been sent from Revenue and Customs’ offices.

The Government was forced to begin a separate investigation last night after a businessman claimed that he was posted two discs containing highly sensitive information about judges, barristers and solicitors.

Frank Milford, whose company was hired in 2006 by the Department of Constitutional Affairs to overhaul its administration, said he had asked for a list of its suppliers. He received a package from a firm called Liberata, which handled the department’s finances, containing two discs listing personal details of every person, business or company paid by the department over the past five years. He told The Sun newspaper that the discs were neither encrypted nor password-protected.

Q&A: how can I protect myself?

Advice for anyone who fears their personal data may be misused by fraudsters after Britain's worst ever security breach

• Government under pressure over taxman's giant blunder

Related Internet Links

• Online security: full coverage

Background

• Police step in as other CDs have gone astray

• Moment’s blunder puts half the country at risk

• Data watchdog seeks dawn-raid powers

• New data law 'urgently needed'

Related Links

• Datagate and the threat of a digital dystopia

• Revenue routinely sent data with no security

Recorded on the files were the addresses, phone numbers, e-mail details and bank information of people such as Lord Falconer of Thoroton, the recently retired Lord Chancellor, and Lord Woolf, the former Lord Chief Justice. Mr Milford, 46, said that even after his work finished in July he was never asked to return the discs.

The Ministry of Justice, which has taken over the responsibilities of the department, confirmed last night that it had begun an investigation.

Last week the Government admitted that it had lost two discs containing details of the country’s 25 million child benefit claimants. The Conservatives have demanded that Alistair Darling, the Chancellor, return to Parliament tomorrow to give a second statement to MPs on the loss.

In another embarrassing twist, it emerged last night that at least one letter sent to the house of a child benefit claimant apologising over the lost data contained private information about another parent. Stuart Gray, 35, said he had opened the letter from HM Revenue and Customs to find the name, national insurance number and child benefit code of Karen Cromar, who used to live in the property.

This newspaper has been told that there are actually ten missing discs, including the two sent from offices in Washington, Tyne and Wear, to the National Audit Office in London and six lost in transit from tax offices in Preston. The discs were not registered properly or encrypted, leaving them open to fraudsters.

Staff from the Washington office are searching for another disc that contains “limited but sensitive” information related to child benefit claimants. Yet another, with the tax details of several hundred people appealing against previous Revenue & Customs decisions, is also being sought.

A source close to the investigation said: “There are other CDs yet to be accounted for — we have been told of ten so far, but basic checks are being carried out before any formal announcement.” Police will today continue their search of the premises of TNT, the private courier company, after finding no trace of the discs at child benefit offices in Tyne and Wear.

A government review is also under way into whether sensitive information about NHS patients could be sent overseas for processing. Doctors have expressed concerns that sending patient information abroad would create a “risk to confidentiality” — particularly if records were sent to countries with a different culture of protecting personal data.

The Department of Health says that there are no plans to export the processing of patient files, but a leaked internal NHS document, seen by the IT magazine Computer Weekly, reveals that the review is being held.

It states: “Organisations should be aware of a current review into the possibility of NHS patient data being processed overseas by approved organisations.” It was “considering the requirements for, and implications of, such possible arrangements”.

The leaked document was issued internally by NHS Connecting for Health, which runs part of the £12.4 billion National Programme for IT. It gives advice to NHS organisations registering staff and clinicians for smartcard access to the IT programme.

Organisations that send personal data abroad for processing remain legally responsible under the Data Protection Act for ensuring that it is secure.

The Information Commissioner’s Office said that it would be contacting NHS Connecting for Health to check that its position had not changed.

The Department of Health said that patient data was not sent abroad and denied that there was a review: “There are no considerations relating to the National Programme for IT for patient data to be processed abroad.”

Find out how to protect yourself against ID theft

Explore Health

• Expert Advice

• Health Features

• Mental Health

• Alternative Medicine

• Child Health

• Health Club