Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

60. To ask the Minister for Finance when information on leaks or suspected leaks from the National Asset Management Agency were first brought to his attention; the steps he has taken in relation to same; and if he will make a statement on the matter. [10929/16]

Michael Noonan (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Employees assigned by the NTMA to NAMA are bound by a number of statutory obligations in respect of the confidentiality of information to which they have access by virtue of their employment by NAMA. These include obligations imposed under Section 14(1) of the National Treasury Management Agency Act 1990 and under Section 202 of the NAMA Act 2009. Staff assigned to NAMA are also subject to the provisions of the Official Secrets Act 1963. Contravention of these statutory obligations constitutes criminal offences and, under Section 7 of the NAMA Act, a person who commits such offences may be liable to a substantial fine or term of imprisonment or both.

Under Section 19 of the Criminal Justice Act 2011, any party with evidence of criminal wrongdoing is legally obliged to bring such evidence to the attention of An Garda Siochána.

In September 2012, evidence emerged that confidential NAMA data may have been unlawfully disclosed by a former NAMA Officer. NAMA informed the Gardaí and the Data Protection Commissioner of their concerns and the matter was brought to my attention at the time. Last week, the former Officer was found guilty by the Dublin Circuit Criminal Court of the unlawful disclosure of confidential NAMA information. The case follows an extensive investigation of the matter by the Garda Bureau of Fraud Investigation (GBFI) since Autumn 2012.

In September 2012, NAMA launched a major review of data security and of data access within the Agency and of data transmission to external parties which had a business need to receive data from it. The review found that the security processes in place in NAMA (which were derived from those of the NTMA) were very robust, a number of additional measures were proposed and adopted in order to reduce further the scope for unauthorised transmission of data to external parties.

I am advised that NAMA employs a wide range of measures to prevent unauthorised disclosure of confidential data. These include practical measures such as the deployment of email monitoring technology to prevent email attachments from being forwarded to personal and non-corporate email accounts. IT controls also ensure that data cannot be saved from the NTMA network onto external storage devices, such as USB keys and compact discs. I am advised, however, that no organisation, short of installing system and process restrictions which would seriously compromise its ability to conduct its day to day business effectively, can absolutely protect itself against data theft. In the case of the unlawful disclosure of confidential NAMA information which was the subject of the recent prosecution in the Dublin Circuit Criminal Court, it was noted that despite NAMA's robust data security infrastructure the ex-employee, who was subject of the case, acted in a determined fashion to circumvent the security measures in place by distributing the information through his spouse who at that time was employed by a firm engaged in providing services to NAMA.

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

61. To ask the Minister for Finance if, when and in what manner the National Asset Management Agency notified affected clients and debtors that confidential information in respect of their accounts had been leaked; and if he will make a statement on the matter. [10930/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

62. To ask the Minister for Finance why the National Asset Management Agency has not notified all affected clients and debtors that confidential information in respect of their accounts leaked in 2011 and 2012; if he has requested the agency to immediately inform clients and debtors; and if he will make a statement on the matter. [10931/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

63. To ask the Minister for Finance the number of clients and debtors of the National Asset Management Agency who are affected and were included on confidential lists leaked by a former official; and if he will make a statement on the matter. [10932/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

69. To ask the Minister for Finance if and when he or the National Asset Management Agency notified the Data Protection Commissioner of leaks from the agency; the result of such notifications; and if he will make a statement on the matter. [10938/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

70. To ask the Minister for Finance why, if it has not, the National Asset Management Agency has not notified all affected debtors and clients that confidential information in respect of their accounts was leaked; and if he will make a statement on the matter. [10939/16]

Michael Noonan (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 61 to 63, inclusive, 69 and 70 together.

NAMA notified the Data Protection Commissioner in Autumn 2012. I am advised that, following consultation with the Office of the Data Protection Commissioner, NAMA has followed best practice as set out in the Data Protection Commissioner's Code of Practice in respect of security breaches.  

In addition to its obligations under Data Protection, NAMA has at all times acted in accordance with the instructions of the Garda Bureau of Fraud Investigation. 

Information on the number of debtors potentially affected is held by the Garda Bureau of Fraud Investigation which carried out the investigation which led to the prosecution of the former NAMA official.

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

64. To ask the Minister for Finance the lapses in security at the National Asset Management Agency that allowed leaks to take place; and if he will make a statement on the matter. [10933/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

65. To ask the Minister for Finance the steps the National Asset Management Agency has taken and the measures it has put in place to ensure that other security lapses of a similar nature to the recent taking of information have not taken place; and if he will make a statement on the matter. [10934/16]

Michael Noonan (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 64 and 65 together.

I am advised that, in September 2012, after reporting its concerns about alleged unauthorised data disclosure to An Garda Síochána, NAMA launched a major review conducted by Deloitte of data security and of data access within the Agency and of data transmission to external parties which had a business need to receive data from it. While the Deloitte review found that the security processes in place in NAMA (which were derived from those of the NTMA) were very robust, a number of additional measures were proposed and adopted in order to reduce further the scope for unauthorised transmission of data to external parties.

I am advised that NAMA employs a wide range of measures to prevent unauthorised disclosure of confidential data. These include practical measures such as the deployment of email monitoring technology to prevent email attachments from being forwarded to personal and non-corporate email accounts. IT controls also ensure that data cannot be saved from the NTMA network onto external storage devices, such as USB keys and compact discs. I am advised, however, that no organisation, short of installing system and process restrictions which would seriously compromise its ability to conduct its day to day business effectively, can absolutely protect itself against data theft.  However, the standards employed by NAMA are to the highest professional available and implemented elsewhere.

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

66. To ask the Minister for Finance if he has concerns that the leaked information from the National Asset Management Agency, including valuation information, ended up in the hands of funds or entities bidding to purchase assets from it; if the State suffered a loss as a result; and if he will make a statement on the matter. [10935/16]

Marc MacSharry (Sligo-Leitrim, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

67. To ask the Minister for Finance if any of the recipients of the leaked information from the National Asset Management Agency or their employees or agents are connected to, employed by or comprise any of the eventual successful bidders for the properties that are the subject of the leaks; and if he will make a statement on the matter. [10936/16]

Michael Noonan (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 66 and 67 together.

I am advised that NAMA has stated, and the Gardaí in turn advised the Courts, that NAMA does not consider that it suffered any loss arising from the unlawful disclosure of the confidential NAMA information which was the subject of the recent prosecution in the Dublin Circuit Criminal Court. I am advised that it was not part of the DPP's case that NAMA's ability to conduct its business had been compromised by the disclosure.

I am advised that there is no evidence to suggest that there are connections between the recipients of the unlawful disclosures and bidders for assets that may have been offered for sale by NAMA debtors. In any event, I am advised that, as part of NAMA asset and loan sales, the information provided to potential bidders is much more comprehensive than the unlawfully disclosed 2009 information which was the subject of the recent Circuit Criminal Court case. Accordingly, I am advised that no advantage would accrue to the recipients of the unlawfully disclosed information in any competitive bidding process as it is market value as determined at the time of sale that is the basis for NAMA's assessment of any bids.

I am advised that NAMA's policy is that the sale of all loans and the sale of properties by debtors and receivers should be openly marketed wherever possible to ensure that the best price available in the market is achieved in all instances.  NAMA enjoys a strong reputation in the market for the quality of information it provides as part of its property portfolio and loan sale processes and for the transparent and professional manner in which such transactions are executed. Both its property portfolio and loan sales processes are built on international best practice and NAMA uses experienced advisers to ensure that transactions are executed to the highest market standards and that bidders are treated equally by mapping out a clear and rigorous process to be followed in each sale.

Prior to the launch of a property portfolio or a loan sale, all relevant data, including loan agreements, security and title documentation, data tapes, lease information and tenancy schedules, is assembled in a data room by NAMA in conjunction with its legal and loan sale advisors. An initial high-level summary of the property or loan portfolio is then issued to potential purchasers so as to generate as much interest as possible.

Bidders are required to submit binding unconditional bids, proof of funding and marked-up contracts for sale. The final bids are assessed by NAMA with advice and recommendations from the portfolio sales agents or loan sales brokers, and a recommendation is made to the appropriate decision-making authority in NAMA.  The successful and unsuccessful parties are advised of the outcome with the successful party also being notified of the timescale for completing the transaction.