Report highlights 'residual' security risks with ContactPoint database

The coalition government has previously said the database will be scrapped although last week the Department for Education announced it will remain in use while an alternative is settled on.

The report, compiled by consulting firm Deloitte in 2008 and released to campaign group Action on Rights for Children, details a number of "residual risks" involved with the database, which stores information on every child in England.

Points raised include:

• A risk to the effectiveness of overall security due to a lack of accountability for data across organisations using the database
• A risk that security controls will not be effective because they have not been formally assured to a recognised standard
• A lack of defined processes around the disposal of electronic and hard-copy media that could lead to "information leakage"
• A risk of "inappropriate advice" being given to organisations using the database by the central support helpdesk that could lead to security practices not being followed or being bypassed.

The report concludes that the importance of security appears ingrained within key project areas but makes a series of recommendations to remedy the potential risks identified.

The Department for Education said all the recommendations in the report were acted on. "One of the first actions for the department immediately after the election was to start shutting down ContactPoint," a spokeswoman said.

"We are currently looking at ways of salvaging investment which went into the system and we will terminate its operation soon.