A typically British security setup

HMRC manual on data protection was protected data

What? Really? No!? I suppose it proves that they at least have a security policy...