English: Thank you for that statement, Cabinet Secretary. This is an astonishing data security breach affecting thousands of NHS workers right across Wales. At the moment, we know that NHS staff in the Betsi Cadwaladr University Local Health Board have been informed, all 654 of them. We know also that the Velindre trust has informed its members of staff, but, as yet, we're unaware that other members of staff in all the other health boards across Wales have been actually informed. I wonder whether you could tell us today: when will they get to know about the fact that their personal details, including their dates of birth, national insurance numbers, alongside their names, have potentially been leaked to third parties and could be abused in terms of fraudulent activity? People can change their bank account numbers, they can change their passwords, but they cannot change their national insurance numbers. This is something that goes around with them for the rest of their life, and potentially this information could be misused five, 10, 15, 20 years down the line. So, I wonder what action the Welsh Government is taking to ensure that health boards take their responsibility to inform staff very quickly seriously. Can you tell us why there has been a delay between the NHS having been informed of this breach and staff being informed? When did the Welsh Government first become aware of this data security breach, and why did we not receive at that time a briefing as Assembly Members in order that we could liaise with health boards and reassure our constituents about the problems that this might cause? And did the Welsh Government give instructions to sit on this information at all? I think these are important questions. I don't doubt that there was some discussion between the Welsh Government and the health boards about this particular breach, but I wonder what advice was given to those health boards, when they became aware of the breach, about communicating with their staff. It's very clearly the biggest data breech that I've ever been aware of in the NHS in Wales. It's a serious breach, and we need to understand precisely how this happened and what can be done to prevent it from happening again in the future.
Welsh: Diolch i chi am y datganiad yna, Ysgrifennydd y Cabinet. Mae hwn yn achos o danseilio diogelwch data rhyfeddol sy'n effeithio ar filoedd o weithwyr y GIG ledled Cymru. Ar hyn o bryd, rydym yn gwybod bod staff y GIG ym Mwrdd Iechyd Lleol Prifysgol Betsi Cadwaladr wedi cael gwybod, pob un o'r 654 ohonynt. Rydym yn gwybod hefyd bod ymddiriedolaeth Felindre wedi hysbysu ei aelodau staff, ond, hyd yma, nid ydym yn ymwybodol bod aelodau eraill o staff yn yr holl fyrddau iechyd eraill ledled Cymru wedi cael gwybod. Tybed a allech chi ddweud wrthym ni heddiw: pryd y byddant yn cael gwybod am y ffaith bod eu manylion personol, gan gynnwys eu dyddiadau geni, rhifau yswiriant gwladol, ochr yn ochr â'u henwau, o bosibl wedi eu rhyddhau i drydydd parti ac y gellid eu cam-drin o ran gweithgarwch twyllodrus? Gall pobl newid eu rhifau cyfrif banc, gallant newid eu cyfrineiriau, ond ni allant newid eu rhifau yswiriant gwladol. Mae hyn yn rhywbeth sy'n mynd o gwmpas gyda nhw am weddill eu hoes, ac o bosibl gallai'r wybodaeth hon gael ei chamddefnyddio bump, 10, 15, 20 mlynedd yn ddiweddarach. Felly, tybed pa gamau mae Llywodraeth Cymru yn eu cymryd i sicrhau bod byrddau iechyd yn cymryd eu cyfrifoldeb i hysbysu staff yn gyflym iawn o ddifrif. A allwch chi ddweud wrthym pam y bu oedi rhwng yr amser y cafodd y GIG wybod am yr achos hwn o danseilio a'r staff yn cael eu hysbysu? Pryd daeth Llywodraeth Cymru yn ymwybodol gyntaf o'r achos hwn o danseilio diogelwch data, a pham na chawsom ni friff bryd hynny fel Aelodau'r Cynulliad er mwyn i ni gysylltu â'r byrddau iechyd a thawelu meddyliau ein hetholwyr am y problemau y gallai hyn ei achosi? A wnaeth Llywodraeth Cymru roi cyfarwyddiadau i gelu'r wybodaeth hon o gwbl? Rwy'n credu bod y rhain yn gwestiynau pwysig. Nid wyf yn amau bod rhywfaint o drafodaeth wedi bod rhwng Llywodraeth Cymru a'r byrddau iechyd am yr achos hwn o danseilio, ond tybed pa gyngor a roddwyd i'r byrddau iechyd hynny, pan ddaethant yn ymwybodol o'r achos, am gyfathrebu â'u staff. Mae'n amlwg iawn mai hwn yw'r achos mwyaf o danseilio data yr wyf i yn ymwybodol ohono yn y GIG yng Nghymru erioed. Mae'n achos difrifol, ac mae angen i ni ddeall yn union sut y digwyddodd hyn a beth y gellir ei wneud i'w atal rhag digwydd eto yn y dyfodol.