'the NAO wanted only limited child benefit records but was told in an e-mail from a senior business manager in March that to remove more sensitive information was too costly and complex.
Please correct me if I'm wrong, but this should be trivial for any well set up system. In the commercial 'filemaker' system, one can choose which records to export. If, as is more likely, the database was SQL, one could make a copy of the database and then drop unwanted tables, or fields. For anyone managing an IT system, this should have been trivial.
Someone who is responsible for decisions on such a large and costly database really should be able to manipulate that data easily.
For the record, the SQL syntax (after about 15 secs of research) is:
ALTER TABLE <table_name> DROP <field_name>
DROP TABLE table_name
Methinks the 'it was too expensive' excuse is just so much baloney.
Update: qwghlm has a post on this too.