To be honest that is a bit of a poor argument. To say that it's 'better', yet still be insecure is like saying that you'd rather be shot than nibbled to death by rats - the end result is still death (or in this case dataloss). And with an uncentralised system the amount of information that you can make away with is limited, with NPfIT you can get away with a lot more, and leave less fingerprints... Also, do you honestly think that staff on the 'shopfloor' level will change their habits to become more data security conscious? Will they remember to log out? Will they realise that when they remove their security card from the card reader they are still logged in and that anyone can use that computer with their 'authorisation'? PEBUAK...