Transparency data

Data Usage Agreement: exploring fraudulent behaviour in the SDS Modern Apprenticeship Programme

Published 20 March 2025

This Data Usage Agreement between HMRC and Skills Development Scotland was agreed and put in place in 2023.

Data sharing between HMRC and Skills Development Scotland (SDS) to explore the extent of fraudulent behaviour in the SDS Modern Apprenticeship Programme

Data Usage Agreement reference: RIS DUA 2023 007

Legal basis

Section 56 of the Digital Economy Act 2017 in conjunction with schedule 8 (part 3), may be used by HMRC to disclose information for the purposes of fraud provisions as SDS is listed as a specified body under schedule 8.

Also relevant are The Digital Government (Scottish Bodies) Regulations 2022. These regulations relate to the disclosure of information in relation to fraud against the public sector, pursuant to sections 56 of the DEA.

Lawful basis

The lawful basis for processing is article 6(1)(e) of General Data Protection Regulation (GDPR), as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority.

Background

Skills Development Scotland contracts with and pays a range of organisations to support and administer its Modern Apprenticeship Programme. These organisations, include public sector colleges, private training delivery organisations, local authorities and competency assessment organisations and are collectively known as Training Providers (TPs).

SDS spends up to £150 million on its apprenticeship programmes each year. In recent years, SDS investigations have identified fraud and financial irregularities across SDS programmes including fictitious companies; fictitious learners; or continuing claims for learners who have left programmes.

In 2020, the English equivalent to SDS, the Education and Skills Funding Agency (ESFA) found that for an identified fraud, there was over £5 million in funding for 400,000 apprentices since 2015 at risk. The ESFA investigation identified links between 8 employers used for the apprentices, and the learning provider. ESFA analysis found that the number of apprentices withdrawn from a programme but still subject to claims for funding could be as high as 6%.

Purpose

The purpose of this one-off pilot is to allow SDS to further explore the extent of fraudulent behaviour within the SDS Modern Apprenticeship Programme.

The pilot will run for 12 months, commencing in approximately November 2023. HMRC will process, match and verify up to 40,000 individual apprentices and employment details to detect the level of fraud in funding of those participating in learning during the SDS 2023 to 2024 funding year (April 23 to March 24).

HMRC is the only organisation with data available to enable verification of both identity and employment status. SDS has identified HMRC PAYE and Self Assessment data as potentially useful as it is a condition that individuals on the Modern Apprenticeship Scheme must be employed, and individuals who are self-employed or a sole trader for an apprenticeship job role are ineligible for funding. The HMRC data could support SDS manage eligibility for its Modern Apprenticeship Programme; eligibility for on-going training related payment for apprentices; recovery of ineligible funds paid and support taking cases through to prosecution.

HMRC considers that the disclosure of information to SDS is necessary and proportionate to assist SDS in their role of processing funding applications and identifying any potential fraud.

Benefits of the exchange

Where HMRC data matching indicates potential fraud, SDS will revisit its counter fraud strategies and activities, with a view to introducing further prevention (deter, disable) controls in those areas and will take action to investigate and recover any funds claimed fraudulently.

Where HMRC data matching indicates alignment between HMRC and SDS data, this will be equally helpful to SDS. It will provide assurance to SDS that reliance can be placed on data provided by TPs in support of legitimate claims for payment under SDS Modern Apprenticeship Programme contracts.

The SDS HMRC data sharing pilot will enable SDS to:

• confirm the identity or existence of the apprentice and the validity of the National Insurance number (for example, apprentices are real and not fabricated)
• identify applicants who are eligible for programmes given their employment status – employed as a modern apprentice
• identify employers who have received funds for employees they no longer employ and repayment of all or part of the funds are due, for example, apprentice employer grant
• verify that apprentices are paid at least the apprentice National Minimum Wage by validation of apprentice HMRC registration
• only use SDS skills and training funds where eligibility conditions are met
• identify ineligible claims and take action to recover any payments made
• have robust evidence to investigate and take cases of fraud through to prosecution
• identify and follow up ‘red flags’ which may resolve problem areas early
• reduce time taken to check alternative but less reliable eligibility evidence, for example, that self-declarations are fully completed and follow-up validation of individual employees
• disable false claims by only processing claims where relevant eligibility or other criteria are validated by HMRC records
• increase the deterrence and detection of fraudulent claims
• reduce manual checking of data and hence save staff costs
• provide greater assurance on the robustness of data which is used by other public sector organisations such as HMRC or for statistical purposes

The broader benefits are:

• improved detecting and preventing fraudsters from claimed public money, which in turn provides confidence to the taxpayer that their tax payments are going to good use
• gives apprentices confidence that their training provider is a legitimate and legally compliant organisation
• ensures apprentices are paid at least apprentice National Minimum Wage by validation of apprentice registration
• provides public confidence in the Modern Apprenticeship Programme

Data controller

HMRC is the data controller and when the data has left HMRC and is received by SDS, SDS will be the data controller, using definitions as set out in the Data Protection Act 2018.

Data Protection Impact Assessment

A Data Protection Impact Assessment (DPIA) is required prior to the exchange proceeding.

HMRC DPIA reference number: 11834
Registered: 31 May 2023 Last reviewed: 30 October 2023

SDS DPIA reference number: DPIA/2022/7/153a Registered: 21 July 2022 Last reviewed: 31 October 2023

Records of Processing Activity

HMRC Records of Processing Activity (ROPA) is an inventory of all HMRC’s major processing activities involving personal data and is to be created or revised if setting up or reviewing an exchange.

Procedure

This is a one-off pilot data matching exercise, expected to be carried out in November 2023.

Data matching is carried out in accordance with the agreed Risk and Intelligence Service team quality assurance standards’ framework and only the most up to date information available to HMRC will be shared with SDS.

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

The number of records shared with HMRC, represents the number of apprentices that are actively undergoing training on the SDS Modern Apprenticeship Programme.

Data items provided from SDS to HMRC:

• apprentice forename
• apprentice middle name or initials
• apprentice surname
• apprentice National Insurance number
• apprentice date of birth
• apprentice address and postcode
• employer name
• employer address and postcode

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

Data items returned from HMRC to SDS:

• SDS: apprentice forename
• SDS: apprentice middle name or initials
• SDS: apprentice surname
• SDS: apprentice National Insurance number
• SDS: apprentice date of birth
• SDS: apprentice address and postcode
• SDS: employer name
• SDS: employer address and postcode
• overall match status – Yes/No indicator
• apprentice forename – returned match indicator Yes/No
• apprentice middle name or initial – returned match indicator Yes/No
• apprentice surname – returned match indicator Yes/No
• apprentice National Insurance number – returned match indicator Yes/No
• apprentice date of birth – returned match indicator Yes/No
• apprentice base address – returned match indicator Yes/No
• apprentice address and postcode – returned match indicator Yes/No
• currently shown as employed on HMRC records – Yes/No indicator – if yes, current employment start date, latest employment leaving date, PAYE data above taxable pay threshold for 2022 to 2023 tax year (£23,750) – Yes/No
• employer address including postcode matches that provided by SDS – Yes/No indicator
• is the customer currently registered as self-employed on HMRC records – Yes/No indicator
• self-employment income shown on HMRC records for 2022 to 2023 tax year – Yes/No indicator – if yes, self-employed income above threshold value of £10,000 for 2022 to 2023 – Yes/No indicator (SDS are interested in level of self-employed income above threshold of £10,000 as this may indicate a job role not relevant for apprenticeship funding
• self-employment correspondence address (including postcode) matches SDS apprentice address – Yes/No indicator

HMRC will not provide any data, other than the original SDS inbound data, for individuals where there is not an overall positive match. The data item ‘overall match status’ will be marked as ‘N’ indicator and all other columns will be blank.

Where data matching indicates alignment between HMRC and SDS data, it will provide assurance to SDS that reliance can be placed on data provided by training providers in support of legitimate claims for payments under SDS modern apprentice programme contracts.

Onward disclosure

SDS may only use the information supplied by HMRC for the purpose for which it is disclosed and may not onwardly disclose it without seeking HMRC consent.

However, it is acknowledged that if fraud is discovered, SDS may share relevant information with Police Scotland for the purposes of investigation.

SDS is not a prosecuting authority, and they rely on Police Scotland if they want to prosecute in a case where fraud has been proven. A determination would be made by SDS on a case-by-case basis, if a case is to be referred to Police Scotland.

Any referrals from SDS to Police Scotland will be conducted under separate legislation, article 9(2)g GDPR, for the purposes of prevention or detecting unlawful acts, to enable Police Scotland to take on the case and refer onto the Procurator Fiscal in Scotland for criminal prosecution.

HMRC have provided a ‘general consent’ for SDS to share relevant data with Police Scotland in acknowledgement of HMRC having an existing statutory basis under section 19 of Anti-terrorism, Crime and Security Act 2001 with which HMRC could supply the data directly to Police Scotland, allowing the onward disclosure from SDS to Police Scotland to be permissible under section 56 Digital Economy Act 2017 by virtue of section 59(2) DEA.

HMRC ‘general consent’ is only provided to share relevant data with Police Scotland for the purposes of fraud, and only for the duration of this pilot.

The pilot commences on sharing the data with HMRC. The pilot will last 12 months from that date. No HMRC data should be onward shared with Police Scotland after the pilot has concluded.

Data retention and storage

HMRC

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

Auto reminders in outlook are set by the Government Data Engineering Team (GovDET) analyst to delete the data as required after delivery.

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

SDS

All data received by SDS from HMRC will be destroyed by SDS 3 months after receipt from HMRC and within the duration of the pilot, unless it is informing an active counter fraud investigation and on agreement from both parties.

Access is limited to colleagues within the Data Sharing Team and GovDET and is managed through appropriate governance structures with access being provided as and when staff leave and, or start a role.

Data security

HMRC and SDS both agree to:

• move, process and destroy data securely and in line with the principles set out in HM Government Security Policy Framework, issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information
• only use it for the purpose that is has been disclosed for and ensure that only those with genuine business need to see the information will have access to it
• only keep it for the time it is needed, and then destroy it securely
• not onwardly disclose that information without the prior authorisation of HMRC
• comply with the requirements in the Security Policy Framework, and be prepared for and respond to security incidents and to report any data losses, wrongful disclosures or breaches of security relating to information
• mark information assets with the appropriate security classification and apply the appropriate baseline set of personnel, physical and information security controls that offer an appropriate level of protection against a typical threat profile as set out in Government Security Classifications, and in particular as set out in the annex of Security Controls Framework to the GSC

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

Freedom of Information requests

If a Freedom of Information (FOI) request relating to this information is made to SDS, the SDS FOI team will engage with HMRC’s FOI team regarding the potential impact of disclosure. However, any final decision on disclosure of SDS data will remain with SDS.

Assurance

In accordance with the review and assurance agreed, a Certificate of Review and Assurance (CoRA) must be completed by both departments for the DUA when the data share has completed.

Costs

There are no costs to SDS for this one-off pilot as there is a reciprocal sharing arrangement between HMRC and SDS for apprenticeship data.

Disputes

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

Signatures

This content has been withheld because of exemptions in the Freedom of Information Act 2000.