Data Usage Agreement: National Fraud Initiative - HMRC and local authority counter-fraud pilot 2
Published 19 October 2023
© Crown copyright 2023
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/national-fraud-initiative-hmrc-and-local-authority-counter-fraud-pilot-2/data-usage-agreement-national-fraud-initiative-hmrc-and-local-authority-counter-fraud-pilot-2
1. Conditions of disclosure of information by HMRC
HMRC discloses this information to Cabinet Office by virtue of section 56 of the Digital Economy Act - disclosure of information to combat fraud against the public sector.
Schedule 8 of the Digital Economy Act allows disclosure from HMRC to the Minister for the Cabinet Office as part of the National Fraud Initiative (NFI). The NFI is an exercise that matches electronic data within and between public sector bodies (in this case HMRC and Cabinet Office) to prevent and detect possible fraud and error risk. The NFI team legally reside within Cabinet Office.
The special category data processed by HMRC is processed by virtue of article 9(2)(g) of UK General Data Protection Regulation (GDPR) and section 10(3) the Data Protection Act (DPA) 2018 with reference to schedule 1, part 2, paragraph 6 of the DPA.
1.1 Purpose
NFI has already run a successful pilot matching, analysing and disclosing data held by HM Revenue and Customs (HMRC). Involving local councils in England, it has prevented/detected almost £10 million to date. The pilot was undertaken using Cabinet Office statutory data matching powers under the Local Audit and Accountability Act 2014 and the Digital Economy Act 2017.
Due to the successful nature of the first pilot, this proposal for a second tranche exercise aims to improve the effectiveness of the NFI by appending HMRC data, focused on household composition, household earnings and indicators of property ownership, to a subset of the NFI records from English and Welsh local authorities (4 datasets per local authority) and returning it to the Cabinet Office NFI. It is anticipated this 2nd tranche will achieve improved outcomes ranging between £16 million to £36 million. This data will be used for the purpose of identifying fraud and error and will then be used as a basis of investigation of fraud or error.
1.2 Benefits of the exchange
HMRC considers that the disclosure of information to the Cabinet Office is necessary and proportionate because we are assisting Cabinet Office in the detection and prevention of fraud and error within the public sector.
Cabinet Office have offered HMRC Acquisition access to the data they going to be producing, however at present HMRC do not have an internal customer. Therefore, there is currently no HMRC function apart from meeting the above strategic objectives.
The Cabinet Office anticipates benefits of:
- assisting local authorities to identify specific instances of fraud that they can investigate
- identifying potential improvements in the business processes of local authorities
- creating significant efficiencies through a single and standardised process that is combined with the expert counter-fraud analytics of the Cabinet Office NFI Team
- contributing significantly to the development of the NFI 5-year strategy
1.3 Procedure
The Cabinet Office NFI Team will share two samples, totalling 15 to 20 million data records containing personal data, with HMRC (a portion of this number will relate to the same individual more than once).
The first data sample will be available to HMRC from NFI in January 2021 and will be drawn from data sets relating to the following areas:
- housing tenancy
- council tax reduction scheme
- housing benefits
The second data sample will be available to HMRC from February/March 2021 and will be drawn from a data set relating to the following:
- Council Tax single person discount (CTSPD)
Local authorities provide the CTSPD file to the NFI at a later date than the rest of their data sets so that data set has to be provided to HMRC at a later date.
The areas specified for the data samples to be drawn from have been identified as areas containing higher specific fraud risks, such as:
- illegal subletting of a social housing property
- fraudulent claiming of council tax reduction
- composition of household not declared correctly in order to fraudulently claim benefits and/or services
- failure to declare property ownership
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
Household composition indicators consist of counts of individuals and their personal data, linked to a known address. Data fields selected are the minimum required to identify the customer and indicate with confidence whether there is a potential fraud or error risk for investigation.
Only confirmed matches will be returned by HMRC, data mismatches will not be returned. The matching is designed to flag scenarios that may indicate fraud or error. Therefore, the only information that is shared is when HMRC has identified potential risk.
Where a match is found, it indicates that there may be an inconsistency or circumstance that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out by the relevant department.
The data returned to NFI from HMRC will be held in a central file by NFI. Where the application of fraud risk analytics identifies there is a fraud or error issue for investigation, HMRC data will be split into separate sets of matches for each local authority. Local authorities will be provided with the matches via the accredited and access controlled NFI web application (under the Local Audit and Accountability Act 2014).
There is a hierarchy of users at local authorities starting with a senior responsible officer who will appoint a key contact. Individual users only have access to the matches that are relevant their role.
NFI will also share HMRC data with DWP about housing benefit claims administered by English and Welsh local authorities under the same process and route.
1.4 Categories of data and data specification
No special category data will be shared.
See Annex A for data specification from NFI to HMRC
See Annex B for return data specification from HMRC to NFI – this includes ‘title’ which could be considered as special category data as it could include religious titles. This data would not be used to make a significant decision about an individual; they would be considered as forms of address, and no inference should be drawn to religious beliefs.
Decisions relating to further investigation of potential fraud risks would be based on other data categories focussing on the areas containing higher risks such as:
- illegal subletting of a social housing property
- fraudulent claiming of council tax reduction
- composition of household not declared correctly in order to fraudulently claim benefits and/or services; or
- failure to declare property ownership
1.5 Frequency
This is a specific pilot approved by the Digital Economy Act Board, with the first data sample being delivered in July 2021 and the second data sample being delivered in August/September 2021. If the results achieved identify any further need for future shares, the Cabinet Office would need to make a further application to the DEA board and apply with a new data request application through the HMRC data sharing team. This would be impacted accordingly and set up as a new project and would need to be under a more strategic solution.
1.6 Method of transfer
NFI data is accessible to HMRC via the NFI secure web application platform. HMRC contact will use the NFI secure web application platform using a specified user account, username and password that shall not be shared with any other person.
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
The last accreditation was completed on 27 March 2020. NFI have provided HMRC with a copy of the NFI residual risk statement as at 8 July 2021, following their annual full health checks and penetration tests. The accreditation has not expired as there is no expiry date. The security and assurance of the NFI secure web application is maintained by way of monthly security working group meetings with cyber security and regular penetration tests.
HMRC will store the NFI data in a secure site with restricted access to members of the RIS team directly involved in the data share.
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
The NFI Team will then check the data for any issues, apply data analytics and produce matches for individual local authorities to access via the NFI secure web application using individual accounts.
1.7 Data retention
HMRC’s RIS Government Data Exchange Team will only retain data for a maximum of 6 months before deletion.
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
Cabinet Office will advise local authorities and DWP when the data will be deleted on the NFI secure web application. Local authorities and DWP are able to take local copies of the data for those cases that are pending further investigations or pending prosecution. They will only retain the data for a maximum of 6 years plus 1, unless it is being used for an open case, in which case once it is closed it is retained for 6 years plus 1 for compliance purposes.
1.8 Data protection legislation and Human Rights Act 1998
Data Protection Impact Assessment (DPIA) reference number: 8354 (13 July 2021)
All the information transferred by HMRC should be relevant, necessary and proportionate to enable the Cabinet Office to carry out their task or process.
HM Revenue and Customs and the Cabinet Office are public authorities for the purposes of section 6 of the Human Rights Act. It would be unlawful for HMRC and the Cabinet Office to act in a way that is incompatible with European convention on human rights.
1.9 Data security
HMRC and Cabinet Office agree to:
- move, process and destroy data securely, in line with the principles set out in HM government security policy framework, issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information
- only use it for the purposes that it has been disclosed for and ensure that only those with a genuine business need to see the information will have access to it
- only keep it for the time it is needed, and then destroy it securely
- not onwardly disclose that information without the prior authorisation of HMRC
- comply with the requirements in the security policy framework, and be prepared for and respond to security incidents and to report any data losses, wrongful disclosures or breaches of security relating to information
- mark information assets with the appropriate security classification and apply the appropriate baseline set of personnel, physical and information security controls that offer an appropriate level of protection against a typical threat profile as set out in government security classifications, and in particular as set out in the Annex – Security Controls Framework to the GSC
Cabinet Office is acting as the data controller until the data file is received by HMRC. HMRC will act as data controller whilst the data file is within its infrastructure, and HMRC information is extracted to generate the output file. Once the matched data is sent by HMRC and received by Cabinet Office, Cabinet Office will then become the data controller for the final output.
1.10 Freedom of information (FOI) requests
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
1.11 Costs and charges
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
1.12 Disputes
Any disputes and issues relating to this information transfer should be reported to the following:
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
1.13 Signatures
This content has been withheld because of exemptions in the Freedom of Information Act 2000.
2. Annex A – NFI to HMRC data specification
| NFI data specification | Field structure | Source | Field comments |
|---|---|---|---|
| Dataset type | XX | NFI | Housing Tenancy (HR), Council Tax Reduction Scheme (CTRS), Council Tax Single Person Discount (CTSPD), Housing Benefits (HB) |
| Unique reference | Numerical | NFI | Unique identifier - needs to be unique to each HB application, or housing tenancy claim |
| Individual reference | Numerical | NFI | A unique number per individual linked to the unique reference, for example, 1 = applicant/recipient, 2 = joint applicant/named tenant, 3 = second named tenant |
| Forename(s) | Character | NFI | |
| Surname | Character | NFI | |
| Date of Birth | Date (DD/MM/YYYY) | NFI | |
| National Insurance number | AA123456 | NFI | The National Insurance suffix is removed |
| Address line 1 | Character | NFI | |
| Address line 2 | Character | NFI | |
| Address line 3 | Character | NFI | |
| Address line 4 | Character | NFI | |
| Postcode | Postcode | NFI |
3. Annex B – HMRC to NFI data specification
| HMRC household composition | HMRC coding field references | Source | Field format | Comments |
|---|---|---|---|---|
| NFI dataset type | NFI | |||
| NFI unique identifier | NFI | |||
| HMRC address status | HMRC RIS | Latest address, previous address 1, previous address 2 | ||
| Individual matched to NFI Source Data Address? | HMRC RIS | Y/N | A flag to indicate if the individual was declared or undeclared in the NFI source data | |
| Latest base address | Latest base address | HMRC RIS | ||
| Latest base address postcode | Latest base address postcode | HMRC RIS | ||
| House of Multiple Occupancy flag | HMRC RIS | Y/N | To indicate if address is known House of Multiple Occupancy | |
| Alternative latest base address | Latest base address | HMRC RIS | ||
| Alternative latest base address postcode | Latest base address postcode | HMRC RIS | ||
| House of Multiple Occupancy Flag (alternate address) | HMRC RIS | Y/N | To indicate if address is known House of Multiple Occupancy | |
| Count of individuals | HMRC RIS | Numerical | Total number of individuals in the property | |
| Individual number | HMRC RIS | Numerical | The individual reference for the individuals in the property | |
| Individual in NFI source data? | HMRC RIS | Y/N | A flag to indicate if the individual was declared or undeclared in the NFI source data | |
| Title | HMRC RIS | Character | Mr, Mrs, etc. | |
| Current gender | HMRC RIS | M/F | ||
| Forename | HMRC RIS | Character | ||
| Second forename | HMRC RIS | Character | ||
| Surname | HMRC RIS | Character | ||
| Surname matches | HMRC RIS | 0/1 | If the surname of the individual matches to anyone in the NFI source data (by unique identifier) 0=N, 1=Y | |
| Surname mismatches | HMRC RIS | 0/1 | If the surname of the individual does not match anyone in the NFI source data (by unique identifier) 0=N, 1=Y |
| HMRC RTI - earnings information and sources | HMRC coding field references | Source | Field format | Comments |
|---|---|---|---|---|
| HMRC date of birth | HMRC date of birth | HMRC RIS | Date (DD/MM/YYYY) | |
| HMRC National Insurance number | HMRC National Insurance number | HMRC RIS | AA123456 | |
| Tax year | Tax year | HMRC | 20YY | 20YY - e.g. 2018 refers to the 2017/18 tax year |
| PAYE scheme | PAYE scheme reference | HMRC RIS | Text | |
| Starting declaration | HMRC RIS | A, B, C | A. this is their first job since the start of the tax year (6th April), B. this is currently their only job, C. they have another job or pension | |
| Employer name | Employer name | HMRC RIS | Text | |
| RTI start date | RTI start date | HMRC RIS | Date (DD/MM/YYYY) | For all current active employments |
| RTI leaving date | RTI leaving date | HMRC RIS | Date (DD/MM/YYYY) | For all current active employments |
| Number of normal hours worked | HMRC RIS | A, B, C, D, E | A. up to 15.99 hours, B. 16-23.99 hours, C. 24-29.99 hours, D. 30 hours or more, E. other | |
| RTI latest employment payment date | RTI latest employment payment date | HMRC RIS | Date (DD/MM/YYYY) | For all current active employments |
| Pay frequency | Pay frequency | HMRC RIS | Key | For all current active employments: W1 (weekly), W2 (fortnightly), W4 (4 weekly), M1 (calendar monthly), M3 (quarterly), M6 (bi-annually), MA (annually), IO (one-off), IR (irregular) |
| Pay in latest period | HMRS RIS | Value | For all current active employments | |
| Taxable pay in period | Taxable pay in period | HMRC RIS | Value | For all current active employments |
| Taxable pay year-to-date | Taxable pay year-to-date | HMRC RIS | Value | For all current active employments |
| Pay after statutory deductions | Pay after statutory deductions | HMRC RIS | Value | For all current active employments |
| Occupational pension | Occupational pension | HMRC RIS | Flag | Flag to indicate employment is an occupational pension (key for personal budgets) |
| Total income 1415 | Total income 1415 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total income 1516 | Total income 1516 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total income 1617 | Total income 1617 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total income 1718 | Total income 1718 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total RTI pay 1819 | Total RTI pay 1819 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total RTI pay 1920 | Total RTI pay 1920 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| Total RTI pay 2021 | Total RTI pay 2021 | HMRC RIS | Value | Total income for the individual in the specified tax year |
| HMRC Self Assessment | HMRC coding field references | Source | Field format |
|---|---|---|---|
| Self Assessment employment flag | Self Assessment employment flag | HMRC RIS | Y/N flag |
| Self Assessment self employment flag | Self Assessment self employment flag | HMRC RIS | Y/N flag |
| Self Assessment income | Self Assessment income | HMRC RIS | Value |
| SA100 - field 1 - employment | Self Assessment employment flag | HMRC RIS | Y/N Flag |
| SA100 - field 2 - self-employment | Self Assessment self-employment flag | HMRC RIS | Y/N Flag |
| SA100 - field 3 - Self Assessment partnership | Self Assessment partnership flag | HMRC RIS | Y/N Flag |
| SA100 - field 4 - income from UK property | Self Assessment property flag | HMRC RIS | Y/N Flag |
| SA100 - field 5 - foreign income | Self Assessment foreign income flag | HMRC RIS | Y/N Flag |
| SA100 - field 6 - trusts | Self Assessment trusts flag | HMRC RIS | Y/N Flag |
| SA100 - field 7 - Capital Gains | Self Assessment Capital Gains flag | HMRC RIS | Y/N Flag |
| SA100 - income - field 1 - taxed UK interest | taxed UK interest | HMRC RIS | Value |
| SA100 - income - field 2 - untaxed UK interest | untaxed UK interest | HMRC RIS | Value |
| SA100 - income - field 3 - untaxed foreign interest | untaxed foreign interest | HMRC RIS | Value |
| SA100 - income - field 4 - dividends from UK companies | UK company dividends | HMRC RIS | Value |
| SA100 - income - field 5 - other dividends | other dividends | HMRC RIS | Value |
| SA100 - income - field 6 - foreign dividends | foreign dividends | HMRC RIS | Value |
| HMRC property ownership indicators | Source | Field format | Comments |
|---|---|---|---|
| SA105 - UK property - field 1 - number of properties rented out | HMRC RIS | Numerical | |
| SA105 - UK property - field 5 - income – the amount of rent and any income for services provided to tenants | HMRC RIS | Value | This included furnished holiday lettings, real estate investment trust or property authorised investment funds |
| SA105 - UK property - field 20 - total rents and other income from property | HMRC RIS | Value | This doesn’t include furnished holiday lettings, real estate investment trust or property authorised investment funds dividends/distributions here |
| The number of properties in the land registry data held by the individual (current) | HMRC RIS | Numerical | A count to show the number of properties that the individual owns in the HMRC acquired land registry data |
| The individual has paid Stamp Duty Land Tax | HMRC RIS | Y/N | |
| Date of transaction | HMRC RIS | Date | Include all known dates for prototyping, we will scope the data range as part of the output fraud risk analysis for the December output |
| Value of the property | HMRC RIS | Value | |
| Address of the property that stamp duty was paid | HMRC RIS | Address format |