National Fraud Initiative privacy notice
How we’ll use your personal information at the Welsh Revenue Authority for the National Fraud Initiative (NFI).
Contents
We take part in the NFI, a data matching exercise that aims to highlight possible cases of error and fraud within the public sector.
In Wales, the NFI is coordinated by Audit Wales and nationally by the Cabinet Office (the Data Controller).
How it works
The NFI works by organisations supplying various sets of data from different information systems, in areas such as:
- payroll
- pensions
- social housing
- housing benefit
- other state benefits
- student awards
- payments to suppliers
- NHS exemptions
- record of death
The data supplied is input to a secure database, designed to cross-match data items and identify:
- potential fraud
- inappropriate activity
- erroneous payments
Data we submit
We submit datasets about our employees via a secure IT portal.
Lawful basis for processing
We’re required by law to protect the public funds we administer. We may share information provided with others responsible for auditing or administering public funds to prevent and detect fraud.
The UK GDPR lawful basis for processing is Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest.
Our public task is set out in sections s12(4) and s33 of the Tax Collection and Management (Wales) Act 2016, which describe our functions and the responsibility for public funds of the Accounting Officer.
Sharing data
The data we submit will be shared with the Cabinet Office for the data matching to take place. Cabinet Office shares the data as necessary to prevent and detect fraud with the Auditor General for Wales.
If data submitted by one participant matches with another, we'll share summary information with them.
The data matches are returned to participants in a series of reports. Matches are reviewed to determine if they’re significant and, if so, allow further investigations to be undertaken. Returned reports include:
- individuals claiming benefits at more than one authority
- individuals who are on payroll and also claiming benefit
- individuals recorded on more than one payroll
- failed asylum seekers or those not entitled to work in the UK
- duplicate payments to suppliers
The report highlighting staff who are employed by more than one participant will also be used to demonstrate our duty of care to employees, to confirm that working hour limits contained within the Working Time Directive are not exceeded.
Data retention
When it's confirmed data submission to Cabinet Office is successful, we'll destroy the data extracts from our systems.
Cabinet Office will keep data in line with their Data Deletion Schedule. This is currently being revised following consultation and will be made available, via this document, when it’s published.
Your rights
When we process your personal data, you have the right to:
- request information about how it’s processed
- request a copy
- request us to correct any inaccuracies without delay
- request that any incomplete data is completed
- request that your data is erased if we no longer need it
Sometimes, you also have the right to request that the processing of your personal data is restricted. For example, where accuracy is queried
Contacts
If you have any questions or concerns about how we process personal data, contact us:
Data Protection Officer
Welsh Revenue Authority
PO Box 108
Merthyr Tydfil
CF47 7DL
Email: data@wra.gov.wales
Rydym yn croesawu gohebiaeth yn Gymraeg / We welcome correspondence in Welsh.
You can also directly complain to the Information Commissioners Office (ICO). The ICO is the UK supervisory authority for data protection issues.
Information Commissioner’s Office Wales
Churchill House
17 Churchill Way
Cardiff
CF10 2HH
Telephone: 029 2067 8400 / 0303 123 1113
Email: casework@ico.org.uk
Rydym yn croesawu galwadau a gohebiaeth yn Gymraeg / We welcome calls and correspondence in Welsh.
Annex A: NFI Data Specifications
Payroll requirements
- Data submitted should meet this data specification and include all field names listed.
- Data should only be submitted via the Data File Upload (DFU) facility. This is now the only acceptable method to supply data. If another submission method is used our policy is to inform the Senior Responsible Officer/Director of Finance that data has been put at risk unnecessarily.
- All payrolls (for example, monthly, weekly, and quarterly, members/councillors, schools, and teachers) should be provided. However, data should not be provided in respect of payrolls processed for other organisations on an agency basis unless:
- this has been authorised by the organisation; and
- the organisation has confirmed that a Privacy Notice has been issued.
- Ensure a single file for each organisation is uploaded, for example, do not submit one file that merges Police, Fire and County Council employees.
- Ensure that there’s only a single record for each employee, such as details for individual employees with more than one post should be merged into one record. For example, for employees with multiple posts ‘Gross pay to date’ and ‘Standard hours per week’ for each post should be added together to give aggregated totals for those 2 fields. Other fields such as ‘Date started’, ‘Sort code’ and ‘Bank account’ should be provided from the main (highest earnings) post.
- Include current employees only.
| Field name | Data format | Supporting notes |
|---|---|---|
| Employee reference number | Character | |
| Employee post number | Character | Leave blank if not applicable. |
| Department | Character | Provide the Department where the employee works, for example, Social Services, Education. If this field contains a code, please provide a lookup table. |
| Title | Character | |
| Gender | Character | |
| Surname | Character | |
| Forename(s) | Character | Please ensure you capture any middle name(s) or initial(s). You can provide this in a separate Middle name(s) or middle initial(s) field or in the ‘Forename(s)’ cell if preferred. |
| Middle name(s) or middle initial(s) | Character | |
| Address line 1 | Character | |
| Address line 2 | Character | |
| Address line 3 | Character | |
| Address line 4 | Character | |
| Postcode | Character | |
| Unique Property Reference Number (UPRN) | Character | This new field should significantly improve address matching. |
| Date of birth | Date | |
| Home telephone number | Character | |
| Mobile telephone number | Character | |
| Email address | Character | |
| Passport number | Character | |
| Date started | Date | |
| Date left | Date | Included as an independent check that only current employees are included. |
| Leaver indicator | Character | Included as an independent check that only current employees are included. |
| National Insurance Number | Character | |
| Full-time/part-time flag | Character | Insert ‘F’ for full time (employed for 30 or more hours per week), ‘P’ for part time (less than 30 hours a week) or ‘C’ for Casual/As and when employees. |
| Gross pay to date | Numeric | This should be gross pay to date NOT taxable pay to date for the 2018/2019 financial year up to date of extract. Do not submit a record if this field is zero. |
| Standard hours per week | Numeric | For example, 16 hours as 1600. |
| Date last paid | Date | |
| Teacher flag | Character | Insert ‘T’ for a teacher. |
| Sort code | Character | 6 numeric characters in groups of 2 which may be separated by hyphens, for example, 20-4523. |
| Bank account | Character | Usually 8 numeric characters. |
| Building society roll number | Character | Building societies have a roll number where payments are disbursed to after being paid into a single account. |