National Fraud Initiative privacy notice

How we’ll use your personal information at the Welsh Revenue Authority for the National Fraud Initiative (NFI).

Contents

We take part in the NFI, a data matching exercise that aims to highlight possible cases of error and fraud within the public sector.

In Wales, the NFI is coordinated by Audit Wales and nationally by the Cabinet Office (the Data Controller).

How it works

The NFI works by organisations supplying various sets of data from different information systems, in areas such as:

  • payroll
  • pensions
  • social housing
  • housing benefit
  • other state benefits
  • student awards
  • payments to suppliers
  • NHS exemptions
  • record of death

The data supplied is input to a secure database, designed to cross-match data items and identify:

  • potential fraud
  • inappropriate activity
  • erroneous payments

Data we submit

We submit datasets about our employees via a secure IT portal.

See Annex A for data fields we submit.

Lawful basis for processing

We’re required by law to protect the public funds we administer. We may share information provided with others responsible for auditing or administering public funds to prevent and detect fraud.

The UK GDPR lawful basis for processing is Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest.

Our public task is set out in sections s12(4) and s33 of the Tax Collection and Management (Wales) Act 2016, which describe our functions and the responsibility for public funds of the Accounting Officer.

Sharing data

The data we submit will be shared with the Cabinet Office for the data matching to take place. Cabinet Office shares the data as necessary to prevent and detect fraud with the Auditor General for Wales.

If data submitted by one participant matches with another, we'll share summary information with them.

The data matches are returned to participants in a series of reports. Matches are reviewed to determine if they’re significant and, if so, allow further investigations to be undertaken. Returned reports include:

  • individuals claiming benefits at more than one authority
  • individuals who are on payroll and also claiming benefit
  • individuals recorded on more than one payroll
  • failed asylum seekers or those not entitled to work in the UK
  • duplicate payments to suppliers

The report highlighting staff who are employed by more than one participant will also be used to demonstrate our duty of care to employees, to confirm that working hour limits contained within the Working Time Directive are not exceeded.

Data retention

When it's confirmed data submission to Cabinet Office is successful, we'll destroy the data extracts from our systems.

Cabinet Office will keep data in line with their Data Deletion Schedule. This is currently being revised following consultation and will be made available, via this document, when it’s published.

Your rights

When we process your personal data, you have the right to:

  • request information about how it’s processed
  • request a copy
  • request us to correct any inaccuracies without delay
  • request that any incomplete data is completed
  • request that your data is erased if we no longer need it

Sometimes, you also have the right to request that the processing of your personal data is restricted. For example, where accuracy is queried

Contacts

If you have any questions or concerns about how we process personal data, contact us:

Data Protection Officer

Welsh Revenue Authority
PO Box 108
Merthyr Tydfil
CF47 7DL

Rydym yn croesawu gohebiaeth yn Gymraeg / We welcome correspondence in Welsh.

On 3 April 2023, our postal address changed to: Welsh Revenue Authority, PO Box 108, Merthyr Tydfil, CF47 7DL.

We recommend using our online contact form to send us correspondence. If you have any questions, contact us.

You can also directly complain to the Information Commissioners Office (ICO). The ICO is the UK supervisory authority for data protection issues.

Information Commissioner’s Office Wales

Churchill House
17 Churchill Way
Cardiff
CF10 2HH

Telephone: 029 2067 8400 / 0303 123 1113

Rydym yn croesawu galwadau a gohebiaeth yn Gymraeg / We welcome calls and correspondence in Welsh.

Annex A: NFI Data Specifications

Payroll requirements

  • Data submitted should meet this data specification and include all field names listed.
  • Data should only be submitted via the Data File Upload (DFU) facility. This is now the only acceptable method to supply data. If another submission method is used our policy is to inform the Senior Responsible Officer/Director of Finance that data has been put at risk unnecessarily.
  • All payrolls (for example, monthly, weekly, and quarterly, members/councillors, schools, and teachers) should be provided. However, data should not be provided in respect of payrolls processed for other organisations on an agency basis unless:
    • this has been authorised by the organisation; and
    • the organisation has confirmed that a Privacy Notice has been issued.
  • Ensure a single file for each organisation is uploaded, for example, do not submit one file that merges Police, Fire and County Council employees.
  • Ensure that there’s only a single record for each employee, such as details for individual employees with more than one post should be merged into one record. For example, for employees with multiple posts ‘Gross pay to date’ and ‘Standard hours per week’ for each post should be added together to give aggregated totals for those 2 fields. Other fields such as ‘Date started’, ‘Sort code’ and ‘Bank account’ should be provided from the main (highest earnings) post.
  • Include current employees only.
Field name Data format Supporting notes
Employee reference number Character  
Employee post number Character Leave blank if not applicable.
Department Character Provide the Department where the employee works, for example, Social Services, Education. If this field contains a code, please provide a lookup table.
Title Character  
Gender Character  
Surname Character  
Forename(s) Character Please ensure you capture any middle name(s) or initial(s). You can provide this in a separate Middle name(s) or middle initial(s) field or in the ‘Forename(s)’ cell if preferred.
Middle name(s) or middle initial(s) Character  
Address line 1 Character  
Address line 2 Character  
Address line 3 Character  
Address line 4 Character  
Postcode Character  
Unique Property Reference Number (UPRN) Character This new field should significantly improve address matching.
Date of birth Date  
Home telephone number  Character  
Mobile telephone number Character  
Email address Character  
Passport number Character  
Date started Date  
Date left Date Included as an independent check that only current employees are included.
Leaver indicator Character Included as an independent check that only current employees are included.
National Insurance Number Character  
Full-time/part-time flag Character Insert ‘F’ for full time (employed for 30 or more hours per week), ‘P’ for part time (less than 30 hours a week) or ‘C’ for Casual/As and when employees.
Gross pay to date Numeric This should be gross pay to date NOT taxable pay to date for the 2018/2019 financial year up to date of extract. Do not submit a record if this field is zero.
Standard hours per week Numeric For example, 16 hours as 1600.
Date last paid Date  
Teacher flag Character Insert ‘T’ for a teacher.
Sort code Character 6 numeric characters in groups of 2 which may be separated by hyphens, for example, 20-4523.
Bank account Character Usually 8 numeric characters.
Building society roll number Character Building societies have a roll number where payments are disbursed to after being paid into a single account.

First published

1 October 2020

Last updated