This notice tells you about how your personal information is processed in connection with the Auditor General for Wales’ data matching exercises, which include participation in the data matching exercises conducted by the National Fraud Initiative (NFI).

The data

The information to which data matching relates is personal information that you provide when:

• Making a claim or applying for:
  - personal budget/social care
  - pension
  - taxi driver licence
  - market trader licence
  - personal alcohol licence
  - social housing (current tenants and individuals on a housing waiting list)
  - right to buy (completed and in progress)
  - transport pass and permit
  - council tax reduction scheme
  - blue badge
  - state benefits, including universal credit and housing benefit
  - Covid-19 support payments or grants
• Seeking payment of an invoice from an organisation that takes part in the NFI. This is referred to as trade creditor standing and payment history data.
• Seeking payment for employment from an organisation that takes part in the NFI. This is referred to as payroll data.
• Registering to vote. This is referred to as Electoral Register data.

We also process information that you provide in relation to:

• Your council tax.
• Your business rates.
• Residents in a private care home supported by an organisation that takes part in the NFI.

Data specifications providing more information about the data we process in the above areas can be accessed on our website.

Criminal convictions

If data matching through the NFI results in a prosecution, then this may also be recorded by participating organisations.

Special categories of personal information

Some special categories of personal information (sensitive personal data) are included in the above.

Housing benefit and student loan data includes an indicator of physical or mental health or condition. This disability flag, which does not identify the specific condition, is required as disability has an impact upon a student’s entitlement to claim housing benefit.

The personal budget (direct payment) match uses data relating to individuals who have a specified range of social care needs because they have a particular disability.
We collect information on blue badge holders (and applicants). While we do not hold information on the medical condition that entitles the individual to a badge we do know who has a badge.

Where personal data have not been obtained from you, your personal data were obtained by us from participants including local authorities, police forces fire authorities, NHS bodies, the Welsh Government, the Wales Audit Office and some housing associations and Welsh government sponsored bodies.

This notice tells you about how your personal information is processed in connection with the Auditor General for Wales’ data matching exercises, which include participation in the data matching exercises conducted by the National Fraud Initiative (NFI).

Purpose

In accordance with statute, the Auditor General for Wales (the Auditor General) conducts data matching exercises to assist in the prevention and detection of fraud.

What is done with your data

Data matching involves comparing sets of data, which includes your data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. The data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

All bodies participating in the Auditor General’s data matching exercises receive a report of matches that they should investigate, to detect instances of fraud, over- or under- payments and other errors, to take remedial action and update their records accordingly.

Legal basis of processing

The processing of data (including special category data) by the Auditor General for Wales in a data matching exercise is carried out under his statutory powers in the Public Audit (Wales) Act 2004. It does not require the consent of the individuals concerned under data protection legislation.

In the case of sensitive personal data, it is processing which is necessary for reasons of substantial public interest for the exercise of a function of the Auditor General.
The legal basis for processing criminal convictions data is paragraphs 6 and 10 of schedule 1 to the Data Protection Act 2018.

Further information about the Auditor General’s powers is set out in the Code of Data Matching Practice [opens in new window].

Recipients

Your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud with equivalent audit bodies in Northern Ireland and Scotland, the Cabinet Office in England and the bodies who participate in data matching exercises on a mandatory or voluntary basis, such as local authorities and NHS bodies, central government departments and private sector organisations such as the Insurance Fraud Bureau and credit reference agencies.

Disclosures are made by the Auditor General in accordance with the relevant statutory provisions in sections 64D and 64E of the Public Audit (Wales) Act 2004.

We may share records containing personal data with HMRC. These will be matched against HMRC records and additional HMRC information appended and returned. The HMRC matching will seek to identify persons at the address provided and relevant income related information.

National Fraud Initiative (NFI)

Information about the NFI is set out on our website.

Retention

Your personal data will be kept by us for the periods set out in our Documents and Records Management Policy, and in relation to the NFI for the periods specified in the Cabinet Office Data deletion Schedule.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. You have the right to request that any inaccuracies in your personal data are rectified without delay. You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

The processing of your data is necessary for reasons of substantial public interest in the exercise of official authority vested in the Auditor General for Wales and other data matching controllers. You have the right to object to the processing of your personal data on grounds relating to your particular situation. If you object, we must demonstrate compelling legitimate grounds for the processing.

You have the right to complain directly to us about the handling of your personal data. Please email complaints@audit.wales 

Contact details

If you wish to discuss any objections or concerns, or obtain a copy of the current personal information held about you, please write to:

Data Protection Officer, Audit Wales, 1 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ or by email to infoofficer@audit.wales 

Any questions about data matching exercises should be addressed to: 

NFI Co-ordinator, Audit Wales, 1 Capital Quarter, Tyndall Street, Cardiff, CF10 4BZ or by email to National.Fraud@audit.wales 

The Information Commissioners Office

To obtain further information about data protection law or to complain to complain about how we are handling your personal data, you may contact the Information Commissioner online, by writing to: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or by telephone on: 0303 123 1113 (or 0330 414 6421 to speak in Welsh).

You should note, however, that the ICO would normally expect you to have exhausted our internal complaints procedures before dealing with a complaint. 

Further guidance may be found on the ICO’s website.