Transparency data

Data Usage Agreement: Disclosure of information by HMRC to the Legal Aid Agency to reduce debt owed to the public sector

Published 30 April 2024

This Data Usage Agreement between HMRC and Legal Aid Agency was agreed and put in place in 2023.

1. Conditions of disclosure of information by HMRC

HM Revenue and Customs (HMRC) disclose information to the Legal Aid Agency (LAA) to reduce debt owed to the public sector.

1.1 Legal basis

HMRC disclose this information to the LAA by virtue of the legal basis section 48 of the Digital Economy Act 2017.

1.2 Purpose

The LAA provide civil and criminal legal aid and advice in England and Wales to help people deal with their legal problems. LAA works with solicitors, barristers and others to provide simple, timely and reliable access to legal aid for those whose life and liberty is at stake, where they face the loss of their home, domestic violence, or where their children may be taken into care.

Last year the LAA processed 400,000 legal aid applications with a spend of circa £1.7 billion, some of these costs will need to be repaid to the LAA. LAA will provide a sample of 1,400 to 2,700 untraceable and traceable debtors to HMRC and request HMRC PAYE and Self-Assessment data. This figure constitutes of 1,400 untraceable cases across crime (1,000) and civil (400) and a further 800 traceable debtors in crime which exclude those in prison or already in payment arrangements. LAA have included an extra 500 cases in the sample to better inform their strategies on those cases where they have run out of contact and enforcement options based on their current information.

This data will allow LAA to assess the viability of further collection and/or enforcement activity, for example to contact the debtor and notify them that LAA are aware of their employment/earnings status, and to encourage them to engage with agreeing a payment plan asking them to contact LAA within 14 days. LAA can also seek an attachment of earnings with the employer, or in the case of self-employed debtors a High Court Writ or Charge Order on business premises to recover the debt.

1.3 Benefits of the exchange

A list of the benefits to be achieved through the data share:

• quicker and more accurate decision making, by using structured and up to date data
• identifying vulnerable debtors and assure they are treated fairly
• ensuring that legal aid debt is assessed correctly on applicant’s financial status
• providing the ability to prioritise likely success of debt recovery, based on data available
• access to up-to-date data will enable LAA to prepare an attachment of earnings order for debt recovery
• efficiency saving of moving from paper to digital

There is no direct benefit to HMRC who are only supporting LAA with their functions in this pilot.

1.4 Data security

HMRC and LAA both agree to:

• move, process and destroy data securely for example in line with the principles set out in Government Security Policy Framework issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information
• only use it for the purposes that it has been disclosed for and ensure that only those with a genuine business need to see the information will have access to it
• only keep it for the time it is needed, and then destroy it securely
• not onwardly disclose that information without the prior authorisation of HMRC
• comply with the requirements in the Security Policy Framework, and be prepared for and respond to security incidents and to report any data losses, wrongful disclosures or breaches of security relating to information.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

• mark information assets with the appropriate security classification and apply the appropriate baseline set of personnel, physical and information security controls that offer an appropriate level of protection against a typical threat profile as set out in Government Security Classifications

HMRC is the data controller when HMRC processes the data, and it is within the HMRC environment. When the data has left HMRC and is received by LAA, then LAA will be the data controller.

1.5 Freedom of Information (FOI) requests

If an FOI request relating to this information is made to LAA, their FOI team will engage with HMRC’s FOI team regarding the potential impact of disclosure.

1.6 Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment is required prior to the exchange proceeding. DPIA reference number is 9980 (1 December 2022)

1.7 Records of Processing Activity (ROPA)

HMRC Records of Processing Activity (ROPA) is an inventory of all HMRC’s major processing activities involving personal data and is to be created or revised if setting up or reviewing an exchange.

1.8 Procedure

This is a one-off pilot data matching exercise. Data matching is carried out in accordance with the agreed Risk and Intelligence Service (RIS) team quality assurance standards framework and only the most up to date information available to HMRC will be shared with LAA.

A dataset of approximately 1,400 to 2,700 individuals will be transferred from LAA via Secure Data Exchange Service (SDES) to HMRC RIS Government Data Exchange Team (GovDET) in Microsoft Excel spreadsheet in January 2023.

LAA will provide the following data items to HMRC RIS GovDET:

• individual name
• individual date of birth (DoB)
• individual National Insurance number
• partner name (where applicable)
• partner DoB (where applicable)
• partner National Insurance number (where applicable)

The HMRC RIS GovDET analyst will download and save the received file from LAA.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

The RIS analyst will also provide a copy of the input data containing the above LAA provided data items via a secure Call Assessment Framework (CAF) to Benefits and Credits (B&C) to undertake B&C data matching and return the data back to GovDET so that RIS GovDET can return the full dataset to LAA.

Using Real Time Information (RTI) and Connect, HMRC RIS GovDET will match the full dataset from LAA. Where there is a confirmed match, HMRC will return data for these individuals as outlined below. If there are no positive matches, HMRC will confirm this in their response. HMRC RIS GovDET will populate an Excel spreadsheet with employment and self-employment information as outlined below.

RIS GovDET will provide the following data items:

• latest base address
• latest nominated address
• daytime telephone
• evening telephone
• mobile telephone
• employer name
• employer address
• start date
• leaving date
• payroll ID
• last payment date
• gross pay in period
• self-assessment business description
• self-assessment business address
• self-assessment phone number
• latest return year
• total income
• employment income
• state pension
• self-assessment net income
• trusts income
• UK property income
• foreign income
• life policy gains
• shares income
• other income
• business start date
• business end date
• pay Year to Date (YTD)
• tax YTD
• tax deducted or refunded
• payment date
• maternity pay
• total paternity pay
• adoption pay
• statutory bereavement pay
• partner latest base address
• partner latest nominated address
• partner daytime telephone
• partner evening telephone
• partner mobile telephone
• partner employer name
• partner employer address
• partner start date
• partner end date
• partner payroll ID
• partner last pay date
• partner gross pay
• partner self-assessment business description
• partner self-assessment business address
• partner self-assessment phone number
• partner latest return year
• partner total income
• partner employment income
• partner state pension
• partner self-employment net income
• partner trusts income
• partner UK property income
• partner foreign income
• partner life policy gains
• partner shares income
• partner other income
• partner business start date
• partner business end date
• partner pay YTD
• partner tax YTD
• partner tax deducted refunded
• partner payment date
• partner maternity pay
• partner paternity pay
• partner adoption pay
• partner statutory bereavement pay

Using the tax credits system B&C will match the LAA data to Tax Credits information as listed below and will return this to RIS GovDET via secure CAF transfer:

• entitlement
• Working Tax Credits (WTC) element
• partner entitlement
• partner WTC element

Upon receipt of the B&C matched data, the RIS GovDET analyst will combine the matched HMRC employment/self-employment data with the HMRC B&C matched Tax Credits data. The combined data will then be shared with LAA via SDES.

Along with the above list of matched data items the below original LAA data fields will be returned also:

• individual name
• individual DoB
• individual National Insurance number
• partner name (where applicable)
• partner DoB (where applicable)
• partner National Insurance number

1.9 Data retention and storage HMRC

HMRC RIS GovDET will download the data file received from LAA via SDES.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

It will be manually deleted by the GovDET analyst 6 months after delivery of the data (as per GovDET Team lead’s recommendation) to ensure there are no data quality issues or queries on the data received by LAA.

Auto reminders in outlook are set by the GovDET analyst to delete the data as required after delivery. As an added level of assurance, the data deletion is also recorded on a RIS GovDET General Data Protection Regulation (GDPR) tracker document which is an excel tool outlining all data sharing and what date the data is deleted. This is reviewed on a monthly basis by the Grade 7 RIS GovDET Team Lead and checks are undertaken that data is deleted on time.

In the event of an analyst being absent, the G7 will arrange for the deletion of the data. Once B&C have received the file via the secure CAF from RIS GovDET they will store the data.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

The input and outputs of the matched data will be held for 6 months after delivery of the data to address any potential data quality issues or queries on the data.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

B&C have a workbook which outlines all the data deletion dates which is manually checked by the G7 each month to ensure the data has been deleted according to the deletion schedule.

LAA Debt Recovery will keep the pilot data for a year to analyse before the data is deleted.

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

For specific individuals of interest in the data set, Debt Recovery will keep the specific data, as part of the case file, for seven years from the date of final bill payment or date when debt has been discharged, whichever is later.

LAA have advised that all LAA data for debt and fraud is hosted on Ministry of Justice (MoJ) IT infrastructure which is all on UK hosted servers. Some of MoJ data hosted via MoJ’s 3rd party IT provider is backed up in data centres in the EU, however, LAA have confirmed on 4 October 2022 that HMRC data will only be stored and backed-up in the UK.

1.10 Onward disclosure

LAA may share relevant information with Marston’s Holding Ltd to assist with debt recovery. Marston’s Holding Ltd have a contract with LAA and act on their behalf. LAA will carry out the analysis on the data but will inform Marston’s Holding Ltd of the subsequent next steps required in order to recoup the debt.

Marston Holdings LTD are a collections and enforcement agent working on behalf of the LAA. High level data from the HMRC pilot will be onwardly shared with Marston, only where LAA considers that the information will enhance collections capability or recovery strategies. Onward sharing of relevant HMRC data by LAA with Marston’s Holdings Ltd would be permissible under s48 DEA 2017 by virtue of s51(2) DEA 2017 as HMRC will give a ‘general consent’ for LAA sharing relevant data with Marston’s Collection only, and only for the purposes and duration of the pilot.

1.11 Certificate of Assurance (CoRA)

In accordance with the review and assurance agreed, a Certificate of Review and Assurance (CoRA) must be completed by both departments following the end of the pilot.

1.12 Disputes - HMRC and LAA

Any disputes relating to this information transfer should be reported to:

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.  

1.13 Costs

HMRC RIS GovDET will recharge LAA for the time taken to provide the data for this data share.

1.14 Signatures

  

This content has been withheld because of exemptions in the Freedom of Information Act 2000.