Legislative Reform (Disclosure of Adult Social Care Data) Order 2025 - Explanatory document (HTML)
Published 21 May 2025
© Crown copyright 2025
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/legislative-reform-disclosure-of-adult-social-care-data-order-2025/legislative-reform-disclosure-of-adult-social-care-data-order-2025-explanatory-document-html
Presented to Parliament pursuant to Section 14 of the Legislative and Regulatory Reform Act 2006
Chapter One - Introduction and background to the Order
1. Introduction
1.1. This explanatory document is laid before Parliament in accordance with sections 1 and 3 of the Legislative and Regulatory Reform Act 2006 (“the LRRA 2006”) together with the draft of the Legislative Reform (Disclosure of Adult Social Care Data) Order 2025 (“the draft Order”) which we propose to make under section 1 of that Act.
2.Purpose of the Legislative Reform Order
2.1. The purpose of the draft Order is to amend the Local Audit and Accountability Act 2014 (“the LAAA 2014”) and the Public Audit (Wales) Act 2004 (“the PAWA 2004”) to enable the recommencement of the matching and sharing of adult social care data across local authorities in England and Wales[footnote 1] [footnote 2]
2.2. This will enable the National Fraud Initiative (NFI), a team within the Cabinet Office’s Public Sector Fraud Authority, to use this data in its data matching activities to identify and prevent fraud and error in the adult social care system. This will generate an estimated minimum impact of £4.6m in prevented fraud loss across the UK, over each two-year period.
2.3. Practically, the Order will amend paragraph 4 of Schedule 9 to the LAAA 2014 to add a provision that exempts matched “adult local authority social care” data from a restriction on disclosure. The draft Order will also amend an equivalent provision of Section 64D of the PAWA 2004 to ensure that the draft order has effect in Wales.
2.4. Adult social care data matching was previously undertaken by the NFI on behalf of local authorities, but ceased when an amendment to the NHS Act 2006 in 2016 meant that local authority social care data became aligned with ‘patient data’. This meant that the results of data matching using patient data could only be shared with ‘relevant NHS bodies’.
2.5. Local governments in England and Wales were not designated as relevant NHS bodies for the purpose of data sharing even though local governments hold the responsibility for the provision of social care. This consequence was wholly unintended.
2.6. Thus, the Order will address the legislative anomaly as a result of the NHS Act amendment, and once again allow the NFI to share matched adult social care data with local authorities.
2.7. A legislative reform order has been selected to enact this legislative change due to its primary function of amending primary legislation independently of a Parliamentary Bill to reduce burdens on public bodies. This Order will reduce financial and administrative burdens on local authorities by supporting them to prevent adult social care fraud and deliver financial savings. Further information is set out in Section 9 of this document.
3. Policy background
3.1. The premise of this amendment is to help protect and ensure the correct use of adult social care funding - assisting local authorities to fairly investigate and, if the outcome warrants, recover fraud and error so funding can be redirected for those who need it most. Without this amendment, fraud and error loss will persist and is expected to increase in the adult social care sector.
3.2. Fraud is a significant issue for adult social care in local authorities and the evidence supporting this is clear. In the CIPFA Fraud and Corruption Tracker Survey 2020, local authorities across the UK identified adult social care as one of their highest risk areas. CIPFA also estimates counter-fraud outcomes to be significant - with suggested savings at over £14m between 2014 and 2019[footnote 3] and £8.2m for 2019/20 alone. CIPFA also estimated that fraud within personal budgets alone was valued at an average of just under £7m between 2018-19 and 2019-20.
3.3. The King’s Fund also estimates that total expenditure on adult social care in England to be £27bn (2021/22), £2bn more than it was in 2010/11, indicating that there may be even more outcomes to be generated from data matching. From 2019/20 to 2020/21, the average weekly cost of residential and nursing care increased by 2.6% to £767 and has increased on average by 3% since 2015/16.[footnote 4]
3.4. At a macro-level, the 2022 PSFA Cross-Government Fraud Landscape report estimates that between 0.5% - 5% of all government spending is lost to fraud and error. When applied to total spending on adult social care in 2021/22 (£27bn), this suggests between £135m and £1.35bn could be lost to fraud and error. Even in the context of the £2bn increase in adult social care spending since 2010/11, this suggests between £10m and £50m could be lost to fraud and error.
3.5. Lastly, the evidence that local authorities want to resume NFI adult social care data matching, even prior to the consultation, is substantial. The 2022 NFI Survey highlighted that 78 of 84 (93%) local authority respondents across England, Scotland and Wales said there was a strong need for the NFI to provide adult social care data matching. Moreover, 93% also said that adult social care fraud was a major risk and 94% agreed that mandatory data matching would be valuable to their organisation.
3.6. Thus, at a time of significant funding pressures on local government and a need to prioritise those most vulnerable in our society, it is imperative that everything possible is done to minimise those who actively seek to commit fraud within adult social care.
National Fraud Initiative - Profile
3.7. The NFI, established in 1996, supports c.1,100 public and private sector organisations in enhancing their fraud response through the use of data and analytics. It works across the UK in partnership with Audit Wales, Audit Scotland and the Northern Ireland Audit Office.
3.8. The NFI specialises in data matching, using a range of products and data matching techniques to help detect and prevent fraud. The NFI’s cutting edge data tools help identify businesses and people trying to steal public money.
3.9. The NFI utilises legislative powers of voluntary and mandatory data collection, processing and disclosure for fraud, in the LAAA 2014 and devolved legislation.
3.10. Since its creation, the NFI has delivered cumulative savings of £2.4bn. Between April 2020 and March 2022 alone, £443m was prevented and detected/ recovered across the UK - the NFI’s best ever result.
3.11. Further information regarding the NFI, including the NFI’s National Reports, case studies, governance structures, data matching policies and statutory guidance, can be found at GOV.UK[footnote 5]
4. Legislative background
4.1. The draft Order will allow for the resumption of the sharing of matched adult social care data across local authorities in England and Wales. The draft Order will be enacted in exercise of the powers conferred by section 1 of the LRRA 2006.
4.2. Schedule 9 to the Local Audit and Accountability Act 2014 (c. 2) includes provision for the Secretary of State or the Minister for the Cabinet Office to carry out data matching exercises or to arrange for them to be done on his or her behalf. Paragraph 4 of Schedule 9 sets out the circumstances in which information (obtained for a data matching exercise and the result of any such exercise) may be disclosed by or on behalf of a Minister.
4.3. Section 64 of the Public Audit (Wales) Act 2004 (c. 23) includes provision for the Auditor General for Wales to conduct data matching exercises. The data matching functions of the Auditor General for Wales apply in or with respect to Wales. Section 64D sets out the circumstances in which information (obtained for a data matching exercise and the result of any such exercise) may be disclosed by or on behalf of the Auditor General for Wales.
4.4. This Order amends paragraph 4 of Schedule 9 to the Local Audit and Accountability Act 2014 and section 64D of the Public Audit (Wales) Act 2004 so that matched adult social care data can be shared with local authorities in England and Wales. The sharing of matched adult social care data to local authorities became prohibited as an unintended consequence of a 2016 amendment to the National Health Service Act 2006 (c. 41).
4.5. The term ‘adult social care data’ refers to data on adult social care services and spending, including care home support payments and personal budgets payments. In England, Scotland and Wales, it is collected by local authorities responsible for adult social care.
4.6. The sharing of matched adult social care data to local authorities became prohibited as a result of a 2016 amendment to the NHS Act 2006. In the amendment, Section 251 (12A) of the NHS Act 2006 (control of patient information) defined “medical purposes” as including social care services. Data that is held for “medical purposes”, and from which the individual can be identified, meets the definition of “patient data” under the LAAA 2014, and is subject to restrictions on disclosure.
4.7. As an unintended consequence of the amendment, local authorities’ adult social care data became defined as ‘patient data’ and, once matched, could therefore only be shared with ‘relevant NHS bodies’.
4.8. This effectively prevented the results of matched adult social care data from being shared with local authorities despite them being responsible for the delivery of adult social care as one of their core statutory functions.
4.9. The Welsh equivalent to LAAA, the PAWA 2004, also defines “patient data” by reference to section 251 of the NHS Act 2006. Thus, the PAWA 2004 is also affected by the unintended consequence of the 2016 amendment to the NHS Act. An equivalent amendment to the PAWA 2004 is made in the Order to exempt adult local authority care data from the definition of ‘patient data’.
4.10. Overall, the draft Order is intended to reverse that unintended consequence by amending the LAAA 2014, and PAWA 2004, to exempt adult local authority social care data from the restriction on the disclosure of data matching results that use ‘patient data’.
Chapter Two - Consultation and conclusion
5. Consultation process
5.1. The NFI issued a direct consultation to explore, and help inform, policy decisions on the usage of an Order to resume the sharing of adult social care data across local authorities in England, Scotland and Wales for the purposes of identifying and preventing fraud and error.
5.2. The consultation was conducted in accordance with, and fulfils the requirements of, Section 13 the Legislative and Regulatory Reform Act (LRRA) 2006 and the terms of Cabinet Office’s consultation principles.
5.3. The consultation was issued on the 19th October 2023 and closed on the 30th November at 11:59pm.
5.4. As the amendment relates to a technical legislative change, which would only impact local authorities historically involved in adult social care data matching, a direct consultation approach was sought.
5.5. This approach ensured the NFI could proportionally receive the views of all relevant local authorities, and other organisations that have a remit in the management of public data, adult social care provision, local government administration and/or countering public sector fraud.
5.6. For further information, Annex A sets out a list of all consultees, Annex B sets out the consultation response form and Annex C provides a consultation report which summarises the responses to each question.
Consultation structure
5.7. The intention of the legislative amendment was set out to consultees - insofar that it aimed to help protect and ensure the correct use of adult social care funding. Without this amendment, fraud and error loss will persist, and is anticipated to increase, in the adult social care sector.
5.8. The consultation also set out evidence as to why the government was considering this amendment. It highlighted several academic reports and sources[footnote 6] [footnote 7] which demonstrate that fraud is a significant issue for adult social care provision in local authorities and that it is one of their highest risk areas.
5.9. The evidence also demonstrated that counter fraud outcomes in this area would be significant - with savings estimated at over £14m between 2014 and 2019 and £8.2m for 2019/20 alone. This reinforced the historic evidence from when the NFI previously undertook adult social care data matching, achieving an average £4.6m in prevented fraud loss across the UK, over each two-year period.
5.10. The consultation set out historical case studies from local authorities which displayed the outcomes they achieved when they had been able to undertake adult social care data matching. It also highlighted the outcomes from NFI national surveys to local authorities, such as the 2022 survey. This showed that 78 of 84 (93%) local authorities said there was a strong need for the NFI to provide mandatory adult social care data matching.
5.11. The consultation highlighted how this legislative amendment satisfied the requirements of an LRO, as set out in the LRRA 2006. The consultation also discussed the analysis undertaken in regards to estimated costs and burdens on local authorities, as well as the due regard to the Public Sector Equality Duty from the Equality Act 2010 and environment principles as set out in the Environment Act 2021.
5.12. In order to provide their response, consultees were invited to complete a response survey. A privacy notice was set out in the response form, setting out how the responses and relevant data would be processed.
5.13. Consultees were also offered several ways in which to submit their responses, to ensure wider accessibility in providing views. This included: - completing the relevant survey form via a direct online link; or - completing, attaching and emailing a response form to nfiqueries@cabinetoffice.gov.uk; or - printing off, completing and then posting the response form to the NFI.
6. Summary and analysis of consultation responses
6.1. The NFI invited a total of 226 organisations to provide their views to the consultation proposal.
6.2. It was sent directly to all 207 local authorities in England, Wales and Scotland responsible for adult social care provision[footnote 8]. It was also sent to 19 relevant government departments, public bodies and independent organisations - all of whom have a remit in the management and security of public data, adult social care provision, local government administration and/or countering public sector fraud. The consultation was sent to the Information Commissioner’s Office (ICO), in accordance with the statutory requirement to consult the ICO under A‘article 36(4) GDPR in relation to a relevant legislative measure’, and thus this requirement has been fulfilled.
6.3. The NFI received 137 responses to the consultation, which equates to an overall response rate of 61%. Breaking this down, we received 129 responses from local authorities, representing a response rate of 62% amongst local authorities. We also received 8 responses from the other 19 organisations invited, representing a response rate of 42% amongst that group.
6.4. Breaking the local authority respondents down by country and region:
- 67 (out of 120) tier-one English local authorities responded, a response rate of 56%;
- 28 (out of 33) London Boroughs responded, a response rate of 85%;
- 19 (out of 32) Scottish authorities responded, a response rate of 59%; and
- 15 (out of 22) Welsh authorities responded, a response rate of 68%.
6.5. In order to provide their views, the survey was composed of ten specific questions, with an additional free text comment box for any further thoughts. The first four questions were specific only to local authorities, whereas all the following questions were relevant to all.
6.6. The questions sought views regarding if the resumption of adult social care data matching would benefit local authorities to tackle fraud and error, support local authorities to understand their fraud risks, if authorities currently undertook this form of data matching and if the amendment was proportionate and maintained data protections. It also provided an opportunity for organisations to provide any further views, considerations or general comments.
7. Conclusion outcome
7.1. As an average across all the responses received, and across all questions posed to consultees, 90% of the responses were supportive of the legislative proposal, only 1% disagreed with the legislative proposal with the remainder either giving a ‘neutral’ or ‘other’ response[footnote 9].
7.2. The responses have provided a strong rationale as to why this legislative proposal should be progressed - to help protect and ensure the correct use of adult social care funding.
7.3. The top-five findings from the consultation have been summarised below (Annex C sets out the full consultation report):
- 90% of 129 authorities strongly agreed/agreed they would benefit from receiving adult social data matching;
- One English local authority said: “Previously these NFI data sets were the highest in volume and highest in value of outcomes, enabling intervention by councils to stop debts increasing and correct a very large caseload. Please support local authorities with this effective anti-fraud measure of data matching. These data sets are also intrinsically linked to other benefits and this data should work together giving strength and assurance to our stretched budgets”.
- 91% of 129 authorities strongly agreed/agreed adult social care data matching would help them in understanding their overall fraud risks;
- As an example, one Welsh local authority said: “The adult social care data matches provided good intelligence in terms of identifying fraudulent or erroneous payments, the level of risk faced by the Council, and also on the level of assurance that can be placed on internal controls within our Social Care department. This additionality to assurance processes has been lost through the removal of the adult social care data matching. By reintroducing the matches, it would assist the Council in tackling fraud and error”.
- 88% of all 137 respondents strongly agreed/agreed that the proposal was proportionate;
- In demonstrating this, one English local authority said: “Lack of powers to investigate fraud within Adult Social Care is a major issue which can only be resolved through legislative changes. There is a real risk that matches will not progress due to this lack of power.”
- 82% of all 137 respondents saying that there was no other non-legislative alternative which would target this fraud better; and
- One local authority noted: “There are no non-legislative options that would do a better job than targeted data matching of various areas of adult social care.”
- 80% of all 137 respondents strongly agreed/agreed that the proposal will maintain patient data protections, with 15% neither agreeing or disagreeing.
- In demonstrating this, one English local authority said: “Private companies will not have the safe reputation, recognised and trusted protocols and security levels we have come to expect from NFI.
7.4. Some organisations also provided advisory recommendations to support the operational implementation activity of the Order and ensure that relevant data protections and privacy is considered and maintained. These responses have been considered in the government’s approach, for example:
- the Information Commissioner’s Office and the National Data Guardian for Health and Social Care highlighted that the reintroduction of adult social care data matching gives reason to review the NFI’s Code of Data Matching Practice[footnote 10]. This was suggested primarily to ensure the importance of the protections required for special category data are highlighted and that it will help organisations to ensure that they are transparent about the processing they will carry out, as part of NFI data matching activities. In response, the NFI will undertake a review of its Code to ensure that it is fit-for-purpose and reflective of the changes resulting from this legislative amendment. Individuals will be informed of the use of their data through a revised NFI privacy notice and revised local authority privacy notices ahead of any data sharing and processing commencing;
- the Local Government Association (LGA) recognised that local authorities will incur a small (£300), but unavoidable cost with the introduction of this data matching. In response, the NFI has undertaken a comprehensive Impact Assessment, as signed-off by the Cabinet Office Chief Economist - this can be found in Appendix A and has been laid in Parliament; and
- Audit Wales set out that solely amending the LAAA 2014 amendment on its own would not allow for the recommencement of adult social care data matching in Wales. This is because Welsh NHS bodies are separately defined in PAWA 2004. Therefore, Audit Wales suggested and endorsed an amendment to PAWA 2004. Audit Wales’ findings have been accepted and the Order now includes a provision to amend PAWA 2004.
7.5.Overall, the responses satisfy the primary policy objective in that it will assist local authorities to fairly investigate and, if the outcome warrants, recover fraud and error so funding can be redirected for those who need it most.
8. Conclusion and recommended parliamentary process
8.1. The Government has fulfilled the obligations to undertake an extensive consultation on the proposals. The responses to the consultation have been analysed. The Government has carefully considered feedback received at consultation and has decided to take forward the proposals.
8.2. In light of the consultation, the Government recommends that the draft Order and the Explanatory Document should be laid in Parliament under the affirmative resolution procedure. Although the Order is of limited impact and complexity, it does amend an Act of Parliament and Act of Senedd Cymru. Therefore, the Government thinks it appropriate to subject the Order to a level of scrutiny above that required by the negative resolution procedure. The Order is not wide-ranging or complex, so the super-affirmative procedure is unlikely to be appropriate.
8.3. The policy has been carefully considered as a result of full and open public consultation. The changes presented are a straightforward legislative reform which has widespread support from interested parties.
8.4. The government is laying before Parliament the documents required by section 14(1) of the LRRA. The Government is satisfied that the draft Order serves the purpose set out in section 1(2) of the LRRA, and that the conditions in section 3(2) are satisfied in relation to the draft Order.
Chapter Three - Analysis of ministerial responsibilities
9. Requirements of the Legislative and Regulatory Reform Act
9.1. This Order is made in accordance with section 1 of the Legislative and Regulatory Reform Act 2006 (LRRA). It will remove and reduce burdens in accordance with section 1(2) of the LRRA, namely financial burdens (section 1(3)(a)) and administrative inconveniences (section 1(3)(b)).
9.2. This Order will introduce an initial negligible financial burden, but that will be fully offset by the far greater financial savings in fraud prevention and recovery. For example, the biennial (two-yearly) fee for a local authority would be uplifted to cover the cost of additional social care data matching, by around £300. However, we expect outcomes as a result of resumed data sharing to be similar to previous years in which data sharing was mandated and each local authority made average savings of up to £25,000 in England, £17,000 in Scotland and £7,000 in Wales over a two-year period. Under the current legislation, there has been no mandate for data sharing and therefore no savings in tackling fraud in adult social care. So, resuming data sharing will represent a return on investment of circa 83:1 and demonstrates how overall financial burdens will be reduced as a result of the Order.
9.3. On Section 1 specifically, it is our contention that the draft Order would successfully remove those burdens for the following reasons:
(a) Local authorities have a responsibility to act on fraud to ensure that all public funds are being used efficiently and effectively. Based on previously reported outcomes for care home data alone, each local authority made average savings of up to £25,000 in England, £17,000 in Scotland and £7,000 in Wales over a two-year period. Therefore data matching would support reducing financial burdens on local authorities by helping recover money lost through fraud and error so that it can spent elsewhere;
(b) As all local authorities would be mandated, the extent of counter-fraud detection is likely to be much greater than where local authorities do not need, or are not required, to share data. Mandation means that all local authorities involved in the provision of adult social care would therefore have scope to benefit, both financially and through administrative convenience;
(c) The data processing would be likely to reduce obstacles to local authority efficiency through generating counter-fraud savings that would otherwise be lost to fraud. This would assist local authorities in understanding the fraud risks they face and ensure funds were directed back to vital social care services. Furthermore, the Order will also help support the productivity of local authority fraud investigation teams, as it will clearly indicate cases of suspected fraud and therefore allow them to tackle other, more complex cases of fraud.; and
(d) The change would reintroduce a service previously provided that local authorities found beneficial above the burden of self-sharing data (i.e. no local authorities have undertaken alternative voluntary data matching via the NFI to detect fraud in adult social care) and the paying of a small fee to cover processing costs.
9.4. The government considers that the conditions set out in section 3(2) and section 3(4) of the LRRA are satisfied for the reasons set out below.
Policy objectives could not be satisfactorily secured by non-legislative means (section 3(2)(a))
9.5. There are no non-legislative alternatives, such as a Memorandum of Understanding, that would achieve the intended outcome of the provision. Whilst data could be legally shared, it could only be done so on a voluntary or permissive basis. Under permissive data sharing, local authorities are unlikely to obtain the same scale of outcomes that are available from sharing and processing this data under the LAAA and through the NFI, due to a significantly smaller pool of data being available (e.g. only local authorities that voluntarily provide data, rather than nationally through mandation). In addition, the mandatory biennial National Exercise collects, processes and matches local authority data at a specific point in time to identify anomalies that indicate fraud. This enables relevant data to be shared and matched simultaneously between organisations, rather than across various time periods, which can increase the likelihood of inaccuracies. We would expect overall total outcomes from data matching undertaken on a discretionary basis by local authorities across England, Scotland and Wales to be uncertain and potentially minor compared to those achieved through Cabinet Office mandation encompassing all three nations.
9.6. Since the NFI stopped providing adult social care matches, no local authorities have to date undertaken alternative voluntary data matching via the NFI to detect fraud in adult social care.
9.6. The policy objective is to rectify an unintended consequence of an amendment to the NHS Act 2006 by a previous Act of Parliament and therefore could not be accomplished through a voluntary code of practice or improved guidance.
The effect of the provision is proportionate to the policy objective to be achieved (section 3(2)(b))
9.8. The effect of the provision is proportionate, as the proposed change allows local authorities to make efficiency savings and contributes to the wider counter-fraud agenda. The effect of the provision is limited, only amending LAAA and PAWA to facilitate the disclosure of matched local authority social care data to local authorities, but not removing adult social care data from the definition of “patient data”.
9.9. The LRO provisions would allow local authorities to obtain and access social care data matches. This is much more proportionate than alternative options (such as primary legislation), which would demand additional Parliamentary time and scrutiny and could lead to adult social care data no longer falling within the definition of “patient data” by reference to the relevant provisions of the NHS Act 2006, in order to allow local authorities to access and to process it.
The provisions of the proposed Order will strike a fair balance between the public interest and the interest of any person adversely affected by them (section 3(2)(c))
9.10. The provision would strike a fair balance as data matches from local authorities will assist fraud prevention, reduce the risk of harm to businesses and individuals, and ensure public funds are used effectively. Only those individuals who appear in a match which may indicate fraud would have their record shared for the purposes of further investigation, in line with data protection requirements. Participating bodies receive a report of matches which identify inconsistencies in the data held which may be indicative of fraud and which they should review, and investigate where appropriate. Where no match is found, the data matching process has no material impact on those concerned.
9.11. The proposal is also a restoration of the previous system that proved effective and did not adversely affect individuals. Through this work we are targeting fraud, but will also identify genuine errors (of which investigation is therefore carried out to determine intent). It is within the public interest to pursue such individuals/prevent fraud against the public sector.
The provisions do not remove any necessary protection (section 3(2)(d))
9.12. In terms of removing any necessary protections, the proposed change could potentially have some impact on individuals’ existing data protections (such as patient confidentiality of data) by allowing adult social care data to be collected and processed by the NFI and the resultant data matches shared with local authorities. The data protection risk in this instance, like any other aspect of data sharing, would be the risk of data loss as a result of error or criminal attack. However, the NFI’s data matching practices are extremely robust and are in compliance with data protection legislation. The National Fraud Initiative has been in secure operation since 1996, with no data breach issues in its history of operation.
9.13. The Order would not remove any protections provided for in wider data protection legislation (e.g. Data Protection Act 2018). The provision is in line with wider data protection restrictions on social care data as a special category data.
9.14. All protections would remain and would continue to be observed. The proposed change would be in line with the LAAA 2014 and devolved legislation requirements for patient data to be mandated and disclosed to certain relevant bodies, specified in the legislation. The proposed change would reflect the NHS Act 2006 provisions which have resulted in personal data held for the purposes of local authority social care falling within the definition of patient data and ensure the data is treated as such by the NFI and only disclosed to certain relevant bodies as specified in the legislation (to include patient data held for the purposes of local authority social care provided to adults being disclosed to a local authority). The effect of the provision is to return to the pre-2016 position, and DHSC have advised the implication of their amendment to the NHS Act on the LAAA was not policy intent.
The provisions of the proposed Order do not prevent a person exercising any right or freedom that they might reasonably expect to continue to exercise (section 3(2)(e))
9.15. The proposal would not prevent anyone from continuing to exercise any such right or freedom. Individual rights in relation to their social care data would remain protected and the change would be implemented in line with data protection requirements. Matched information would only be disclosed to local authorities with the aim to address criminal activity (i.e. preventing and detecting fraud), and only then to those bodies that are relevant and specified. Individuals would be able to be informed of the use of their data through a revised NFI privacy notice and revised local authority privacy notices ahead of any data sharing and processing commencing.
The provisions of the proposed Order are not constitutionally significant (section 3(2)(f))
9.16. The proposed amendment would not deliver significant constitutional reform and would instead amend a legislative oversight to re-adopt previous fraud prevention practices that local governments are strongly in favour of.
The provision would not restate an enactment (section 3(3))
9.17. The draft Order is not intended to restate any existing enactment, therefore it does not need to demonstrate that the provision would make the law more accessible or easily understood.
9.18. The government is also satisfied that the restrictions set out in sections four to eight of the LRRA 2006 are satisfied, namely that the draft Order does not:
- Confer of transfer any function of legislating on anyone other than those listed;
- Impose, abolish or vary taxation;
- Create a new criminal offence or increase the penalty for an existing offence so that it is punishable above certain limits;
- Authorise forcible entry, search or seizure, or compel the giving of evidence;
- Amend or repeal any provision of Part One of the LRRA 2006; or
- Amend or repeal any provision of the Human Rights Act 1998.
10. Extent and Territorial Application
10.1. The Order will apply only to England and Wales. In England, the Order will apply to all local authorities that undertake the adult social care provision i.e. all Metropolitan, Unitary and London Borough authorities and, where there is a two-tier system of local government, it will apply to the upper tier authority undertaking adult social care.
10.2. In Wales, this means all local authorities as the local government system is comprised of unitary authorities only. The amendment relates to a reserved matter, so Senedd consent is not strictly necessary to amend the relevant Welsh legislation (PAWA). However, the Cabinet Office believes that it would be desirable to receive Senedd consent for the Order, as it will amend primary legislation within the Senedd’s legislative competence. The Welsh Government has been consulted and agreed to lay a Statutory Instrument Consent Memorandum (SICM) in order to obtain the consent of the Senedd to the Order. The SICM should be laid in the Welsh Senedd no later than three days after the Order is laid before the UK Parliament. The Welsh Government has been consulted and is undertaking steps to lay a corresponding SICM in the Senedd.
Guidance
10.3. Data matching generated by the NFI is bound by statutory guidance through a Code of Data Matching Practice[footnote 11], which explains the process and gives guidance to persons and bodies involved in data matching exercises.
10.4. Ahead of the implementation of the draft Order, this Code will be updated to reflect the recommencement of adult social care data matching. Relevant stakeholders will also be informed of the use of their data through revised, published NFI privacy notices and revised local authority privacy notices.
11. Impact Assessment
11.1. An impact assessment was undertaken to assess the effects of the draft Order.
11.2. The total net present value is £19.5m, over a ten-year period across the UK. The net annual costs for each local authority would only be £300 over a two-year period (the estimated cost of two datasets - the average amount used to identify adult social care fraud and error when it was previously undertaken by local authorities). As the draft Order concerns local authorities, there is no net cost to businesses.
11.3. In consideration of the potential impacts on businesses and charity/voluntary bodies, it is the conclusion that this measure has no impact on business, voluntary, charity and/or community bodies due to the nature of this measure only affecting local authorities.
11.4. The impact assessment has been published alongside this document for publication (see Appendix A).
12. Public Sector Equality Duty and other legislative and non-legislative considerations
12.1. The Public Sector Equality Duty[footnote 12] ensures that public bodies have due regard to the need to achieve the objectives set out under s149 of the Equality Act 2010 in carrying out their functions.
12.2. The government has considered our public sector equality duty to be in adherence with the Equality Act 2010 and do not consider that this policy will have a significantly adverse impact on those with protected characteristics.
12.3. Whilst adult social care is an area used proportionately more by those who are older and/or with a disability (i.e. those in need of adult social care support), the outcome of the draft Order (i.e. data matching to detect fraud and error) will only affect individuals committing fraudulent acts - who can be of any characteristic, both protected and otherwise. Recovery of money lost through fraud and error in adult social care spending could also benefit those with protected characteristics in legitimate receipt of adult social care provision by a local authority, as any recovered money could be put back into essential services.
12.4. The Environment Act 2021 includes measures designed to protect and improve the natural environment in the UK. Section 19 places a duty on Ministers of the Crown to have due regard to the environmental principles policy statement when making policy, including proposals that lead to legislation. Each of the five environmental principles[footnote 13] associated with the Environment Act 2021 has been considered and it is concluded that this policy will not have an adverse impact on the natural environment in the UK - in that it does not have any interaction with it.
12.5. The Caldicott Principles[footnote 14] are eight principles that provide guidelines for using and keeping safe people’s health and care data. Whilst the relevant matched NFI adult social care data is not for the provision of health and social care services, we consider that adherence to this guidance is still good practice. Each principle has been considered and we consider that the Order, the impact of the Order and the ongoing operation of the NFI’s activities in regards to adult social care data matching adheres to the principles.
13. Monitoring and review
13.1. The impact of the draft Order, specifically the financial costs and benefits, will be monitored through the NFI’s routine benefits realisation process across the NFI’s biennial National Exercise and other non-mandatory products (e.g. FraudHub, AppCheck and ReCheck). This involves working with local authorities (and other organisations) who provide data that demonstrates specific benefits.
13.2. All benefits demonstrated are subject to auditing by the Government Internal Audit Agency. Once concluded, the NFI produces a biennial public report, summarising cumulative savings, broken down into categories, over that period. Adult social care data would be one of these categories once implemented. Thus, this will be a significant part of the evaluation methodology and process.
13.3. Further monitoring will come from user-feedback once the draft order has been implemented. The NFI’s subsequent national surveys to local authorities will include questions to ensure the changes as a result of the draft Order are meeting user-expectations as intended.
13.4. There is no need to include a review clause as this instrument amends primary legislation.
14. European Convention on Human Rights
14.1. The Minister of State at the Cabinet Office has made the following statement regarding Human Rights:
“In my view, the provisions of The Legislative Reform (Disclosure of Adult Social Care Data) Order 2025 are compatible with the Convention rights.”
15. Contact
15.1. The National Fraud Initiative within the Cabinet Office, Public Sector Fraud Authority, email: nfiqueries@cabinetoffice.gov.uk, can answer any queries regarding the Order.
Annex A - List of Consultees
All Local Authorities (207 in total, broken down by nation or region):
| Scotland - provided a response |
|---|
| Aberdeen City Council |
| Aberdeenshire Council |
| Angus Council |
| Argyll and Bute Council |
| Dundee City Council |
| East Ayrshire Council |
| East Dunbartonshire Council |
| East Renfrewshire Council |
| City of Edinburgh |
| Falkirk Council |
| Fife Council |
| North Lanarkshire Council |
| Orkney Isles Council |
| Renfrewshire Council |
| Shetland Isles Council |
| South Lanarkshire Council |
| Stirling Council |
| West Lothian Council |
| Scotland - provided a response, but after the deadline |
|---|
| Glasgow City Council (submitted 1st December) |
| Scotland - did not provide a response |
|---|
| Clackmannanshire Council |
| Comhairle nan Eilean Siar |
| Dumfries & Galloway Council |
| East Lothian Council |
| Highland Council |
| Inverclyde Council |
| Midlothian Council |
| Moray Council |
| North Ayrshire Council |
| Perth & Kinross Council |
| Scottish Borders Council |
| South Ayrshire Council |
| West Dunbartonshire Council |
| Wales - provided a response |
|---|
| Bridgend County Borough Council |
| Caerphilly County Borough Council |
| Cardiff County Council |
| Ceredigion County Council |
| Conwy County Borough Council |
| Isle of Anglesey County Council |
| Merthyr Tydfil County Borough Council |
| Monmouthshire County Council |
| Newport City Council |
| Pembrokeshire County Council |
| Powys County Council |
| Rhondda Cynon Taff County Borough |
| Torfaen County Borough Council |
| Vale of Glamorgan Council |
| Wrexham County Borough Council |
| Wales - did not provide a response |
|---|
| Blaenau Gwent County Borough Council |
| Carmarthenshire County Council |
| Denbighshire County Council |
| Flintshire County Council |
| Gwynedd Council |
| Neath Port Talbot County Borough Council |
| Swansea |
| England - London - provided a response |
|---|
| City of London |
| London Borough of Barnet |
| London Borough of Bexley |
| London Borough of Brent |
| London Borough of Bromley |
| London Borough of Camden |
| London Borough of Croydon |
| London Borough of Ealing |
| London Borough of Enfield |
| Royal Borough of Greenwich |
| London Borough of Hackney |
| London Borough of Hammersmith & Fulham |
| London Borough of Haringey |
| London Borough of Harrow |
| London Borough of Hillingdon |
| London Borough of Hounslow |
| London Borough of Islington |
| Royal Borough of Kensington & Chelsea |
| Royal Borough of Kingston upon Thames |
| London Borough of Lambeth |
| London Borough of Lewisham |
| London Borough of Merton |
| London Borough of Newham |
| London Borough of Redbridge |
| London Borough of Richmond upon Thames |
| London Borough of Sutton |
| London Borough of Tower Hamlets |
| London Borough of Wandsworth |
| City of Westminster |
| England - London - did not provide a response |
|---|
| London Borough of Barking & Dagenham |
| London Borough of Havering |
| London Borough of Southwark |
| London Borough of Waltham Forest |
| City of Westminster |
Rest of England
| County - provided a response |
|---|
| Derbyshire County Council |
| Essex County Council |
| Gloucestershire County Council |
| Hampshire County Council |
| Hertfordshire County Council |
| Kent County Council |
| Leicestershire County Council |
| Lincolnshire County Council |
| Norfolk County Council |
| Nottinghamshire County Council |
| Oxfordshire County Council |
| Staffordshire County Council |
| Suffolk County Council |
| Surrey County Council |
| Warwickshire County Council |
| West Sussex County Council |
| Worcestershire County Council |
| County - did not provide a response |
|---|
| Cambridgeshire County Council |
| Devon County Council |
| East Sussex County Council |
| Lancashire County Council |
| Metropolitan - provided a response |
|---|
| Birmingham City |
| Bury |
| Calderdale |
| Doncaster |
| Dudley |
| Knowsley |
| Leeds City Council |
| Manchester City Council |
| Oldham |
| Rotherham |
| City of Salford |
| Sandwell |
| Solihull |
| St Helens |
| Stockport |
| Sunderland City Council |
| Trafford |
| Wakefield |
| Wigan |
| Wirral |
| Metropolitan - did not provide a response |
|---|
| Barnsley |
| Bolton |
| Bradford |
| Coventry City |
| Gateshead |
| Kirklees Borough Council |
| Liverpool City Council |
| Newcastle City Council |
| North Tyneside |
| Rochdale |
| Sefton |
| Sheffield City Council |
| South Tyneside |
| Tameside |
| Walsall |
| Wolverhampton City Council |
| Unitary - provided a response |
|---|
| Bath & North East Somerset |
| Bournemouth, Christchurch and Poole |
| Brighton & Hove City Council |
| Bristol City Council |
| Central Bedfordshire |
| Cheshire West & Chester |
| Cornwall |
| Durham County Council |
| Isle of Wight Council |
| Medway |
| Middlesbrough Borough Council |
| Milton Keynes |
| North Yorkshire |
| Plymouth City Council |
| Reading Borough Council |
| Redcar & Cleveland Borough Council |
| Rutland County Council |
| Shropshire Council |
| Slough Borough Council |
| South Gloucestershire |
| Southend on Sea |
| Stoke on Trent City Council |
| Telford & Wrekin |
| Thurrock |
| Torbay |
| Warrington Borough Council |
| West Northamptonshire |
| Wiltshire |
| Wokingham |
| City of York |
| Unitary - did not provide a response |
|---|
| Bedford |
| Blackburn with Darwen |
| Blackpool |
| Bracknell Forest |
| Buckinghamshire Council |
| Cheshire East |
| Cumberland |
| Darlington |
| Derby City Council |
| Dorset Council |
| East Riding of Yorkshire Council |
| Halton Borough Council |
| Hartlepool Borough Council |
| Herefordshire Council |
| Hull City Council |
| Isles of Scilly (sui generis unitary) |
| Leicester City |
| Luton |
| North East Lincolnshire |
| North Lincolnshire |
| North Northamptonshire |
| North Somerset |
| Northumberland Council |
| Nottingham City Council |
| Peterborough City Council |
| Portsmouth City Council |
| Somerset |
| Southampton |
| Stockton on Tees Borough Council |
| Swindon Borough Council |
| West Berkshire |
| Westmorland and Furness |
| Royal Borough of Windsor & Maidenhead |
All other organisations, broken down by organisation type (19 in total):
| Government Departments - provided a response |
|---|
| Department for Work and Pensions |
| His Majesty’s Treasury |
| Government Departments - did not provide a response |
|---|
| Department for Health and Social Care |
| Department for Levelling Up, Housing and Communities |
| Cabinet Office (Central Digital and Data Office) |
| Wales Office |
| Scotland Office |
| Public bodies - provided a response |
|---|
| Information Commissioner’s Office (ICO) |
| Audit Wales |
| Audit Scotland |
| Northern Ireland Audit Office |
| Public bodies : provided a response, but after the deadline |
|---|
| National Data Guardian (submitted 4th December) |
| Public bodies - did not provide a response |
|---|
| NHS Counter Fraud Authority |
| Independent organisations - provided a response |
|---|
| Local Government Association (LGA) |
| Independent organisations - did not provide a response |
|---|
| Chartered Institute of Public Finance and Accountancy (CIPFA) |
| Welsh Local Government Association (WLGA) |
| Convention of Scottish Local Authorities (COSLA) |
| Fraud Advisory Panel |
| National Care Forum |
Annex B - Consultation response form
1. To ensure accessibility, there are a number of methods in which to submit your responses to the consultation questions below. These include :
a. Please complete a relevant Google Form which can be accessed by clicking this link here; or
b. Please complete, attach and email your Response Form to: nfiqueries@cabinetoffice.gov.uk; or
c. Please print off, complete and then post your Response Form to:
National Fraud Initiative,
Cabinet Office, Benton Park View,
Benton Park View, BP3302,
Newcastle Upon Tyne
NE98 1ZZ
2. Please enter your responses into the blank space underneath each question (or on a separate piece of paper) and provide your relevant respondent details in-case we need to contact you :
- Name (Optional):
- Organisation:
- Address:
- Email:
Questions
| Question Number | Question |
|---|---|
| Q1 | If the Cabinet Office were to re-commence adult social care data matching for local authorities, would your authority benefit from receiving NFI data matches relating to adult social care which may lead to counter fraud savings? |
| Q2 | Would the re-commencement of adult social care data matching assist your authority to better understand the overall fraud risks that you face? |
| Q3 | Does your authority currently voluntarily undertake any data matching exercises for adult social care to detect financial fraud with other local authorities? |
| Q4 | Which datasets and organisations would your authority consider it as valuable to match data against? |
| Q5 | Does the NFI’s UK-wide data matching service (with a small mandated fee for local authorities) support financial efficiency through the potential generation of savings? |
| Q6 | Do you consider that there would be any individuals adversely impacted by the data matching (other than those committing fraudulent acts)? Is the public interest fairly balanced against the interest of the individual? |
| Q7 | Would the recommencement of adult social care data matching be a proportionate action as a means to help tackle fraud in adult social care? |
| Q8 | Is the proposal a proportionate one that delivers a benefit whilst maintaining patient data protections? |
| Q9 | Are there any non-legislative means that would satisfactorily remedy the issue which the proposals intend to address? |
| Q10 | Do you have any further views regarding the expected outcomes of the proposals outlined in this consultation document? |
If you have any additional comments beyond those provided in the above questions, please provide them below.
Annex C - Consultation Summary Report
Summary and analysis of consultation responses
1. The NFI invited a total of 226 organisations to provide their views to the consultation proposal.
2. It was sent directly to all 207 local authorities in England, Wales and Scotland responsible for adult social care provision[footnote 15]. It was also sent to 19 relevant government departments, public bodies and independent organisations - all of whom have a remit in the management and security of public data, adult social care provision, local government administration and/or countering public sector fraud.
3. The NFI received 137 responses to the consultation, which equates to an overall response rate of 61%. Breaking this down, we received 129 responses from local authorities, representing a response rate of 62% amongst local authorities. We also received 8 responses from the other 19 organisations invited, representing a response rate of 42% amongst that group.
4. Breaking the local authority respondents down by country and region:
a. 67 (out of 120) tier-one English local authorities responded, a response rate of 56%;
b. 28 (out of 33) London Boroughs responded, a response rate of 85%;
c. 19 (out of 32) Scottish authorities responded, a response rate of 59%; and
d. 15 (out of 22) Welsh authorities responded, a response rate of 68%.
5. In order to provide their views, the survey was composed of ten specific questions, with an additional free text comment box for any further thoughts. The first four questions were specific only to local authorities, whereas all the following questions were relevant to all.
6. The consultation sought views regarding if the resumption of adult social care data matching would benefit local authorities to tackle fraud and error, support local authorities to understand their fraud risks, if authorities currently undertook this form of data matching and if the amendment was proportionate and maintained data protections. It also provided an opportunity for organisations to provide any further views, considerations or general comments.
Summary conclusion
7. After consideration of all the views provided to this consultation, we recommend that we proceed with implementing a Legislative Reform Order (LRO) to recommence adult social care data matching.
8. As an average[footnote 16] across all the responses received, and across all questions posed to consultees, 90% of the responses were supportive of the legislative proposal, only 1% disagreed with the legislative proposal with the remainder either giving a ‘neutral’ or ‘other’ response.
9. The overall responses have provided a strong rationale as to why this legislative proposal is demanded - to help protect and ensure the correct use of adult social care funding. The responses highlight that it will assist local authorities to fairly investigate and, if the outcome warrants, recover fraud and error so funding can be redirected for those who need it most.
10. Several organisations, such as the Information Commissioner’s Office (ICO), the National Data Guardian for Health and Social Care (NDG), Audit Wales and the Local Government Association also provided responses to the consultation. These responses, alongside some other local authority responses, provided suggestions to support the implementation of the LRO. These suggestions, and how they have been taken into account, is covered in the ‘further considerations’ section (paragraphs 77-90).
Responses broken down by question
11. A summary of the responses, and the conclusions that can be drawn from them, to each question has been set out below. Where relevant, we have anonymously drawn on specific comments made by an organisation.
Question One - My local authority would benefit from receiving NFI data matches in relation to recommencement of adult social data matching.
Figure 1.1
| Strongly agree | 56.5% |
| Agree | 33.3% |
| Neither agree nor disagree | 6.2% |
| Other | 3.1% |
12. Of the 129 responses to this question, 73 ‘strongly agreed’, 43 ‘agreed’, eight ‘neither agreed nor disagreed’, one ‘strongly disagreed’ and four responded with ‘other’.
13. This shows that 90% of local authority respondents strongly agreed/agreed that they would benefit from receiving adult social care data matching. This is a strong indicator of the enthusiasm local authorities have for recommencing adult social care data matching, and the benefits it will generate, for the purposes of detecting potential fraud or error. To highlight this, three local authorities from Scotland and England said the following respectively:
“I believe that it is imperative that the data matching of social care data is recommended at the earliest available opportunity”.
“Previously these NFI data sets were the highest in volume and highest in value of outcomes, enabling intervention by councils to stop debts increasing and correct a very large case caseload. Please support local authorities with this effective anti-fraud measure of data matching. These data sets are also intrinsically linked to other benefits and this data should work together giving strength and assurance to our stretched budgets”.
“We’ve identified significant savings and recoveries from matching deceased persons to residential care home residents, over £100k in one year”.
14. The one ‘strongly disagree’ response, from a local authority in Wales, said the reason for their response is because they have the ability to receive some relevant data on deceased individuals via registrars, rather than being opposed to the amendment and the benefits it can generate. Of the 12 respondents who said ‘neither agree nor disagree’ or ‘other’, the main theme as to why they responded with this was because they felt the extent of benefits from resuming adult social care data matching factored on which other datasets (eg, council tax, deceased records) it would be matched against.
15. In response to these views, local authorities may voluntarily match certain relevant national datasets, such as deceased persons data, to their own data and/or may share and match certain social care datasets with each other under the provisions in the Digital Economy Act 2017. However, historical evidence shows that sharing and matching in this way would result in suboptimal outcomes compared to a national, centralised approach, based on use of the NFI data matching framework and existing datasets. The strong views from other local authorities suggests this. In addition, figure 1.3 (question three) also shows how infrequently, if at all, local authorities undertake voluntary data matching.
16. The vast majority of positive responses provide comprehensive evidence that local authorities want this type of matching to resume. This builds on the already strong indication the NFI received in its 2022 survey where 78 of 84 local authorities said there was a strong need for the NFI to provide mandatory adult social care data matching.
17. This result also strengthens the evidence needed as part of the requirements to undertake an LRO under the LRRA. It demonstrates that the change would reduce costs or other financial burdens in that it would generate counter-fraud savings which would otherwise be lost to fraud or error.
18. Overall, this outcome strengthens the rationale for proceeding with LRO.
Question Two - The recommencement of adult social care data matching would assist my authority to better understand the overall fraud risks that it faces
Figure 1.2
| Strongly agree | 55% |
| Agree | 35.7% |
| Neither agree nor disagree | 3.9% |
| Other | 3.9% |
19. Of the 129 responses to this question, 71 ‘strongly agreed’, 46 ‘agreed’, five ‘neither agreed nor disagreed, one disagreed’, one ‘strongly disagreed’ and five responded with ‘other’.
20. This shows that 91% of local authority respondents strongly agreed/agreed that the recommencement of adult social care data matching would assist them to better understand their overall fraud risks. As with the previous question, this provides a strong indicator of the enthusiasm local authorities have for recommencing adult social care data matching. More specifically, it shows how it would help them identify the level of fraud that exists in local adult social care services.
21. As an example, one Welsh local authority said:
“The adult social care data matches provided good intelligence in terms of identifying fraudulent or erroneous payments, the level of risk faced by the Council, and also on the level of assurance that can be placed on internal controls within our Social Care department. This additionality to assurance processes has been lost through the removal of the adult social care data matching. By reintroducing the matches, it would assist the Council in tackling fraud and error”.
22. The one ‘strongly disagree’ response was from the same local authority in Wales that responded to question one. Again, they stated the same reason - in that they have the ability to receive relevant data on deceased individuals via registrars, meaning this amendment would not help them further in identifying fraud risks. The other ‘disagree’ respondent did not provide a reason for their response.
23. Of the ten respondents who said ‘neither agree nor disagree’ or ‘other’, the main theme as to why they responded this way was because they could only give a view as to whether the matched data would assist in identifying fraud risks until after they saw the results of the data matching.
24. In response to these views, we do agree that once the matched data has been shared, it will provide local authorities with a clearer landscape of fraud in their local adult social care provision - allowing them to make a more thorough conclusion as to the fraud risks it faces. However, we do have evidence that data matching does provide local authorities from previous NFI surveys. For example, the 2022 NFI survey showed 76% of the 84 local authority respondents agreeing that the NFI supports delivery of their organisation’s anti-fraud strategy with a further 69% agreeing the NFI is a valuable tool to demonstrate that an organisations’ controls are robust in addressing fraud risks.
25. The vast majority of positive responses give us strong evidence that not only would local authorities benefit financially, but that it would help them in strategically planning where best to focus resources in order to investigate instances of fraud and error.
26.As a result, this outcome strengthens the rationale for proceeding with LRO.
Question Three - Does your authority voluntarily undertake any data matching exercises for adult social care to detect financial fraud with other local authorities?
Figure 1.3
| Yes | 2.3% |
| No | 72.9% |
| Don’t Know | 22.5% |
| Other | 2.3% |
27. Of the 129 responses to this question, 94 said ‘no’, 29 said ‘don’t know’, three said ‘yes’ and three responded with ‘other’.
28. This shows that 73% of local authority respondents said that they did not undertake any voluntary adult social care data matching exercises to detect fraud with other local authorities. This aligns with expectations based upon previous engagement with NFI local authority participants and is reinforced by independent research by the Institute of Chartered Accountants in England and Wales (ICAEW)[footnote 17]. Thematically, respondents that have answered ‘no’ have done so on the basis that their local authority does not have either the capacity, capability or resources to undertake this form of data matching voluntarily.
29. As an example of this, one London Borough said:
“The recommencement will have a positive impact on overstretched local authority budgets, improve resources and capacity to protect genuine vulnerable clients to receive the support they are entitled to”.
30. This reinforces historical evidence provided to the NFI. For example, the 2022 NFI Survey highlighted that 93% were in favour of the mandatory collection of adult social care data on a national scale. In that survey, one Unitary Authority in England and one Scottish Authority said;
“Mandating the data on a national scale is needed as all councils have a responsibility to protect public funds and in addition the effectiveness of some matching, for example duplicate care payments, would potentially be adversely impacted if all relevant organisations are not required to participate.”
“By making the collection of data mandatory nationally, you are enhancing our detection of overpayments for recovery and mitigating fraud risk within the Social Care system”.
31. None of the three respondents that had responded ‘yes’ had given a reason for their answer, meaning it is difficult to conclude if they do actually undertake voluntary data matching. However, of the three local authorities that responded with ‘other’, they gave similar thematic rationale for their response - which could also provide an explanation for some of the ‘yes’ responses. Generally, they stated that they had plans in development with the aim of doing instances of voluntary data matching. For example, one English local authority said:
“We have been planning to work with our local registrars, social care and Office of National Statistics to allow us to analyse data to identify fraud”.
32. Although these local authorities said that plans were in development, none of them said that these plans were being implemented. Of the 29 local authorities that responded with ‘don’t know’, these local authorities gave similar thematic responses in that the respondent did not have enough of an understanding about individual datasets to understand if voluntary data adult social care data matching takes place.
33. In summary, this outcome strengthens the rationale for proceeding with LRO, as it will allow for adult social care data matching to resume on a mandatory basis, requiring local authorities to submit this data for matching
Question Four - Which datasets and organisations would your local authority consider it as valuable to match data against?
34. This question sought to understand which datasets and organisations (which ‘own’ a dataset) local authorities consider as valuable to match data against. This question aimed to provide insight that would assist the operational implementation of the NFI’s data matching process, if adult social care data matching were to resume.
35. Because of this, in many instances, the 129 local authority respondents gave more than one answer - leading to 201 dataset responses being recorded. Due to this volume, and variance of responses, the number of responses has been broken down in Figure 1.4 below.
Figure 1.4
| Datasets | Number of responses |
|---|---|
| DWP (eg benefits, pensions, deceased register) datasets | 48 |
| Adult social care datasets | 36 |
| HMRC (eg, earnings, capital) datasets | 31 |
| Other local authority datasets | 22 |
| Health related (eg, NHS, CQC) datasets | 15 |
| Housing related (eg, Land Registry) datasets | 13 |
| Other datasets (eg, electoral, banking) | 12 |
| Council Tax datasets (eg single person discount) | 10 |
| N/A / Unsure | 9 |
| Payroll datasets | 5 |
36. From these results, it highlights the level of importance that DWP and HMRC datasets have for local authorities in order for them to identify as many instances of fraud and error as possible. In addition, 36 local authorities still included adult social care datasets in their response, despite the question asking about other datasets - this could indicate the level of importance that these datasets have.
37. From the responses gathered, the NFI performs matches across the vast majority of these datasets, except Land Registry and health related datasets. These provide operational confidence that if adult social care data matching were to resume, it would be able to be matched against relevant and useful datasets for local authorities. It also provides an insight into potential future opportunities for the NFI to expand their dataset range.
Question Five - The NFI’s UK-wide data matching service supports financial efficiency through the generation of savings.
Figure 1.5
| Strongly agree | 33.3% |
| Agree | 48.6% |
| Neither agree nor disagree | 14.5% |
| Other | 2.9% |
38. Responses to this question, and all other questions following it, were invited from all organisations. As a result, of the 137 responses to this question, 46 ‘strongly agreed’, 67 ‘agreed’, 20 ‘neither agreed nor disagreed’, one ‘disagreed’, and four responded with ‘other’.
39. This shows that 82% of respondents strongly agreed/agreed that the NFI’s UK-wide data matching service supports financial efficiency through the generation of savings. This provides a substantive indicator of the level of confidence that local authorities and others have for the NFI’s data matching activities, and how it can generate financial savings for participating organisations.
40. To highlight this, one English and Welsh local authority said respectively:
“Adult social care data has in the past been our area of largest savings.”
“We recognise the importance of proactive exercises in general, and the NFI in particular has become a very sophisticated tool and an important element of counter fraud work.”
41. The Local Government Association also said:
“The National Fraud Initiative (NFI) data sharing exercise has been supported by local authorities for several decades now. It has an important place in counter fraud activities, as well as work to recover and reduce error and debt”.
42. The NFI has a proven track record of delivering audited savings in detected, prevented and recovered fraud. As shown from the NFI’s National Reports, the NFI delivers on average over £200m in counter fraud benefits every two years. During 2020-22 alone, the NFI delivered £443m in savings[footnote 18]. The positive responses to this question further validate the value of the NFI and how its activities generate savings.
43. Although 20 respondents gave an answer of ‘neither agree, nor disagree’, none of the respondents provided further reasoning for their response. However, this does still infer that from these local authorities, they do not disagree that the NFI’s UK-wide data matching service supports financial efficiency through the generation of savings. Similarly, the one local authority that responded with ‘disagree’, then did not provide further explanation as to why that was the case.
44. Of the four respondents who responded with ‘other’, only one provided further information behind their response. They said that there was not enough historical evidence that the NFI’s data matching activities would be successful in the detection and prevention of fraud.
45.In summary, the overall responses to this question strongly indicates that the data matching services provided by the NFI supports financial efficiency through the generation of savings. Therefore, this, in combination with the responses to question one, highlights how NFI participants acknowledge how the NFI both achieves, and is expected to continue to achieve, counter fraud outcomes. This provides further rationale for proceeding with the LRO.
Question Six - Do you consider that there would be any individuals adversely impacted by the data matching (other than those committing fraudulent acts)?
Figure 1.6
| Yes | 5.1% |
| No | 75.4% |
| Don’t Know | 13.8% |
| Other | 5.8% |
46. Of the 137 responses to this question, 104 said ‘no’, 19 said ‘don’t know’, eight said ‘other’ and seven said ‘yes’.
47. This shows that 75% of respondents consider that there would be no individuals (other than those committing fraudulent acts) adversely impacted by recommencing adult social care data matching. With the addition of only 5% responding ‘yes’, this highlights strong evidence that the majority of organisations consider that individuals and their data will not be adversely impacted.
48. The primary thematic reasons that respondents gave for why there would be no adverse impacts to other individuals is that:
-
the adult social care data that would be collected would not be healthcare related (ie, it will not show medical conditions, treatments or anything else that indicate health conditions). The data will be used solely to highlight the payment of adult social care services;
-
all data protections provided for in wider data protection legislation (eg, UK GDPR) would remain and would continue to be observed. Linked to this, some also said that the proposal- would also still align with wider data protection restrictions on adult social care data as a special category data; and
-
the proposed change would be in line with the LAAA 2014 and devolved legislation requirements for patient data to be mandated and disclosed to certain relevant bodies, specified in the legislation.
49. To highlight some of the thematic responses supporting the higher ‘no’ response rate, several local authorities said:
“The only data being used relates to the individual and not their care or support needs or underlying conditions.”
“There is limited or no impact on non-fraudulent activity with the expectation of preserving finances, through actioning fraudulent actors, for those in genuine need of the Council’s services and or support.”
“The risk of misuse of the data is appreciated, however, the personal financial data already being matched, presents an equal risk and we are of the view that it is being securely managed within the NFI application.”
50. Of the seven respondents that said ‘yes’, five of the seven respondents gave the same response. They stated that there could be unlikely instances whereby a direct claimant could be affected if care providers are found to be overcharging for adult social care, and then care is temporarily stopped. Therefore, this is not in relation to data protections but instead in relation to the provision of care being affected whilst investigations took place to determine if fraud or error has occurred. Historically, adult social care data matching primarily takes place in cases whereby the claimant is already deceased, and therefore ceasing adult social care provision in those instances would not impact the recipient. Of the two remaining ‘yes’ respondents, they did not provide any further information.
51. Of the 19 respondents that said ‘don’t know’, none of them further elaborated on why that was the case. Of the eight ‘other’ responses, the main theme that emerged regarding this response was a reminder that any change would have to be done in accordance with other legislative responsibilities on local authorities, such as the Care Act 2014. It should be highlighted that, should the LRO be implemented, it would be done so in full adherence with other legislation, whether it be data protection specific or specific to local authority responsibilities.
52. The overall views provided in response to this question provides confidence that this amendment would not adversely impact any individuals, other than those committing fraudulent acts - further strengthening the rationale for implementing it.
53. Additional responses also provided suggestions as to how individuals can be made more aware of how their data is being processed, and for what purpose. Further explanation of how these views have been taken into account is covered in the ‘further consideration section (paragraphs 89-102).
Question Seven - Would the recommencement of adult social care data matching be a proportionate action as a means to help tackle fraud in adult social care?
Figure 1.7
| Strongly agree | 48.6% |
| Agree | 39.1% |
| Neither agree nor disagree | 7.2% |
| Strongly disagree | 0.7% |
| Other | 4.3% |
54. Of the 137 responses to this question, 67 ‘strongly agreed’, 54 ‘agreed’, ten ‘neither agreed nor disagreed’, one ‘strongly disagreed’, and six responded with ‘other’.
55. This shows that 88% of respondents strongly agree/agree that the recommencement of adult social care data matching be a proportionate action as a means to help tackle fraud in adult social care provision. This provides a strong indication that the majority of organisations consider that an approach whereby a legislative amendment to recommence adult social care data matching is proportionate and well-balanced.
56. In demonstrating this, one English local authority and London Borough said respectively:
“Lack of powers to investigate fraud within Adult Social Care is a major issue which can only be resolved through legislative changes. There is a real risk that matches will not progress due to this lack of power.”
“The reintroduction of these records into the NFI is proportionate in response to known and suspected levels of fraud within local authority budgets and the wider UK economy. It is appropriate and what local authority tax payers would already assume is being done to protect the public purse”.
57. This evidence helps to support one of the requirements of enacting an LRO, namely that ‘the effect of the provision is proportional to the policy objective’. The responses to the consultation highlight how the proposed amendment will allow local authorities to make efficiency savings and contribute to the wider counter-fraud agenda. This approach is also more proportionate than alternative options (such as primary legislation), which might have to decrease the status of adult social care data (ie, remove it from the patient data category) in order to allow local authorities to access and to process it.
58. Of the ten local authorities who responded ‘neither agree nor disagree’, none of them provided any further information. In addition, the one local authority that ‘strongly disagreed’ also provided no further information supporting their response.
59. As a result, the views provided in response to this question provide further support for the approach of using an LRO specifically to recommence adult social care data, striking a fair balance between proportionality and outcomes.
Question Eight - Do you consider that the recommencement of adult social care data matching will maintain patient data protections?
Figure 1.8
| Strongly agree | 38.4% |
| Agree | 41.3% |
| Neither agree nor disagree | 14.5% |
| Other | 5.8% |
60. Of the 137 responses to this question, 53 ‘strongly agreed’, 57 ‘agreed’, 20 ‘neither agreed nor disagreed’ and eight responded with ‘other’.
61. This shows that 80% of respondents strongly agree/agree that the recommencement of adult social care data matching will maintain patient data protections. As with previous responses, this demonstrates that the majority of organisations consider that this legislative amendment will not only satisfy policy intent and generate counter fraud outcomes, but also crucially maintain patient data protections.
62. In demonstrating this, two English local authorities said:
“Private companies will not have the safe reputation, recognised and trusted protocols and security levels we have come to expect from NFI. Going ahead with this proposal gives well deserved meaningful recognition to the importance of the NFI public sector to combat fraud.”
“I’ve never really understood why the data we use for matching in Adult Social Care became classified as patient records requiring greater restriction than other records. None of what we do involves accessing sensitive medical records, it is merely matching on names, date of births, National Insurance Numbers and addresses. Yes some parts of the data we hold will be sensitive but the identification part of a patient record should not require the same level of restriction/protection”.
63. No respondent disagreed with the question, again providing further evidence that the proposal will maintain data protections. Of the 20 responses that ‘neither agreed, nor disagreed’, and the eight that said ‘other’ the main thematic reason for these responses was because some local authority respondents did not feel they have a great enough understanding of data protection legislation in order to give an informed view.
64. In anticipation of some organisations not having a deep understanding of data protection legislation, we consulted with the ICO[footnote 19] and the NDG for their specific views on the legislative proposal. Both organisations responded to the consultation, setting out further suggested actions the NFI could take to ensure that the purposes of matching adult social care data were transparent and that all aspects of data confidentiality, and any potential impacts on individuals, are considered. Further explanation of their views, and how they have been taken into account, is covered in the ‘further consideration section (paragraphs 89-97).
65. The views expressed in the response to this question also reaffirms a requirement of undertaking an LRO, as per the LRRA 2006, namely that the ‘provision does not remove any necessary protections’. The proposed change could potentially have some impact on individuals existing data protections (such as patient confidentiality of data) through allowing adult social care data to be collected and processed by the NFI and the resultant data matches shared with local authorities. However, this would not remove any protections provided for in wider data protection legislation (eg, Data Protection Act 2018). The provision is in line with wider data protection restrictions on social care data as a special category data.
66.The views provided in response to this question provide further support for the approach of using an LRO to recommence adult social care data. If the proposal is implemented, all protections would remain and would continue to be observed. The proposed change would be in line with the LAAA 2014 and devolved legislation requirements for patient data to be mandated and disclosed to certain relevant bodies, specified in the legislation. It would also uphold the NHS Act 2006 classification of social care data as patient data and ensure the data is treated as such by the NFI.
Question Nine - Do you consider there to be any non-legislative proposals that you believe would better target fraud than recommencing adult social care data matching?
Figure 1.9
| Yes | 4.3% |
| No | 81.9% |
| Don’t Know | 6.5% |
| Other | 7.2% |
67. Of the 137 responses to this question, 113 said ‘no’, ten said ‘other’, nine said ‘don’t know’ and six said ‘yes’.
68. This shows that 82% of respondents do not consider there to be any non-legislative proposals that you believe would better target fraud than recommencing adult social care data matching. This provides a strong indication that the majority of organisations consider the legislative approach being suggested in the consultation, and LRO, to be the best method in recommencing adult social care data matching.
69. Many organisations set out their rationale as to why they had responded ‘no’, several local authorities across the UK said:
“No, there are no non-legislative options that would do a better job than targeted data matching of various areas of adult social care.”
“No. A national approach is felt to offer the greatest opportunities.”
“No, whilst internally data sets can be matched, there is no current method to enable matching adult social care data to deceased data lists, cross-authority to identify whether there are fraudulent/erroneous payments being made, or duplicated payments being made for residents who may live on county borders. The NFI provided the Council an opportunity to undertake this matching through economies of scale”.
70. Of the ten ‘other’ responses, and the six ‘yes’ responses, the primary theme set out by organisations that had elaborated further was that there a very small number of local authorities that have tried to implement local activities to replace a proportion of the information lost when adult social care data matching was withdrawn. However, some of the organisations that highlighted this still reference the fact that this approach can be cumbersome, and does not provide anything comparable to the economies of scale generated by the NFI’s data matching activities. For example, the Local Government Association said:
“The withdrawal of the adult social care data matching exercise from the NFI in 2020 was a disappointment to many local authorities. Some local authorities have instituted workarounds to replace some (but not all) of the information lost when the data matching was withdrawn, and therefore, the proposal to restore it to the NFI is welcome. We believe this will be helpful in addressing some significant areas of fraud risk for local authorities”.
71. The views expressed in response to this question also satisfies one of the requirements of implementing an LRO, as set out in the LRRA 2006, which states that “policy objectives could not be satisfactorily secured by non-legislative means”. This result shows this to be the case, and for those instances where local workarounds are implemented, they do not generate significant counter fraud outcomes and therefore does not satisfy our policy intent.
72. There are no non-legislative alternatives that would achieve the same intended outcome of the proposal. Under permissive data sharing, local authorities are unlikely to obtain the same scale of outcomes that are available from sharing and processing this data under the LAAA and through the NFI, due to a significantly smaller pool of data. We expect, as confirmed by responses to the question, overall total outcomes from data matching undertaken on a discretionary basis by local authorities across England, Scotland and Wales to be uncertain and potentially minor compared to those achieved through NFI mandation.
Question Ten and further comment question - Do you have any further views regarding the expected outcomes of the proposals outlined in this consultation document?
Figure 1.10
| No further comment | 50.6% |
| Positive expectation that this | 22.2% |
| Don’t Know | 6.5% |
| Other | 27.2% |
73. Of the 137 responses to this question, 82 provided ‘no further comments’, 36 used the opportunity to further highlight that they had ‘positive expectations that the amendment would deliver outcomes’ and 44 said ‘other’.
74. This question, and the following ‘any further comment’ question, aimed to provide another opportunity for organisations to set out any additional thoughts beyond what they had already highlighted.
75. 51% had no further comments to provide, with a further 22% taking the opportunity to highlight how this proposal would be beneficial. For example, one English local authority and one London Borough said respectively:
“The organisation, through the NFI, has previously identified and recovered over £1m of payments made in error (for deceased customers) over a 3 year period”.
“When the data matching was available to us before, it identified amounts being paid out in fraud and error that we could recoup. At a time where local government is facing financial pressures, to allow us to use this tool again would greatly assist in achieving our goal of protecting the public purse and recouping funds paid out illegally”.
76. 27% of respondents provided additional views which have been categorised as ‘other’. Although varied, a majority of these responses highlighted the following themes:
-
regret and/or frustration that the removal of adult social care data matching was allowed to arise in the first instance;
-
the benefits of having access to more NFI datasets to target instances of fraud in local authorities;
-
further utilisation of technology, such as artificial intelligence, and other innovation activities that aim to make data matching more automated and efficient;
-
that data protection and the privacy of individuals is always considered and upheld where appropriate; and
-
that local authorities will need to review their privacy notices to ensure that adult social care data is included, alongside details of how it will be processed.
Further considerations
77. Several organisations provided further suggestions and considerations to take into account during the implementation of the LRO. These have been grouped thematically and set out below, alongside responses from the NFI.
Code of Data Matching Practice
78. The NFI’s data matching activities is bound by statutory guidance through a Code of Data Matching Practice[footnote 20], which explains the process and gives guidance to persons and bodies involved in data matching exercises.
79. Both the ICO and NDG stated that the reintroduction of adult social care data into NFI data matching gives reason to review and update the Code of Data Matching. In particular, given the current proposals, this could be an opportunity to include sections that highlight the importance of the protections required for special category data. They also add that any such revisions to the Code of Data Matching will help organisations to ensure that they are transparent about the processing they will carry out, as part of NFI data matching activities, and more generally. Lastly, the NDG stated that they recommend that it is shown how the eight Caldicott Principles have been considered as part of this proposal, and the Cabinet Office sets out how they will be adhered to if the matching recommences.
80. In response, the NFI welcomes the recommendations from both the ICO and NDG. On the basis of the recommendations suggested, the NFI will undertake a review of its current Code of Data Matching Practice to ensure that it is fit-for-purpose and reflective of the changes resulting from this legislative amendment. The NFI has considered the eight Caldicott Principles as part of the preliminary policy development for the LRO. The NFI will set out how the proposal adheres to the principles in the LRO’s Explanatory Document.
Data transparency and privacy notices
81. Under UK GDPR, organisations must make sure that people know what they will do with their data. As stated by the ICO, this does not prevent local authorities from using the data they receive to participate in anti-fraud measures or schemes such as the NFI data matching. It also does not mean alerting fraudsters to the fact that, for example, they are under investigation. However, they will need to be open and transparent about how they will use the data at the point of collection.
82. Individuals are, and will continue to be, informed of the use of their data through the NFI’s privacy notice and relevant local authority privacy notices. In response to the suggestions set out, the NFI will produce a revised privacy notice, setting out how this data will be specifically used, and ask relevant local authorities to update their privacy notices ahead of any data sharing and processing commencing.
83. The ICO also set out that it published a public consultation on a draft transparency guidance in November 2023, which focuses on the additional steps that organisations will need to take to ensure that they are sufficiently transparent about the processing they carry out. The consultation concluded in January 2024, with the final version now published. The NFI will take account of this updated guidance when revising its privacy notice.
Special category data
84. The ICO and NDG consider that the relevant adult social care data likely constitutes special category data - this is a view shared by the NFI.
85. The ICO has also set out that local authorities and others processing personal data under the NFI data matching initiatives will need to identify both a lawful basis for processing under Article 6 UK GDPR and an additional condition for processing of special category data under Article 9.1. In all cases, a data protection impact assessment is a useful tool that helps organisations to identify the risks of the processing they undertake, and helps them to decide on the mitigating steps they will implement. The NFI supports this assessment and understands that local authorities undertake these processing for existing data matching activities. The NFI will notify local authorities and strongly recommend that these processes also apply to adult social care data matching once it recommences.
Application to Wales
86. The NFI’s policy intention is that adult social care data matching resumes across the UK on an equal footing across all nations, particularly as Northern Ireland still retains this ability due their own separate devolved legislation.
87. Audit Wales’ response set out that the LAAA 2014 amendment on its own would not allow for the recommencement of adult social care data matching in Wales. While paragraph 4 of Schedule 9 of the LAAA 2014 is also referenced in terms of bodies mentioned in paragraph (a), (b) or (c) of that paragraph in section 64D(6)(b)(ii) of Public Audit Wales Act (PAWA) 2004, Audit Wales is uncertain if that amendment alone would allow the Auditor General to disclose social care data matches to Welsh local authorities, as Welsh NHS bodies are separately defined in section 60 the PAWA 2004. Audit Wales suggested that an amendment to the PAWA 2004 may be required to solve the problem in respect of Wales, including in relation to cross-border matches.
88. The NFI accepts the findings of Audit Wales, and as such, the Order will also make a parallel amendment to Section 64D of the PAWA so the amendment can take effect for Welsh local authorities.
Burdens on local authorities
89. The LGA recognises that local authorities will incur an unavoidable cost with the introduction of the resumed data matching under the NFI and trusts this will be taken into account. The LGA also recognised the proactive steps already taken by the NFI to assess the proposal under the new burdens doctrine.
90. The NFI has also undertaken a comprehensive Impact Assessment, as signed-off by the Cabinet Office Chief Economist. This Impact Assessment, which includes a cost/benefits analysis, has been included as an Annex to the Explanatory Document to the LRO that has been laid in Parliament.
-
The Audit and Accountability (Northern Ireland) Order has a provision for patient data to be disclosed to health and social care trusts in NI, who have responsibility for social care. ↩
-
The Public Finance and Accountability (Scotland) Act 2000 (PFASA) does not carry restrictions on the disclosure of local authority social care data. The PFASA’s definition of “medical purposes’’ does not expressly include local authority social care and therefore does not meet the definition of “patient data”, and therefore it is not necessary to amend PFASA. ↩
-
https://www.cipfa.org/services/cipfa-solutions/fraud-and-corruption/fraud-and-corruption-tracker, p. 11. ↩
-
https://www.kingsfund.org.uk/publications/social-care-360/expenditure ↩
-
https://www.cipfa.org/services/cipfa-solutions/fraud-and-corruption/fraud-and-corruption-tracker, p. 11. ↩
-
https://www.kingsfund.org.uk/publications/social-care-360/expenditure ↩
-
This is also local authorities in Wales and Scotland and only tier-one local authorities (metropolitan, unitary, county and London borough) in England. ↩
-
Calculated by averaging all ‘positive’ responses [123 of 137], ‘negative’ responses [1 of 137], and all ‘neutral/other’ responses [13 of 137]; categorisations were based upon majority responses to each question in the survey. ↩
-
https://www.gov.uk/government/publications/the-caldicott-principles ↩
-
These are local authorities in Wales and Scotland and only tier-one local authorities (metropolitan, unitary, county and London borough) in England. ↩
-
Calculated by averaging all ‘positive’ responses [123 of 137] (ie, majority of answers were strongly agree, agree responses to questions 1, 2, 5, 7, 8 or no responses to questions 3, 6 and 9), ‘negative’ responses [1 of 137] (ie, majority of answers were strongly disagree, disagree responses to questions 1, 2, 5, 7, 8 or yes responses to questions 3, 6 and 9) and all ‘neutral/other’ responses [13 of 137] (ie, majority of answers were neither agree or disagree/other to questions 1, 2, 3, 4, 5, 6, 7, 8 and 9). ↩
-
TACKLING FRAUD AND CORRUPTION AGAINST GOVERNMENT - May 2023 ↩
-
As per Article 36(4) of the General Data Protection Regulation (GDPR). ↩