Describe the nature of the processing:
- how will you collect, use, store and delete data?
- what is the source of the data?
- will you be sharing data with anyone? You might find it useful to refer to a flow diagram or other way of describing data flows.
- what types of processing identified as likely high risk are involved?
Brighton & Hove City Council will supply Cabinet Office, DWP and HMRC with the names and addresses of Brighton & Hove City Council’s customers with Council Tax debt.
Plus supporting identification information, (for example, National Insurance number, date of birth, email address and phone numbers) as a one-off data share.
Department of Work and Pensions (DWP) and HMRC will match against their data and matching cases will be supplied to Brighton & Hove City Council with income-based benefits information, PAYE and Self-Assessment (SA) data.
The data will be used to enable management and recovery of Council Tax debt through:
- discussions around the use of debt support, where financial vulnerability is identified
- Assessment of Earnings (AoE), where employment information has been provided
- further discussion with the individual where self-assessment information has been provided
The data will be stored in a secure folder within Brighton & Hove City Council. Cabinet Office (CO) will send this to DWP by secure government email. DWP will then send the data to HMRC by secure government email.
Neither HMRC or DWP is to keep the data beyond its matching operations. Cabinet Office is not to keep the data beyond its collation of the local authorities’ spreadsheets, its passing of this to DWP and its return of disaggregated information to respective local authorities.
The standard data retention period for the pilot is 12 months.
However, data that is being used operationally to recover debt (for example, through an Attachment of Earnings, bankruptcy action or supporting identified vulnerable customers) will be kept in line with Brighton & Hove City Council’s data retention policies and deleted in accordance with said policies.
From the information supplied by HMRC, if Brighton & Hove City Council subsequently has this information confirmed by either the employer or the individual, then that information can be classed as having been supplied by another source (other than HMRC), then Brighton & Hove City Council shall be able to retain this data on its systems.
However, the data received from HMRC in its raw format shall be deleted at the end of the pilot.
For HMRC, the pilot data will be deleted one year after the data has been shared with Cabinet Office. Except where the data is being used operationally and will be deleted once recovery action has been completed.
The data will not be shared with anyone else.
Council Tax flow chart below showing our debt recovery process and enforcement actions
Read an explanation of the debt recovery flowchart in plain text.
Describe the scope of the processing:
- what is the nature of the data, and does it include special category or criminal offence data?
- how much data will you be collecting and using?
- how often?
- how long will you keep it?
- how many individuals are affected?
- what geographical area does it cover?
An overview of the activity under the arrangement and how the data will be used
Brighton & Hove City Council, will undertake a one-off data share as to a reasonable sample of debtors.
This sample is to be of an appropriate size in relation to Brighton & Hove City Council (as may include all debtors contained within our Liability Order dataset).
There is no limit to this sample size. This sample is to be shared with Cabinet Office.
Cabinet Office will then collate all of the submitted samples from the pilot’s local authorities into a single document.
This collated document will then be passed by Cabinet Office to DWP who will match against their benefits records.
For those records matched, DWP will add income-based benefits data and add corroborative customer information (like National Insurance number and/or date of birth) and then forward these records to CO.
CO will store the matched DWP data securely and produce a minimised version of the spreadsheet showing only the LA identifiers and personal information and matched DWP personal information.
This minimised spreadsheet will then be password protected, and sent to HMRC.
HMRC will match these customer records against their systems and return the records to Cabinet Office with the associated address, PAYE and/or Self Assessment information.
Cabinet Office will then disaggregate this information and provide the respective samples to each local authority, whereupon Brighton & Hove City Council shall receive its sample back.
No special category or criminal offence data shall be contained within the sample.
The sample will exclude debtors who are:
- in receipt of debt support - full or partial
- deceased
- subject to committal and bankruptcy cases
- companies
- subject to a current Attachment of Earnings
A snapshot of data will be taken before being issued to DWP/HMRC for evaluation during and post-action.
Once the data has been returned, Brighton & Hove City Council will analyse the results from DWP and HMRC and for those in receipt of:
- DWP income-based benefits:
- pass to debt support team for action
- communicate with the debtor
- if debtor contacted and vulnerability discussed, support offered (where appropriate) and/or payment plan agreed
- if no contact, Brighton & Hove City Council shall continue recovery action
- PAYE:
- 14-day letter (as per the first pilot) to be issued to the debtor
- if debtor contacted, payment plan or vulnerability discussed
- if no contact, Brighton & Hove City Council shall progress Attachment of Earnings action
- self-assessment (SA):
- communicate with the customer noting they are in receipt of SA
- if debtor contacted, payment plan or vulnerability discussed
- if no contact, Brighton & Hove City Council shall continue recovery action
Outline of what types of data will be shared and the data security arrangements to be put in place
Brighton & Hove City Council, will send a password protected Excel spreadsheet to the CO contact, [redacted] by forced Transport Layer Security (TLS) government-secure email relating to a sample of their Council Tax Debtors.
The password will be sent by a separate means to Cabinet Office (CO) on confirmation of receipt of file(s).
The sample will exclude debtors who are:
- in receipt of debt support - full or partial
- deceased
- subject to committal and bankruptcy cases
- companies
- subject to a current Attachment of Earnings
The data items sent from local authorities (LA) to CO are as follows:
- full name, including title, first name and middle name or initials
- current address and postcode
- forwarding address and dates
- date of commencement of Liability Order, if applicable
- unique identifier, future proof
- phone numbers, where available
- email addresses, where available
In addition, either date of birth or National Insurance number will be provided as a minimum (where available) to assist the Department of Work and Pensions (DWP) data matching.
CO will collate our sample with the other samples from the LAs involved in this pilot for onward transmission to DWP.
DWP will match against their benefits records and, for those matched customers, will add additional corroborative data and income-based benefits information as follows:
- match successful – yes or no
- customer name as recorded on DWP records
- National Insurance number, as recorded by DWP, where available
- date of birth as recorded by DWP, where available
- phone numbers, where available
- email addresses, where available
- income-based benefit in payment – yes or no
- payment frequency – weekly or monthly
- benefit amount
The file(s) will then be downloaded as an Excel document. The file(s) will be password-protected, and sent to the CO contact, at the mailbox [redacted] by forced TLS email over a government secure network.
In line with DWP policy, the password will be relayed to by the DWP DST individual to the CO contact, [redacted], by phone once CO have confirmed receipt of the file(s).
CO will then store the matched DWP data securely and produce a minimised version of the spreadsheet showing only the LA identifiers and personal information and matched DWP personal information.
This minimised spreadsheet will then be password protected, and sent to HMRC, split into 10MB files, by forced TLS email over a government secure network.
The password will be sent in a separate email once HMRC contact have confirmed receipt of the file(s).
HMRC will match against their records and, for those matched customers, will add the following data and return to local authorities through Cabinet Office:
- match successful - yes or no
- address as recorded by HMRC
- if person is in current employment, PAYE data, including:
- employer Name
- employer Address
- employer contact details, like name and phone number
- currently employed, as of last PAYE update - yes or no
- employment end date
- employment pay frequency
- taxable pay in period
- taxable pay year to date
- payroll ID in this employment
- individual address
- self-assessment (SA) data, including:
- tax year
- SA total income
- SA correspondence address
- furlough payments data, including:
- furlough payment or average
- payment frequency
- period of furlough payments
- total furlough amount paid
HMRC RIS DAT will produce a single spreadsheet with the matched data. This spreadsheet shall be password-protected and split into 10MB file(s) and returned by forced TLS government-secure email to the CO contact, [redacted] at the mailbox [redacted].
The password will be emailed from HMRC RIS DAT to CO on confirmation of receipt of files(s).
On receipt of the final data product from HMRC RIS DAT, CO will merge the data with the additional DWP benefits data and then disaggregate the final data set and create separate spreadsheets of the data relevant to each local authority.
The spreadsheet for each LA shall be password-protected and sent to that LA by TLS government-secure email by CO.
Each LA will extract the data from the spreadsheet they receive from CO. The data will be used solely for the purpose of this project and will not be retained for the purpose of any other use.
LAs will delete the data on completion of the pilot and its analysis, and this will be confirmed by email to CO, DWP and HMRC contacts.
DWP and HMRC will conduct their own quality matching policy to the data to ensure match quality and data returned meet their standards.
Data will be securely transferred by encrypted email from a secure email address, will be stored in a secure folder and deleted after the completion of the pilot and analysis.
Persons at Brighton & Hove City Council receiving and disclosing data are limited to debt analysts and debt recovery officers.
All such users sign data disclosure agreements before system access is granted. All staff have had DPA and lately GDPR training.
Persons at DWP and HMRC receiving, analysing and disclosing data are limited to data analysts and processors, within the Centre for Data Exploitation, data management team. These staff have been security trained.
For any third-party entity or body which provides services to Brighton & Hove City Council and which has access to its software suppliers and is able to extract data to be used in a search tool available for other councils - Brighton & Hove City Council shall ensure no data supplied to them under this pilot is available for any other council to obtain.
Describe the context of the processing:
- what is the nature of your relationship with the individuals?
- how much control will they have?
- would they expect you to use their data in this way?
- do they include children or other vulnerable groups?
- are there prior concerns over this type of processing or security flaws?
- is it novel in any way?
- what is the current state of technology in this area?
- are there any current issues of public concern that you should factor in?
- are you signed up to any approved code of conduct or certification scheme (once any have been approved)?
The individuals reside (or resided) within Brighton & Hove City Council’s boundary and are/were liable to pay Council Tax to Brighton & Hove City Council but are in arrears.
The individuals will have no control.
Council tax is covered by the Local Government Finance Act 1992 and individuals are required to pay Council Tax and would expect Brighton & Hove City Council to pursue recovery of their debt.
Children and other vulnerable groups are not included.
There are no prior concerns over this type of processing and security flaws.
The use of data sharing to manage and reduce debt is well established throughout the debt industry.
There is no new technology in this area for this type of pilot.
There are no issues of public concern to be factored in.
Brighton & Hove City Council, Cabinet Office, DWP and HMRC have to follow the DEA Code of Practice, DPA 2018 and LGFA 1992 (as amended).
Describe the purposes of the processing
What do you want to achieve?
The pilot is aimed at increasing recovery of Council Tax debt from individuals who have not paid and debt support for those individuals identified as financially vulnerable.
What is the intended effect on individuals?
The intended effect on individuals will be for those who are able to pay and choose not to pay is to manage and recover their debt.
For those who are identified as vulnerable, the effect will be to help them through debt support. It will also be fairer for those who do pay their Council Tax.
What are the benefits of the processing – for you, and more broadly?
The benefits of the processing are:
- increased debt recovered
- increased in-year collection rate
- increased identification of vulnerable debtors, as can be signposted for assistance within or externally of the Brighton & Hove City Council, where they engage
- increase in debt recovery due to knowledge of PAYE and Self-Assessment information
- increase in take-up of reliable Attachment of Earnings
- reduced failure rate of Attachment of Earnings
- reduced need for using enforcement agents as a first port-of-call and the increasing of debt with fees
- a fair approach to reducing debt with an ability to pay over a regular period
- improved effectiveness in debt recovery and thus reduced pressure on budgets
- those in regular employment will avoid expensive and stressful enforcement agent visits
- customers knowing that we have access to HMRC data will encourage earlier take-up in contacting Brighton & Hove City Council and making arrangements to pay
- efficiency savings by reducing time and court hearings on committal or insolvency cases
- efficiency savings on not transferring cases to enforcement agents
- quicker repayment of debt
- identification of individuals with a propensity to pay and take appropriate recovery action
- reduced or mitigated problem debt