Summary
Jump to
The complaint
Ms M complained that her address details, which were held by a number of different government agencies (which included HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions), were incorrectly changed by an unidentified government agency. Ms M further complained that this error was duplicated across the other government agencies that held her address and was not corrected across these agencies when she told HM Revenue & Customs’ Tax Credit Office (an organisation with which she had dealings with at the time) about the error. None of the bodies involved had been able to explain satisfactorily what had gone wrong and none had, therefore, resolved her complaint.
Procedural background
The Data Protection Act 1998 regulates how personal information should be processed, including how data is obtained, held, used and disclosed. It requires data controllers (such as the bodies involved in this case) to process personal information in accordance with eight data protection principles. The data protection principles most relevant to the circumstances of Ms M’s case say that bodies should: process an individual’s data fairly and lawfully; obtain it only for a specific and lawful purpose and only process (that is disclose) it further in a way that is compatible with that purpose; ensure that the data processed is accurate, and, where necessary, kept up to date; and ensure that the information is protected by appropriate security measures to prevent it being compromised. Individual public bodies are responsible for managing the security of the information each of them holds.
Government departments and agencies have databases and bespoke computer systems designed to support their business needs. Some of these computer systems have databases in common and some have internal and external links between them. These links exist to enable data relevant to all linked-in bodies to be kept up to date when an individual’s personal details are changed on any one system.
What we investigated
We investigated the handling of Ms M’s personal data by HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions from December 2006, when it was incorrectly amended. We also investigated the various bodies’ efforts to correct the error, remedy the consequences, and explain to Ms M how the error had occurred.
What our investigation found
We found it likely that Ms M’s address had been incorrectly changed to Mr A’s new address as a result of an inputting error by the Tax Credit Office in December 2006. We saw evidence to suggest that the Tax Credit Office had received correspondence on 7 December 2006 advising them that Mr A had moved to a new address in another town. We believe that the officer responsible for amending Mr A’s tax credits record mistakenly changed Ms M’s address to Mr A’s new address. That change to Ms M’s address would then have been picked up by other HM Revenue & Customs computer systems and passed on to the other bodies involved via the linked-in computer network; in turn updating the Child Support Agency’s and the Department for Work and Pensions’ systems with the incorrect address for Ms M.
We found that none of the bodies involved accepted responsibility for what happened to Ms M until the Parliamentary Ombudsman became involved. They did not accept responsibility for the presence of the erroneous data; they did not demonstrate a willingness to investigate matters further; and they appear to have been unable to rectify the problem they had created. We found that once an inputting error had been made, an individual’s personal data could be changed across the network of computer systems used by the bodies involved without the individual’s knowledge or consent; and the network of computer systems could not then always locate the source of any errors made. The lack of provision for users to identify retrospectively and rectify human errors which occur from time to time, as in this case, caused the Ombudsman concern. As did the failure by the bodies involved to find out for Ms M what had happened or explain to her why things had gone wrong when there was still an opportunity to do so. The failure by HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions to work together to investigate and resolve Ms M’s complaint fell so far short of the Ombudsman’s Principles that it amounted to maladministration and a failure of public service.
We found further shortcomings in HM Revenue & Customs’ handling of Ms M’s case. The Tax Credit Office failed to keep, or make a proper note of, the paper document received by them on 7 December 2006, which we think caused the incorrect change to Ms M’s address, denying her the explanation and reassurances she was seeking about her data. We also found that the Tax Credit Office sent two documents intended for Ms M, which contained personal information, to Mr A, and never subsequently apologised to her for doing so. We found that when Ms M told the Tax Credit Office of the problem with her address, they took no action to correct her details. As a consequence, the various linked-in systems were not corrected and the Child Support Agency sent a notice of the reassessment of Ms M’s child support maintenance to the wrong address. Furthermore, when Ms M complained to HM Revenue & Customs, her local Enquiry Centre was unhelpful, and the Tax Credit Office delayed responding to her complaint. This poor customer service amounted to maladministration.
We found the National Insurance Contributions Office had given Ms M incorrect information when she first approached them about her difficulties, and looked at her records for the wrong period when Ms M’s MP asked them to investigate Ms M’s complaint further. By the time we became involved, the audit trail of Ms M’s records was no longer available due to the National Insurance Contribution Office’s record retention policy, and their records showed no history of the incorrect changes to Ms M’s address because the data had been removed without any record or explanation. The National Insurance Contributions Office’s handling of Ms M’s complaint, therefore, also amounted to maladministration.
The decision
We upheld Ms M’s complaint. We were satisfied that the individual and collective failings of HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions, when handling Ms M’s personal information, amounted to both maladministration and a failure of public service, and that as a consequence, Ms M suffered injustice.
Recommendations for remedy
To remedy the injustice for Ms M, we recommended that the Permanent Secretary of HM Revenue & Customs apologises on behalf of all of the bodies involved for:
- the collective failure to investigate Ms M’s complaint properly;
- the failure to adopt a co-ordinated approach to resolving Ms M’s complaint;
- the failure to provide an appropriate explanation and remedy for their mistakes; and
- the impact of all of that maladministration on Ms M.
We also recommended that HM Revenue & Customs pay Ms M £2,000 in recognition of the injustice flowing from the maladministration identified, and that they check their databases to ensure that Ms M’s address is correctly recorded and there is no link between Ms M and Mr A. We also recommended that HM Revenue & Customs liaise with the Child Support Agency and the Department for Work and Pensions to ensure that they too check every database they own to ensure that Ms M’s address is correctly recorded and there is no link on their systems between her and Mr A.
To address the wider, cross-cutting issues identified, we recommended that HM Revenue & Customs, together with the Child Support Agency and the Department for Work and Pensions, and in discussion with the Cabinet Office, agree a protocol to deal with complaints of this kind, which cross organisational boundaries and arise from the sharing of information between them. Also, that HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions explain to Ms M, her Member of Parliament, and the Ombudsman how they intend to take forward this recommendation, and provide a timescale for implementation. To ensure there is wider learning across government departments with similar networked systems, we recommended that the Cabinet Office takes steps to ensure that lessons are learnt from our investigation and that appropriate guidance is disseminated to all government departments. Our recommendations were agreed in full.
