Address: Telephone:
Website:
110 George Street
0845 146 1010
www.audit-scotland.gov.uk
Edinburgh Fax:
EH2 4LH
0845 146 1009
Council CEOs
17 December 2007
Dear
National Fraud Initiative (NFI) – electoral register and data security
I wrote to you in early July to explain that Audit Scotland was extending the NFI exercise to match council tax records
with the electoral register. Pilot work in England has demonstrated the scope for such an exercise to help identify
significant numbers of invalid claims for single person discount.
Since then Audit Scotland has provided NFI key contacts with the specifications for the datasets, the timescales for its
submission and instructions on how it can be uploaded securely via a new facility within the NFI web-based application.
In view of recent well publicised events I would like to confirm that this facility has been thoroughly tested and data
uploaded in this way is automatically encrypted. From now on, this secure upload facility will be the only acceptable
method of submitting data for NFI purposes.
Overall, feedback about the council tax exercise has been positive but we have also had enquiries from some officers, in
particular, about the legal framework for providing of a full copy of the electoral register. Similar enquiries were raised in
England and, to allay concerns, the Audit Commission sought advice from Queen’s Counsel. The Audit Commission
has allowed Audit Scotland to make that advice available in Scotland and a copy is enclosed.
Counsel’s advice is that it is lawful for the electoral register to be provided to auditors for the purpose of this exercise.
The advice also covers aspects of data protection and human rights issues. While the advice is based on the duties
and powers of auditors in England, and on the Representation of the People (England and Wales) Regulations, our
legislation is no different in any significant respect and Audit Scotland considers the advice to be persuasive in Scotland.
The Appendix to this letter identifies the key legislation and other documents referred to in the advice and the Scottish
‘equivalent’.
I hope that this letter and enclosure will help to allay any concerns that may exist in your council about providing the
electoral register or about the security of NFI data transfers.
Yours sincerely
Russell AJ Frith
Director of Audit Strategy
cc Council NFI key contacts [by email]
Appointed auditors [by email]
Appendix
Para
Provision or document referred to
Scottish equivalent/comments
4
Representation of the People Act
UK legislation
1983
9
S3(9) Audit Commission Act 1998
The Accounts Commission has approved arrangements under S53
Local Government in Scotland Act 2003 for appointed auditors in
Scotland to be assisted by staff in Audit Scotland and by the Audit
Commission’s NFI appointed auditor. This was done to avoid any
issues about the Audit Commission receiving and processing data from
Scottish bodies on behalf of Audit Scotland
10
Statutory duties of auditors and duties
The statutory duties of auditors are similar in Scotland and England.
etc
under the Code of Audit Practice
The Accounts Commission has approved a Code of Audit Practice
issued by Audit Scotland which further explains the respective
responsibilities etc of auditors and audited bodies. That Code is
available on Audit Scotland’s web-site
16
S6 Audit Commission Act 1998
S100 Local Government (Scotland) Act 1973 (S100 is reproduced at
Appendix 3 of Audit Scotland’s Code of Data Matching Practice – also
available on our web-site)
18
Regulation 107 of the Representation
Regulation 106 of the Representation of the People (Scotland)
of the People (England and Wales)
Regulations 2001
Regulations 2001
20
Regulation 43 of the Representation
Regulation 43 of the Representation of the People (Scotland)
of the People (England and Wales)
Regulations 2001
Regulations 2001
22
Regulation 102 of the Representation
Regulation 101 of the Representation of the People (Scotland)
of the People (England and Wales)
Regulations 2001
Regulations 2001
23
Regulation 94 of the Representation
Regulation 94 of the Representation of the People (Scotland)
of the People (England and Wales)
Regulations 2001.
Regulations 2001
Some previous responses from Audit Scotland referred to Regulation
95(2) which also appeared to be relevant. This was caused by initial
difficulties in identifying all amending regulations between 2001 and
2006.
32
Para 2.3 of the Audit Commission’s
Para 2.3 of Audit Scotland’s Code of Data Matching Practice
Code of Data Matching Practice
36
Serious Crime Act 2007/section 32A
Additional data matching powers for the Audit Commission in this Act
etc of the Audit Commission Act 1998
have not yet been provided in Scotland. This is not relevant to the
current debate but Audit Scotland is in discussion with the SG Justice
Department about this.
