Report

by the Comptroller
and Auditor General

Cross-government

Challenges in using data across government

HC 2220 Session 2017–2019 21 June 2019

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office (NAO) helps Parliament hold government to account for the way it spends public money. It is independent of government and the civil service. The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether government is delivering value for money on behalf of the public, concluding on whether resources have been used efficiently, effectively and with economy. The NAO identifies ways that government can make better use of public money to improve people’s lives. It measures this impact annually. In 2018 the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £539 million.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 20 June 2019

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

19 June 2019

This report draws together our experience of government’s use of data. It reports what we see as the challenges and barriers which have limited government in making the progress it expected from previous attempts to improve the use of data.

© National Audit Office 2019

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

006468 06/19 NAO

The National Audit Office study team consisted of:
Yvonne Gallagher, Caroline Harper, Tracey Payne and Jonathan Pownall under the direction of Siân Jones.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

Foreword

The safe and appropriate use of data is an increasingly important challenge for government. Greater use of technology, the proliferation of data and analytical techniques, and better awareness of their risks, have led to a widespread debate over how to manage data in the modern world. Many organisations in the UK are now contributing to better understanding the legal or ethical implications of using data, and this is a critical requirement for establishing public trust.

But the challenge for government’s use of data goes beyond concerns about trust and security. Getting the right data in the right place at the right time is a fundamental driver of value for money in government: making services work for the people who use them, improving government’s systems and processes, and supporting better decisions. And the steps government needs to take to use data effectively are as much about good management, governance and planning within its existing activities, as they are about learning to work with new technologies. The current focus on the legal and ethical obligations of using data is also an important opportunity for government to tackle these longstanding challenges in how it manages information.

The National Audit Office has reported time and again on the importance of well-informed decisions in government programmes and services. For example, the quality and availability of data in informing decisions has been an issue identified in our recent work on Windrush and Carer’s Allowance.1,2

This report sets out what government needs to do with its data to improve services for citizens, the way systems operate and support better decisions. It draws on our previous work, and the main issues that we believe will help government to use and exchange data and information safely and effectively.

Some aspects of data and technology are widely discussed, including the role of open data, new opportunities such as artificial intelligence (AI) and the challenges of protecting information and privacy. But outside of departments’ data experts there is insufficient recognition of the importance of data.

There are three substantive issues:

Data is not always seen as a priority. Our report on planning and spending across government highlighted the challenges for government in making long-term cross-government investments, and the quality and sharing of data is a clear example of a neglected and poorly planned activity. If government is serious about data being one of its most important assets, it is long overdue a balance sheet review.3

The quality of data is not well understood. Government has pursued the benefits of better use of data but new initiatives often expose the poor quality of the data itself. Good data is not a ‘free good’ and government needs a structured approach to investing in improving and using data.

There is a culture of tolerating and working around poor-quality data. Evidence-based decision-making is a necessary condition for achieving value for money in public spending. And government needs to develop the capability, leadership and culture to support sustained improvement in the quality of information available.

This report aims to support efforts so far, and those working to make data in government better.

Summary

1 Data is crucial to the way government delivers services for citizens, improves its own systems and processes, and makes decisions. Our work has repeatedly highlighted the importance of evidence-based decision-making at all levels of government activity, and the problems that arise when data is inadequate (Figure 1).

2 Government recognises the value of using data more effectively, and the importance of ensuring security and public trust in how it is used. In its 2017 digital strategy, it stated that it would “…take the actions needed to make the UK a world-leading data-driven economy, where data fuels economic and social opportunities for everyone, and where people can trust that their data is being used appropriately”. It plans to produce a new national data strategy in 2020 to position “the UK as a global leader on data, working collaboratively and openly across government”.

3 To achieve its ambitions government will need to resolve fundamental challenges around how to use and share data safely and appropriately, and how to balance competing demands on public resources in a way that allows for sustained but proportionate investment in data. The future national data strategy provides the government with an opportunity to do this, building on the renewed interest and focus on the use of data within government and beyond.

Our report

4 This report sets out the National Audit Office’s experience of data across government, including initial efforts to start to address the issues. From our past work we have identified three areas where government needs to establish the pre-conditions for success: clear strategy and leadership; a coherent infrastructure for managing data; and broader enablers to safeguard and support the better use of data (Figure 2). In this report we consider:

the current data landscape across government (Part One);

how government needs a clear plan and leadership to improve its use of data (Part Two);

the quality, standards and systems needed to use data effectively (Part Three); and

wider conditions and enablers for success (Part Four).

5 We have focused our review on the use of data to support delivery of public services, but many of our findings are equally relevant to data to support decision-making and improve performance, including through research and thematic analysis. Within this context, it is important to ensure that data is used safely, sensitively and appropriately, with proper ethical considerations.

Challenges and barriers

Strategy and leadership

6 Government does not treat data as a strategic asset. The Department for Digital, Culture, Media & Sport (DCMS) is the only department that refers to data as a strategic asset in its 2018 single departmental plan. Five departments of the seven we examined in detail have data strategies, and these were of varying maturity. By contrast, for government property there are long-term funding plans, with publicly available strategies for the whole of government collectively and individual departments (paragraphs 2.2, 2.3 and Appendix 2).

7 There has been a lack of leadership across government. Responsibility for data policy and data ethics sits within DCMS, but it has not made the progress it expected in establishing its leadership or developing the national data strategy, largely because staff were diverted to EU Exit work. The Government Digital Service (GDS) and the Office for National Statistics also have an interest in data policies and provide support to departments. In 2017, the government committed to appointing a new chief data officer for government by 2020. It has not done this yet. The two cross-government groups on data have not met regularly in 2019 (paragraphs 1.7, 1.8, 2.4 to 2.9, Figure 5 and Appendix 3).

8 Funding pressures can inhibit progress on data projects. Data projects have sometimes been set aside when funding is under pressure. There are examples of the government funding projects to automate data feeds, for example the Department for Work & Pensions using HM Revenue & Customs real-time information to support benefit payments. This has the potential to provide benefits, but this has often been driven by new policies rather than fixing ongoing problems (paragraphs 2.3, 2.12 to 2.16, Figure 8 and Appendix 2).

Data, systems and processes

9 Data quality is often inadequate. We commonly find that the effectiveness of programmes is compromised because data quality is poor. For example, the Windrush situation demonstrated the effect of decisions based on poor data. It takes manual effort to make the data usable and to extract the relevant information. This limits the benefits of new policies or systems unless the underlying data quality is improved (paragraphs 3.2, 3.3, 3.6 and Figure 9).

10 A lack of standards across government has led to inconsistent ways of recording the same data. We found more than 20 ways of identifying individuals and businesses across 10 departments and agencies, with no standard format for recording data such as name, address and date of birth. The problem is replicated in local areas where information is recorded differently across local and constitutional boundaries. This makes it difficult for government to maximise its data asset, for example by allowing thematic analysis across different sectors to help understand economic challenges or systemic problems (paragraphs 3.4, 3.13, 3.14 and Figure 10).

11 Legacy systems often only work for the policy they were built for. Departments have historically developed IT to support specific policy objectives. Even within the same department, data cannot be extracted or shared easily. A lack of common data models and standards within and between departments makes it difficult and costly to combine different sources of data. Some government departments have not always prioritised replacing older technology, but until they do so there will be ongoing costs and inefficiencies in decision-making (paragraphs 3.6 and 3.8 to 3.12).

Conditions

12 The General Data Protection Regulation (GDPR) has heightened citizens’ interest on how their data is being used. Government’s use of data is shaped by the need to keep it secure. Digital ways of working and risks of criminal attacks on organisations’ data mean that keeping data secure has become more important. Data must be handled according to data protection laws and with an appropriate legal basis for sharing. Well-publicised misuse of data has increased concerns and undermined efforts to communicate benefits. Departments’ concerns about retaining public trust can discourage them from looking for legal solutions to use data to maximise its potential (paragraphs 1.6, 4.2 to 4.10 and Figure 12).

13 Government has put in place the legislation to make effective and appropriate use of data easier. The Digital Economy Act 2017 provides a legal framework for establishing data-sharing arrangements to support delivery of public services and to help deal with debt and fraud. The Information Commissioner’s Office has been consulted by the government to ensure that the codes of practice for the Digital Economy Act comply with GDPR. DCMS has provided support to departments on how to use the Digital Economy Act to support public services, but departments still lack confidence (paragraphs 4.11 to 4.13, 4.20 and Figure 13).

14 Silo working can inhibit progress. There are boundaries between civil servants as well as systems. The Data Advisory Board found that return on investment for a department can often be difficult to justify in data projects because the benefits might be seen elsewhere in government. Sharing data is difficult and may be expensive and ultimately unsuccessful unless organisations understand each other’s data needs before they start commissioning technical solutions (paragraphs 4.14, 4.15 and Figure 14).

Concluding remarks

15 Past examples such as Windrush and Carer’s Allowance show how important good-quality data is, and the consequences if not used well. Without accurate, timely and proportionate data, government will not be able get the best use out of public money or take the next step towards more sophisticated approaches to using data that can reap real rewards.

16 But despite years of effort and many well-documented failures, government has lacked clear and sustained strategic leadership on data. This has led to departments under-prioritising their own efforts to manage and improve data. There are some early signs that the situation is improving, but unless government uses the data strategy to push a sea change in strategy and leadership, it will not get the right processes, systems and conditions in place to succeed, and this strategy will be yet another missed opportunity.

Recommendations

17 We direct these recommendations at DCMS and the Cabinet Office, who are responsible for drafting the data strategy and for cross-government leadership and coordination. The departments should:

a Use the data strategy to identify and address the barriers to better use of data. It should include a clearly articulated plan of work to overcome these barriers. This should provide an assessment of fundamental data issues, including safeguarding data and public trust, and plans for improving the communication of government’s approach, and potential benefits of using data more effectively.

b Set up clear cross-government accountability, governance and funding for data to support delivery of the data strategy. Joint working and cross-government groups need to have clearly assigned responsibilities that are aligned with the levers available including funding, controls and operational resources. These arrangements should be clearly communicated across government to alleviate confusion of where responsibilities lie.

c Develop cross-government rules, standards and common ways to collect, store, record and manage data. Where multiple standards are used, government should develop a consistent approach to balancing competing demands between standardisation and local requirements, including implications for future decision-making and costs. This should include a regular review of departments to ensure that they are applying these standards and principles to their data collection.

d Identify datasets that are critical to government functions, look at how to share them easily and examine how they can be enhanced by process improvement and automation. This should include an analysis of the processes, systems and data flows so their use is fully understood.

18 We direct the following recommendations at departments, recognising they are at different levels of maturity. Within this context, departments should:

e Put in place governance for data, including improving executive team understanding of the issues associated with their underlying data and the benefits of improving their data.

f Set out data requirements in business cases. This should include an assessment of the current state of the data, implications for confidence in spending decisions, and the improvements or new data that are needed to support implementation of the project. These assessments should have an explicit consideration of the ethics and safe use of the data under discussion.

g Implement guidance for front-line staff for handling data. This needs to recognise the effort and resource required to fully and consistently adopt the policy and principles created by government into the working practices of the department, including standardisation, data ethics and quality.

1 Comptroller and Auditor General, Handling of the Windrush situation, Session 2017–2019, HC 1622, National Audit Office, December 2018.

2 Comptroller and Auditor General, Investigation into overpayments of Carer’s Allowance, Session 2017–2019, HC 2103, National Audit Office, April 2019.

3 Comptroller and Auditor General, Improving government’s planning and spending framework, Session 2017–2019, HC 1679, National Audit Office, November 2018.

Part One

Introduction

1.1 In this part we set out the current landscape for data in government. We discuss:

benefits of using data across government;

current responsibilities; and

previous initiatives.

Benefits of using data across government

1.2 Getting the right data in the right place at the right time is crucial for government. It considers data to be one of its most important assets. Government needs accurate and useful data to underpin its policies, programmes and activities, and to make evidence-based decisions. As it carries out these activities, it must ensure data is safeguarded and public trust is maintained.

1.3 Successive governments have discussed the extensive benefits that they could achieve by using data to make services more efficient and joined-up (Figure 3). Joined-up working can save money for government, for example by removing duplication of effort and preventing illicit activities, such as fraud.

1.4 In June 2018 the government announced that it had asked the Department for Digital, Culture, Media & Sport (DCMS) to produce a national data strategy “to unlock the power of data in the UK economy and government, while building public confidence in its use”. The government plans to publish the strategy in 2020. It aims to produce a strategy that “positions the UK as a global leader on data, working collaboratively and openly across government”.

1.5 The government uses data to make millions of decisions every day, from checking border crossings to paying benefits and pensions. Approximately three billion transactions take place each year with government receiving or paying out at least £900 billion through these interactions. Across a lifetime an individual will interact with several different government functions. In many cases people are required to give the same information several times over (Figure 4).

1.6 Government’s use of data is shaped by the need to keep it secure. It also must demonstrate that it is being reasonable and ethical in the way it uses data, which is especially pertinent for data about individuals. Departments and public bodies are responsible for safeguarding their own information, but each department makes its own decision on what data is most important and how to prioritise protection of those assets. Since 2010, government has decided that it needed centrally driven cyber strategies and programmes to ensure that the UK manages its exposure to these risks. Our recent report Progress of the 2016–2021 National Cyber Security Programme found that the programme “was established with inadequate baselines for allocating resources, deciding on priorities or measuring progress effectively”.4

Current responsibilities

1.7 DCMS has the main responsibility for data and for use and development of the Digital Economy Act 2017.5 It will also develop the national data strategy for the government. In April 2018, it took responsibility for data-sharing, data ethics and data governance from the Government Digital Service (GDS), part of the Cabinet Office. GDS retained responsibility for supporting the digital, data and technology profession. There are several other departments with some responsibility for data (Figure 5).

1.8 In addition, there are two cross-government groups. The Data Advisory Board is chaired by the chief executive of the civil service, with membership of permanent secretaries and chief data officers. Its role is to drive better use of data in government. The Data Leaders Network is chaired and managed by DCMS, with representatives (mostly deputy directors) from the most data-rich departments.

Previous initiatives

1.9 Over the past 20 years government has published reports and announced initiatives to aim to tackle the challenges of data and data-sharing (Figure 6).

Our report

1.10 We have regularly reported on government’s use of data and its limitations. Against our principles (Figure 2) we have set out what we see as the challenges and barriers to government improving its use of data.

Part Two sets out government’s need for a clear strategy and leadership to improve its use of data.

Part Three discusses the quality, standards and systems needed to share data effectively.

Part Four sets out the conditions that are needed to maximise the value of data.

4 Comptroller and Auditor General, Progress of the 2016–2021 National Cyber Security programme, Session 2017–2019, HC 1988, National Audit Office, March 2019.

5 The Digital Economy Act 2017 covers permission to share data between public authorities in order to improve public services. The Act also covers disclosing data for the prevention of fraud and the recovery of debts owed to the public sector.

Part Two

Strategy and leadership

2.1 In this part we cover:

strategic use of data;

leadership, governance and accountability; and

funding.

Strategic use of data

2.2 The government says data is an important asset. In its 2017 digital strategy it stated that: “We must ensure data is used to its maximum potential within government to provide more efficient and responsive public services… Data is fundamental to what we do and vast quantities of data are collected, analysed and used every day”.6 However, government is not managing its data in a strategic way, as it does for other important assets. For example, the government has set up the Government Property Agency to support efforts to manage central government property strategically. Each department produces its own publicly available property strategy, in addition to the overarching strategy for government.7

2.3 Developing data strategies has not been a priority for departments. The Department for Digital, Culture, Media & Sport (DCMS) is the only department that specifically referred to data as a strategic asset in its single departmental plan.8 Five of the seven large customer-facing departments have their own data strategies, but these vary in their maturity. For example, in one department the strategy has been approved but no additional funding has been agreed to implement it. In some departments data strategies are still under development, or elements of data are incorporated into other strategies (Appendix Two).

Leadership, governance and accountability

Cross-government responsibility

2.4 While DCMS has the main responsibility for data, there are a range of other bodies involved. DCMS has responsibility for data policy and ethics and will produce the national data strategy. The Government Digital Service (GDS) has retained responsibility for data standards and leads on data skills and the digital, data and technology profession. The Office for National Statistics has retained its independent role in producing national and official statistics (Figure 5). In 2017, the government committed that by 2020 it would appoint a new chief data officer for government to lead on use of data.9 It has not done this yet.

2.5 Some departments expressed concern about a lack of overarching leadership in government. They were uncertain if DCMS has the authority or mandate as a policy department to secure change. DCMS recognises these problems and acknowledges that the current situation is confusing. It acknowledges that it has not made the progress it expected in establishing its leadership or developing the national data strategy, largely because staff were diverted to EU Exit work. It wants to develop stronger, more coordinated governance, particularly on government use of data.

2.6 There are two cross-government groups on data – the Data Advisory Board and the Data Leaders Network.10,11 DCMS provides the secretariat function for these groups. The Data Advisory Board revised its Terms of Reference in January 2019 to include responsibility for the national data strategy, which includes promoting best practice and supporting development of cross-government policies and standards. It is also overseeing a cross-government project to improve data quality and accessibility, increase data use and improve public trust.

2.7 The Data Advisory Board has also commissioned a series of projects to look at the benefits of sharing data. It has projects looking at: cross-government eligibility (for example, eligibility for residency or free school meals); identification of vulnerable people; fraud, error and debt; and demand management (Figure 7).

2.8 It is too early to assess the impact or effectiveness of these boards, but we have previously commented that cross-government groups can often lack traction, authority or influence to change departments’ ways of working (Appendix Three).

2.9 There is no central body with cross-government accountability for identifying datasets that are critical for government as a whole. In our report Digital transformation in government, we reported that, while the centre has concentrated on developing ‘registers’ (lists of how to write out and record features such as countries or local authority areas), there was little strategic overview of the data needs of departments.12 Previous attempts to map the data landscape had stalled because of its fragmented nature and the burden of detail.

Responsibility, ownership and governance within departments

2.10 Departments have not historically considered data at board level. However, there are signs of improvement. Some departments have recognised that data needs more consideration at senior levels and have appointed chief data officers. The seven departments we reviewed all had a data governance board which provides direction and oversight of a department’s data projects and data decisions. Chief data officers and those with equivalent responsibilities are establishing and refining data governance boards so that departments understand the data they have and create department-wide data rules and standards.

2.11 Most departments have not integrated data governance with their existing investment decision-making controls. For example, business cases do not need to include data availability or quality of data to assess performance, or the costs involved in cleaning data into a usable format for analysis. Some departments are making progress. For example, at the Home Office business cases over a certain value must include information on how it will deal with data to pass through the ‘technical design authority’, one of its gateways to funding. HM Revenue & Customs’ technical governance ensures new projects adhere to its internal data standards. HM Treasury has refreshed its business case guidance to consider availability of data.

Funding

2.12 Data projects are sometimes set aside when funding is under pressure. Schemes to provide basic data improvements do not always receive sustained priority for investment. For example, while the Department for Business, Energy & Industrial Strategy has produced a business-wide data strategy, it has not received additional funding to help make it possible.

2.13 It can be difficult to make the case for funding stand-alone data projects, for example to build a departmental data model, define data standards, or improve the quality of data as it comes into a department. These types of data ‘plumbing’ projects are likely to require longer-term planning, and the benefits may only be seen in future activities.

2.14 A lack of understanding of the current costs involved in cleaning, combining and improving data exacerbates the challenge. People do not monitor the time or costs involved in sorting poor-quality, disorganised data. Some departments suggested they spent between 60% and 80% percent of their time cleansing data. One department suggested it used 300 people to combine and clean data from across the country to be able to carry out a large, national-level analysis.

2.15 Current civil service funding and performance-monitoring arrangements hold government departments to account individually. This means they do not support cross-departmental working, where one or more departments need to contribute resources to support another department to achieve its objectives. The costs and benefits of cleaning up or matching data may sit with different organisations. It is encouraging that HM Treasury has said it will support cross-departmental funding bids for the next Spending Review. The Data Advisory Board (paragraph 2.6) is planning to submit a cross-government bid to coordinate action on data across departments.

2.16 High-profile policy proposals can provide the impetus to get good data-sharing arrangements in place. For example, HM Revenue & Customs (HMRC) shares real-time PAYE information (known as RTI) with the Department for Work & Pensions (DWP) (Figure 8) so that DWP can calculate entitlement to Universal Credit. This was a complex project, with data architects from HMRC working with DWP for several years to make the data systems compatible. This shows how policy imperatives, collaborative working and continued commitment despite the difficulties and complexities, can achieve results.

6 UK Government, UK Digital Strategy 2017, March 2017. Available at: www.gov.uk/government/publications/uk-digital-strategy/uk-digital-strategy (accessed 12 June 2019).

7 Cabinet Office, Departmental strategic asset management plan summaries, February 2018. Available at: www.gov.uk/government/publications/departmental-strategic-asset-management-plan-summaries (accessed 12 June 2019). Cabinet Office, Government Estate Strategy 2018, July 2018. Available at www.gov.uk/government/publications/government-estate-strategy-2018 (accessed 18 June 2019).

8 Cabinet Office, Building a country that works for everyone: the government’s plan. Available at: www.gov.uk/government/collections/a-country-that-works-for-everyone-the-governments-plan (accessed 17 June 2019).

9 UK Government, Government Transformation Strategy, February 2017. Available at: www.gov.uk/government/publications/government-transformation-strategy-2017-to-2020/government-transformation-strategy (accessed 5 June 2019).

10 The Data Advisory Board is chaired by the chief executive of the civil service, with membership of permanent secretaries and chief data officers. The minutes show that permanent secretaries have sent representatives rather than attend in person. It last met in September 2018 with papers circulated for correspondence, including agreeing the revised Terms of Reference, in January 2019.

11 The Data Leaders Network is chaired and managed by DCMS, with representatives (mainly deputy directors) from the most data-rich departments. The Data Leaders Network aims to meet quarterly, although it did not meet between November 2018 and June 2019.

12 Comptroller and Auditor General, Digital transformation in government, Session 2016-17, HC 1059, National Audit Office, March 2017.

Part Three

Data, processes and technology

3.1 In this part we examine:

data quality;

data standards; and

departments’ IT systems.

Data quality

3.2 High-quality data provides government with opportunities to deliver policies effectively and efficiently. However, perfect data is both impossible to achieve and is very costly, so departments must ensure that the data they hold is ‘good enough’ for the purpose required, which will vary depending on its use and potential re-use. Data quality can diminish over time as systems age, so departments need to regularly assess if quality is retained. The Windrush situation gives an example of the potential consequences of poor-quality data (Figure 9). The Home Office undertook elements of data-sharing activities without fully assessing the impact of the quality of the underlying data. Separately from Windrush, since summer 2017 the Home Office has been developing a data quality management model for its Borders, Immigration and Citizenship System.

3.3 In our work, we commonly find that departments cannot assess their effectiveness because of inadequate data.13 For example, we have found that the Department for Education did not collect any data from academies and maintained schools apart from annual financial information.14 In our report on Supporting disabled people to work we found the Department of Work & Pensions’ (DWP’s) approach to designing management information meant there were gaps in its understanding of how its jobcentres were providing services to disabled people.15 We also found that the Ministry of Justice (MoJ) made changes to the way probation services were delivered without adequate data (on the previously existing probation services’ methods and costs).16

Data standards

3.4 While most departments have set their own standards, it is important that data is presented in a consistent way, so that an individual, organisation, event or location can be linked across system and organisational boundaries if or when it is legally and legitimately required. Without a consistent customer record identifier, data on individuals cannot be easily merged when necessary (Figure 10). Across just 10 government bodies we found more than 20 different identifiers being used. This included several different ways of identifying businesses used across HM Revenue & Customs, the Office for National Statistics (ONS) and the Department for Business, Energy & Industrial Strategy. There are no standards in place for storing name, date of birth and address. An individual can be recorded differently in each government system. For example, Sam Jackson on one department’s system may be Samantha Jackson on another.17

3.5 The challenge that departments and government face in implementing standardised ways of recording information is balancing the benefits and drawbacks of their introduction. Introducing consistent ways of recording standard customer information will take time to embed and will require effort to assure compliance. There is also a trade-off between organising data for maximum value, and the burden it places on the information provider adhering to a stricter format.

3.6 An understanding of the costs and time spent on working around discrepancies in systems could provide some valuable information for government on how and where to focus resources. For example, where names vary across systems, where National Insurance numbers may not match or where data is recorded differently in differing local systems. In our discussions departments have suggested that between 60% and 80% of time is spent cleaning and merging data. In some areas this can equate to several hundred analysts’ time.

3.7 ONS has started to develop data standards, although these focus more on data management than on underlying data fields. The standards aim to ensure that ONS adopts a consistent, rule-based approach to data management and complies with its data and statistical policies. The Government Digital Service is also focusing on developing standards to support data exchange, but not on how to store data in the underlying systems.

Departments’ IT systems

Data in legacy systems

3.8 Most of government’s data resides in its legacy systems.18 In our report Managing the risks of legacy ICT to public service delivery, we reported that some legacy systems can be inflexible. This can lead to poorly organised data, such as the lack of a single view of a customer.19 For example, NHS England has mandated the use of the NHS number as the health service’s common patient identifier; however, many hospitals have had to persist with their own hospital record number because some software systems are unable to accommodate the longer number of digits in the NHS number.

3.9 In our report on Carer’s Allowance we commented that while the DWP used data-matching tools to help detect incorrect payments of Carer’s Allowance, some of the systems that they matched against required manual intervention.20 The newer systems provide more timely and accurate data matches, but the underlying data does not provide all the information that DWP needs, such as length of employment or allowable expenses. Officials looking at these matches therefore need to validate the carer’s circumstances manually and a shortage of staff to do this led to significant backlogs of cases.

3.10 Often departments have produced a new customer interface, for example rolling out the online application for the state pension, without fundamentally reconsidering what data their department needs and whether the current data remains fit-for-purpose. In our report Digital transformation in government, we reported that 17 of the government’s ‘Exemplar’ programmes largely redesigned the user interface online and linked it to a pre-existing system.21,22

3.11 Government has invested in technology and new analytic tools, but this does not guarantee that data in the systems is of good enough quality. Government is exploring the use of new technology, such as robotic process automation and artificial intelligence in developing public services. These have the potential to achieve large-scale efficiencies longer-term through delivering accurate and tailored services to individual customers. However, layering new technology on top of existing data carries a significant risk of magnifying rather than overcoming the problems associated with data quality, for example if calculations cannot be adequately tested.

Policy-based systems

3.12 Departments have historically developed IT systems to support specific policy objectives. They do not consider wider data needs when setting up new policies. Systems within a single department have been designed separately without building in ways that they could merge data easily. As government has sought to move to ‘customer-centred’ services, the lack of common data models, taxonomies and standards within and across departments makes it difficult and costly to maximise the value of their data.

3.13 The problem is replicated across government. For example, the different criminal justice bodies (police, prosecutors, courts, prisons and probation) each collect and organise data in different ways due to differing constitutional boundaries. This makes it difficult to assess the effectiveness of different interventions on, for example, reoffending because an individual cannot be linked easily across systems.

3.14 MoJ has been working to ‘join up’ the criminal justice system for many years. It aims to produce a ‘common platform’ to standardise data across the criminal justice system. However, this relies on around 60% of the data coming from individual police forces, which have inconsistent standards for data capture and quality. It is difficult to see how such initiatives can succeed unless government sets standards for consistency, such as how to record dates, places, and individuals’ and organisations’ names across government.

Using application programming interfaces

3.15 The Government Digital Service recommends that, wherever possible, departments use application programming interfaces (APIs) as simple and effective ways of sharing data across multiple sources. An API is a set of rules and specifications (similar to a short computer program) that enables different systems to communicate with each other.

3.16 Departments can use APIs to extract information from legacy systems, which helps to improve exchange of information and enable data-sharing. However, APIs will not on their own resolve all the issues without proper standards and a clear data model being in place. Furthermore, while it may be technically possible to introduce APIs into a legacy environment, some departments have found that it can be a difficult and expensive process (Figure 11).

13 By inadequate data we mean data which may be of low quality or where data does not exist to allow departments to make informed decisions.

14 Comptroller and Auditor General, Academies and maintained schools: Oversight and intervention, Session 2014-15, HC 721, National Audit Office, October 2014.

15 Comptroller and Auditor General, Supporting disabled people to work, Session 2017–2019, HC 1991, National Audit Office, March 2019.

16 Comptroller and Auditor General, Transforming Rehabilitation, Session 2015-16, HC 951, National Audit Office, April 2016.

17 Similar challenges come from comparing addresses, where minor differences from one file to the next may fail to match an individual’s records. However, a solution is available. Some local authorities use the Unique Property Reference Number (UPRN) as their source for addresses, to provide a strict standard to collection of address information. The government is looking at opening geospatial identifiers such as the UPRN (jointly owned by the Local Government Association and Ordnance Survey) to expand their adoption and utility in both public and private sectors.

18 We define these as systems and applications that have been operationally embedded within a business function but have been overtaken by newer technologies or no longer meet changed business needs.

19 Comptroller and Auditor General, Managing the risks of legacy ICT to public service delivery, Session 2013-14, HC 539, National Audit Office, September 2013.

20 Comptroller and Auditor General, Investigation into overpayments of Carer’s Allowance, Session 2017–2019, HC 2103, National Audit Office, April 2019.

21 Comptroller and Auditor General, Digital transformation in government, Session 2016-17, HC 1059, National Audit Office, March 2017.

22 As part of the 2012 Government Digital Strategy the Cabinet Office and departments identified 25 high-volume transactional services for end-to-end service redesign. These services were known as the Exemplar Programme and were expected to be made available to the public by March 2015.

Part Four

Conditions

4.1 In this part we examine:

safeguarding data and securing public trust;

legislation to enable change; and

skills and appetite for change.

Safeguarding data and securing public trust

4.2 Government’s use of data is shaped by the need to keep it secure. It also must demonstrate that it is being reasonable and ethical in the way it uses data, which is especially pertinent for data about individuals. Digital ways of working and risks of criminal attacks on organisations’ data means that keeping data secure has become ever more important.

4.3 Departments and public bodies are responsible for safeguarding their own information, but each department makes its own decision on what data they think is most important and how they prioritise protection of those assets. Since 2010, government has decided that it needs centrally driven cyber strategies to ensure the UK effectively manages its exposure to these risks. Our recent report on Progress of the 2016–2021 National Cyber Security Programme found that government established the programme with inadequate baselines for allocating resources, deciding on priorities or measuring progress effectively.23

4.4 Departments are accountable for keeping their own data secure in accordance with cyber security rules and the General Data Protection Regulation (GDPR). Some departments expressed concern about the safety of their data if they share it with others, especially if they cannot confirm the security arrangements in other organisations. While understandable and right, this can discourage opportunities to use data to its full potential.

4.5 In our report on Mental health in prisons we found that concerns about confidentiality can restrict healthcare teams from sharing information with prison staff on a prisoner’s mental health needs. This makes it difficult for prison officers to respond.24 We reported that staff at one prison addressed this problem by asking patients to consent to their information being shared with prison staff.

Public trust

4.6 GDPR came into force in May 2018 and the government updated the Data Protection Act 2018 accordingly. GDPR alters how businesses and public sector organisations handle the information of their customers. It boosts the rights of individuals and gives them more control over their information. The public sector has invested significant time and resources to adapt and change their policies, processes and practices to comply with GDPR.

4.7 GDPR has heightened citizens’ interest and understanding of their rights to privacy. Well-publicised reports of misuse of data, such as those surrounding Facebook’s sharing of data with private companies, have increased concerns about how information may be used, shared and exploited. For example, at the initial stages of the ‘care.data’ programme, there was insufficient focus on how to gain patient acceptance to share their data. NHS England eventually cancelled care.data following opposition from GPs as well as patients (Figure 12).

4.8 Legitimate sharing of data can have significant benefits. There are efforts to alleviate citizens’ concerns by increasing communication and understanding of how data might be used by others. The Department of Health & Social Care has supported an independent initiative led by the Wellcome Trust called ‘Understanding Patient Data’. The purpose is to enable conversations with the public about how and why data can be used for care and research, for example explaining how this can support the development of new treatments, what is allowed and what is not, and how personal information is kept safe.

4.9 If data-sharing initiatives are to be trusted and supported by the public, it is important that communication is not just about trying to persuade people of the benefits, without addressing the risks and being responsive to their concerns. For example, Understanding Patient Data undertakes and collates research into public views and perceptions about health data use and feeds these into policy and governance decision-making discussions, to help create more trustworthy systems for using data.

4.10 Transparency, communication and clarity about the way in which data is used are necessary for building public trust, and for providing the confidence to share data legitimately. For example, HM Revenue & Customs publishes its data-sharing arrangements. This has benefits on several levels: for its staff, to know whether it is safe and legal to respond to a data request; for other organisations, to know if an agreement is already in place; and citizens, to understand who else may see their tax data.

Legislation to enable change

4.11 Many people in government believe legislative barriers limit their ability to use and share data in the public sector. Government sought to overcome some of these barriers by changing the law. In April 2017 it passed the Digital Economy Act (the Act), which changed the legislation to make sharing of data possible.25 This includes enabling the sharing of personal data between public authorities to improve how public services are delivered to improve the well-being of individuals and households. The Act also covers the disclosure and exchange of personal data for the prevention of fraud and the recovery of debts owed to the public sector.

4.12 The Information Commissioner’s Office advises government on sharing data confidently and legitimately. The government consulted the Information Commissioner’s Office regarding the consistency of the codes of practice issued under the Act and GDPR. However, the codes are necessarily at a high level because they apply across a wide range of public bodies. Some departments have therefore mistakenly believed they cannot apply the rules to their own circumstances.

4.13 The time taken to establish information-sharing agreements under the various powers within Part 5 of the Act will vary. Some information-sharing agreements can take several months to come to fruition. There is a public service Delivery Review Board which considers proposals for new usage of the public service delivery power.26 Once the board has accepted the proposal, it provides advice to the minister, who must ultimately agree or disagree to the proposal (Figure 13). This is a lengthy process, which could act as a disincentive to pursuing data-sharing opportunities.

Skills and appetite for change

Ways of working

4.14 Sharing data is difficult and may be expensive and ultimately unsuccessful unless organisations understand one another before they start commissioning technological solutions. One example of a challenge that impacts on individual and business support is historic ways of working (Figure 14).

4.15 Similarly, the Data Advisory Board (paragraph 2.6 and Figure 7) noted that data initiatives with a positive return on investment for government would not necessarily provide a return on investment for the department investing in the resourcing and infrastructure. We know from our work that civil servants are used to working within departmental boundaries, which is an extra hurdle to setting up and maintaining cross-departmental initiatives, including data-sharing.27

4.16 The Office for National Statistics (ONS) has worked to make it as easy as possible for local authorities to work together to provide council tax data for the 2021 census. ONS identified that three companies provide the revenue and benefits systems for all but two of the 380 local authorities that collect council tax. ONS worked with these companies to develop software to automatically extract the data each month. ONS will provide this software to local authorities for free. It has also developed a secure transfer system; a standard data protection impact assessment; and a data-sharing agreement for local authorities to use if they wish. More than 100 local authorities have signed up to provide the data so far. Others are yet to reply or are seeking further clarification from the ONS. Only 21 have refused.

Improving skills, capability and understanding

4.17 Departments need to have skills at several levels: to understand how to use legislation appropriately for legitimate data-sharing; to know the limitations of the data they hold; and what is needed to fix the problems. Those at senior levels need to understand the implications of poor data to help provide the influence at higher levels and gain traction for improvements.

4.18 Departments may also find it beneficial to enhance the skills and understanding of executive board members to raise their awareness of the importance of good-quality data to their business. For example, the Ministry of Housing, Communities & Local Government has provided training for chief executives and political leaders in local authorities to help support better use of digital services across local areas.

4.19 Some departments have previously struggled to understand how to share data effectively for research, but departments are starting to understand how best to support the needs of others. For example, the Department for Education previously shared around 500 different versions of the national pupil database with several hundred different organisations (for research, statistics and policy development). Its new chief data officer recognised the risk and placed the national pupil database in a secure environment with access limited to accredited parties.

4.20 The Digital Economy Act has so far not given departments the reassurance they need to be confident about sharing data legally. Our discussions with departments have shown us that they would welcome more support on how to use the Act appropriately to support data-sharing. The Department for Digital, Culture, Media & Sport is undertaking a series of roadshows to help support people to use the Act and understand where it might be appropriate. This will include case examples which can be helpful for users. It is also developing a data processing and sharing framework to help departments.

23 Comptroller and Auditor General, Progress of the 2016–2021 National Cyber Security programme, Session 2017–2019, HC 1988, National Audit Office, March 2019.

24 Comptroller and Auditor General, Mental health in prisons, Session 2017–2019, HC 42, National Audit Office, June 2017.

25 The information-sharing powers within Part 5 of the Act became fully operational in July 2018 when the codes of practice associated with them were approved by Parliament and published. They enable the sharing of information between specified organisations for specific purposes.

26 Each area of the Digital Economy Act has its own review board to consider proposals for data-sharing under the powers of the Act.

27 Comptroller and Auditor General, Building capability in the Senior Civil Service to meet today’s challenges, Session 2013-14, HC 129, National Audit Office, June 2013.

Appendix One

Our audit approach

Scope

1 This report draws together our experience of government’s use of data. It reports what we see as the challenges and barriers which have limited government in making the progress it expected from previous attempts to improve the use of data. We have set out our thinking on what is needed to improve using data across government so that data is used effectively to improve services and make better decisions. We have examined if:

there is strategy and leadership in place within and across departments to support better use of data;

the infrastructure is in place to support successful use of data; and

the conditions are in place to support successful use of data.

2 Our approach to our landscape review is shown in Figure 15.

Methods

3 We have based our analysis primarily on a review of our published reports and supplemented this review with interviews and documents from across government organisations. We undertook our fieldwork between January and April 2019.

4 We interviewed relevant officials responsible for central coordination of data or funding, including:

Department for Digital, Culture, Media & Sport

Government Digital Service

HM Treasury

Information Commissioner’s Office

Office for National Statistics.

These interviews were designed to help us understand the role of the centre of government in coordinating efforts to improve data use across government and arrangements in place to support departments.

5 We interviewed officials at chief data officer level or similar with responsibilities for data from the following departments, agencies and organisations with public or business-facing roles:

Department for Business, Energy & Industrial Strategy

Department for Education

Department of Health & Social Care

Department for Work & Pensions

Driver and Vehicle Licensing Agency

HM Passport Office

HM Revenue & Customs

Home Office

Local Government Association

Ministry of Housing, Communities & Local Government

Ministry of Justice

NHS Digital

NHS England.

These interviews were designed to help us understand what departments do to understand and manage their own data needs and how they can work with other departments to improve services and standards.

6 We reviewed relevant documents at seven central government departments and executive agencies that members of the public interact with. The documents included data strategies, data governance arrangements and board papers to assess the importance that departments place on their data to run their business. We assessed these documents against a standard NAO framework looking at: strategy; business alignment; and governance.

7 We held an expert panel discussion on 1 May 2019 with 19 organisations from inside and outside government. We used the discussion to test our emerging views of the challenges and barriers faced by government.

8 We reviewed relevant external literature and reports relating to data-sharing.

9 From our reviews and discussions with departments and agencies we identified case examples which demonstrate the challenges faced or successes achieved through departments’ attempts to share data.

Appendix Two

Analysis of departmental data strategies and documentation

Appendix Three

Analysis of previous National Audit Office reports examining central government coordination

Appendix Four

Practical steps for government to improve use of data

See Figure 18.

Design and Production by NAO External Relations
DP Ref: 006468-001