Police Pension Scheme · CAS-68294-S6L1

CAS-68294-S6L1

Ombudsman’s Determination Applicant Mr L

Scheme Police Pension Scheme (Northern Ireland) (the Scheme)

Respondents Northern Ireland Policing Board (the Board) PSNI Pensions Branch (the Administrator)

Outcome

Complaint summary

Background information, including submissions from the parties

On 30 April 2020, the Administrator issued a statement (the April 2020 Statement) via a newsletter on the Scheme’s website stating:

“[The Administrator is] aware that some [pension] payslips collected by Royal Mail at the end of March [2020] for delivery to pensioners remain undelivered. Investigations are ongoing with Royal Mail to establish what has occurred with a view to identifying the location of these outstanding payslips and to ensure completion of delivery and why this has happened. No details on the payslip identifies any person as being an ex-officer, and there are no anticipated security implications…”

1 CAS-68294-S6L1 On 2 May 2020, Mr L emailed the Administrator and complained that:

• A report in “the news” had suggested that a number of pension payslips had been “lost”. So, he would like written confirmation that this would not cause a “threat”, since he is a former PSNI officer, and personal identifying information had been contained in his April 2020 payslip.

• He would also like clarification regarding any steps taken to investigate what had happened to the missing pension payslips, and that the matter would be referred to the Information Commissioner’s Office (ICO).

On 4 May 2020, Royal Mail informed the Administrator that 25 bags containing 75% of the April 2020 Payslips had been found.

On 5 May 2020, the Administrator received confirmation from Royal Mail that the remaining 25% of the April 2020 Payslips that were missing had been located.

In early May 2020, Mr L received his April 2020 pension payslip and May 2020 pension payslip on the same day.

On 6 May 2020, Mr L emailed the Administrator to complain that there had been a delay in responding to his complaint.

On 7 May 2020, the Administrator’s Data Protection Officer (the DPO) emailed the ICO to report the incident involving the delayed delivery of the April 2020 Payslips (the incident) and said the matter had not been reported on 30 April 2020 because at that time:-

• Only around 30 members had raised concerns regarding the incident.

• No security implications relating to the information contained in the April 2020 Payslips had been found.

• The reason for some members not receiving their pension payslip was identified as resulting from a delay at Royal Mail rather than loss.

• There had been no media coverage of the incident.

• The possibility of risk or any impact to members resulting from the incident was rated as low.

The DPO also confirmed that Royal Mail had found 25 bags containing the April 2020 Payslips on 4 May 2020, by which time, 644 reports regarding the incident had been received from members.

ICO emailed the DPO in response and confirmed that a detailed explanation of the incident had been received.

2 CAS-68294-S6L1 On 15 May 2020, Mr L emailed the Administrator to complain that he had not received acknowledgement regarding his previous complaints of 2 May 2020 and 6 May 2020.

On 18 May 2020, the Administrator emailed Mr L and said:-

• A significant number of enquiries had been received from other members regarding the incident. There had also been restrictions on the Administrator’s staffing levels because of the COVID-19 pandemic. This had caused the delay in responding to his enquiries.

• When Royal Mail collected the April 2020 Payslips at the end of March 2020, it was also experiencing operating issues due to the COVID-19 pandemic, which meant that the payslips remained undelivered for an extended period.

• Upon becoming aware that the April 2020 Payslips were missing, an investigation was launched in collaboration with Royal Mail Security Division (Royal Mail Security) to locate them. The payslips were subsequently found in Royal Mail’s sorting office (the Sorting Office) and none had been opened.

• PSNI Security Branch also reviewed the situation regarding the April 2020 Payslips. Its Senior Investigating Officer (the SIO) who conducted the review concluded that there was no information contained in the payslips that could identify Mr L as being a former PSNI officer.

• The SIO also established that there had been no criminal act or loss involving the April 2020 Payslips. The security of pensioner members is considered to be very important. So, a review of how they are contacted in future would be undertaken.

On the same day Mr L emailed the Administrator and complained that this response was inadequate; he requested answers to the following questions:-

• The Administrator had not provided any details about the investigation regarding the incident. So, how could he be confident that there was no risk to his personal security?

• What was PSNI Security Branch’s position on the incident.

• How did PSNI Security Branch inform the Administrator that his personal security was not at risk?

• Why had PSNI Security Branch not contacted him personally?

• Why was a “Franking Number” quoted on his May 2020 pension payslip lower than that quoted on his April 2020 pension payslip?

• Why was his April 2020 pension payslip delivered on the same day as his May 2020 pension payslip?

On 19 May 2020, the Administrator wrote to Mr L and said:- 3 CAS-68294-S6L1 • PSNI Security Branch had reviewed the content of the April 2020 Payslips and established that none of the information either on the inside, or on the outside would identify any member as being a former PSNI officer.

• Both the Administrator and PSNI Security Branch worked alongside Royal Mail Security in investigating any issues surrounding the April 2020 Payslips. As part of this process, the Royal Mail worker who collected the payslips was interviewed and their process of delivering them to the Sorting Office was analysed.

• Royal Mail found all of the April 2020 Payslips unopened in mail bags at the Sorting Office. So, PSNI Security Branch closed its own investigation after concluding that there was no security risk to any members. Consequently, PSNI Security Branch did not consider it necessary to contact individual members.

• The Scheme’s pension payslips are produced with a pre-printed franking mark on the front of each slip, it is not printed each time a member’s personal details are added. Royal Mail may subsequently print a “Franking Number” on the pension payslips that the Administrator is unable to account for.

• He received his April 2020 pension payslip with his May 2020 pension payslip as Royal Mail had processed them for delivery at the same time. The April 2020 Payslips were found at the same time as the Scheme’s May 2020 pension payslips (the May 2020 Payslips) were collected by Royal Mail.

On 22 May 2020, Mr L referred his complaint under stage one of the Scheme’s Internal Dispute Resolution Procedure (IDRP) and said:-

• He had made three complaints to the Administrator but his grievances were not dealt with as complaints.

• The fact that the April 2020 Payslips had gone missing was reported in the media, which highlighted the problem to the general public, and increased his insecurity.

• He felt that there was a threat to his personal safety resulting from the April 2020 Payslips having been ‘lost.’

In June 2020, the Administrator wrote to Mr L in response and said:-

• Once notification was received from some members that they had not received the April 2020 Payslips, Royal Mail was contacted to check whether it had a processing delay. The Administrator then compiled an incident report with regard to possible data protection breaches.

• The report was subsequently provided to the DPO, and sample copies of the April 2020 Payslips assessed as to the information contained in them from security and data protection perspectives.

4 CAS-68294-S6L1 • Royal Mail considered that the April 2020 Payslips were in its system as part of a backlog caused by staffing issues. Due to this fact and the low level of potential “risk” to members, the incident did not immediately warrant a report to the ICO.

• Nothing other than a service delay at Royal Mail was ever found, even after the SIO was tasked with monitoring for any evidence to the contrary. All of the April 2020 Payslips were found, with no evidence of having been opened.

• The May 2020 Payslips were also delivered to members during this period, following additional steps with Royal Mail security staff to provide assurance that all the payslips would be collected and processed safely. It was not possible to comment on Royal Mail’s franking procedures once the payslips were in its possession.

• There would be a post-incident review involving the Administrator’s data protection and security branch staff regarding possible changes in the methods of communicating with retired members. “All parties” would also be consulted with the understanding that email may not be a viable option for every member.

On 8 June 2020, Mr L wrote to PSNI’s Chief Constable (the Chief Constable) complaining that he had not received satisfactory responses to the complaint he had raised with the Administrator.

On 22 June 2020, PSNI’s HR Department wrote to Mr L on behalf of the Chief Constable and said Mr L had received a comprehensive account of the incident and received the assurances he had sought relating to the security of his personal information.

On 30 July 2020, Mr L appealed under stage two of the IDRP.

On 19 October 2020, the Board, the Scheme’s manager, wrote to Mr L in response and said:-

• The Administrator’s email of 18 May 2020 confirmed that there had been no threat to him resulting from the incident. The email also appropriately explained that the incident was due to internal issues that Royal Mail was experiencing at the time, and that investigations had been undertaken by both PSNI Security Branch and the Administrator.

• The incident and the investigations into it occurred during the early stages of the COVID-19 pandemic in 2020. The Administrator’s 10-working day timescale for responding to his complaint of 2 May 2020, had not been unreasonable in those circumstances.

• The information provided in the email of 18 May 2020 was expanded on in the Administrator’s subsequent email dated 19 May 2020. It explained the role of PSNI Security Branch in the investigation into the incident, and that the Administrator had referred itself to the ICO.

5 CAS-68294-S6L1 • The stage one IDRP response letter had further elaborated on the information previously provided to him. The letter also included assurances regarding his personal security and the investigations following the incident. There was no evidence the Administrator had failed to respond following any complaints that he had raised.

Mr L’s position

His April 2020 pension payslip was delivered by Royal Mail a month late, and on the same day as his May 2020 pension payslip. The April 2020 pension payslip was unopened and did not appear to have been “tampered with.”

A “Franking Number” printed on the outside of the April 2020 pension payslip seemed to be higher than that on the May 2020 pension payslip. He considered that these “Franking Numbers” would facilitate a check of the time and date on which the payslips were printed.

He has attempted to find out what the “Franking Numbers” relate to but has been unable to find anyone who can comment on them. A full copy of the printout used by the Administrator to populate his April 2020 payslip may contain evidence to support his position that the payslip was ‘lost’ then subsequently reprinted and posted.

He has no evidence that a third party has information that could only have been obtained from his April 2020 pension payslip. Neither has any evidence been provided that the payslip was ever recovered. PSNI was at fault for failing to disclose that the April 2020 Payslips had been “stolen.”

There is no evidence that a “full investigation” into the incident has been completed by PSNI, the Board or the ICO since different accounts have been provided by each party that has commented on the subject of investigations.

The answers to the questions he has raised do not support the Administrator and the Board’s assertion that a full investigation was completed. Numerous other members were affected by the incident during which the April 2020 Payslips were ‘lost’.

The security implications of the incident have caused him distress and inconvenience regarding his personal safety. So, he would like answers to the questions he has raised.

The Board and the Administrator’s position

Mr L has been contacted on numerous occasions to clarify the situation regarding the incident and any related data protection implications.

The April 2020 Statement was posted on the Scheme’s social media account and sent in response to any email or telephone enquiries from members regarding the incident, in addition to being made available via the Scheme’s website.

Mr L’s April 2020 pension payslip was not lost and reprinted; he was sent the original version that had been collected by Royal Mail at the end of March 2020. 6 CAS-68294-S6L1 The ICO was informed of all actions taken by the Administrator and the Board relating to the Incident, and the ICO was satisfied that there had been no data protection breach.

Following the incident, a review was undertaken as to how the Scheme’s pensioner members would be contacted in future (the Review). It involved senior staff in the Administrator’s Financial Services Division and Security Branch.

The review established that it would not be feasible to send pension payslips by email. However, a check was carried out to ensure that any wording on the inside and outside of the pension payslips could not identify any former PSNI officers.

Adjudicator’s Opinion

7 CAS-68294-S6L1

• In the Adjudicator’s view there was no maladministration by either the Administrator or the Board that has caused Mr L to suffer distress and inconvenience. Robust steps have been taken to reassure Mr L that this matter has been investigated thoroughly.

The Board and the Administrator accepted the Adjudicator’s Opinion, Mr L did not, and the complaint was passed to me to consider. I note the additional points raised by Mr L but I agree with the Adjudicator’s Opinion.

8 CAS-68294-S6L1 Mr L’s additional comments

A member does not receive a pension payslip unless there is a difference in the pension instalment of over £1 from the previous month.

There were around 16,000 of the April 2020 Payslips, including his own April 2020 pension payslip that were collected by Royal Mail on 30 March 2020. The April 2020 Payslips were not subsequently accounted for until 5 May 2020, so they were missing for over a month.

Despite the significance of the Incident the DPO delayed reporting it to the ICO until three weeks after the April 2020 Payslips ought to have been delivered. Neither the Board nor the Administrator has subsequently provided him with evidence that the Incident was investigated by Royal Mail or PSNI.

He eventually received his April 2020 pension payslip in early May 2020 on the same day as his May 2020 pension payslip was delivered by Royal Mail. However, the April 2020 Payslips had been found much earlier. So, it remains unexplained why the two pension payslips were delivered on the same day in May 2020.

The significance of the “Franking Number” on his April 2020 pension payslip has not been investigated to establish the date on which it was posted.

The Board and the Administrator did not respond promptly to his complaints regarding the delay in delivering his April 2020 pension payslip. There was also a lengthy delay before the Board responded to his complaint under the IDRP.

He has been provided with no information regarding the Review, and the Scheme’s pension slips appear to still be printed and posted in the same way as at the time of the incident.

Ombudsman’s decision

I note that the DPO reported the Incident to the ICO on 7 May 2020. I consider that this report sufficiently explained why the Administrator had not contacted the ICO regarding the Incident earlier. On the same day, the ICO acknowledged that a detailed report had been received, and it did not require the Administrator to take any further action.

By 5 May 2020 all of the April 2020 Payslips had been located by Royal Mail. So, I find that there is no evidence that Mr L’s April 2020 pension payslip was ever ‘lost’. Further, the Administrator has confirmed that it is not responsible for any “Franking Numbers” that Royal Mail may have added to Mr L’s April and May 2020 pension

9 CAS-68294-S6L1 payslips once they had been collected. So, there was no requirement for the Board or the Administrator to investigate the “Franking Numbers” Mr L has referred to.

The Board and the Administrator were satisfied that the April 2020 Payslips had been collected on 30 March 2020, and that the delay in delivering them resulted from operating issues Royal Mail was experiencing due to the COVID-19 crisis. I find that neither the Board nor the Administrator can be held responsible for the delayed delivery of Mr L’s April 2020 pension payslip once it was in the possession of Royal Mail.

The COVID-19 crisis adversely affected a large number of organisations. So, there was nothing unusual in the Board or the Administrator accepting this as the cause of the delay. There is also no evidence that Mr L’s April 2020 pension payslip was delivered on the same day as his May 2020 payslip for any other reason than Royal Mail processed those payslips for delivery at around the same time.

Mr L had first complained about his missing April 2020 pension payslip on 2 May 2020, and he subsequently followed this up on 6 May 2020 and 15 May 2020. The Administrator wrote to Mr L on 18 May 2020 confirming that there had been a delay in responding due to the COVID-19 crisis. That delay of around two weeks from the initial complaint does not amount to maladministration by the Administrator, especially due to the circumstances at the time.

The Administrator also confirmed that a joint investigation had been launched with Royal Mail Security, and that the April 2020 Payslips were found unopened in the Sorting Office. The Administrator said that another investigation by the SIO had established that there was no personal information contained in Mr L’s April 2020 payslip that could identify him as a former PSNI officer. There had also been no criminal activity involved in the Incident.

Further there was no delay in either the Administrator or the Board responding to Mr L under the IDRP. Following Mr L’s complaint at stage one on 22 May 2020, the Administrator wrote to him in June 2020. The Board subsequently wrote to Mr L on 19 October 2020 following his complaint of 30 July 2020 under stage two of the IDRP.

I note that the Administrator had consistently maintained that there were no security implications for Mr L resulting from the Incident, even before this was confirmed by the Administrator and the Board in their letters previously mentioned (see paragraph 54 above).

The Administrator was also prudent in deciding to initiate the Review. The format of the Review, the individuals asked to participate in it, and any resulting changes in communicating with pensioner members, were matters for the Administrator to consider.

So, I find that there was no maladministration by the Board or the Trustee regarding Mr L’s April 2020 pension payslip and the responses to the complaints that he raised

10 CAS-68294-S6L1 regarding it. Consequently, there was no distress and inconvenience caused to Mr L by the actions of the Board or the Administrator.

I do not uphold Mr L’s complaint.

Anthony Arter CBE

Deputy Pensions Ombudsman

20 May 2024

11