The legislation requires the Auditor General to consult on and prepare a code of practice to govern her data matching exercises, and to lay it before the National Assembly for Wales. In 2008, the Auditor General prepared a Code of Data Matching Practice (the Code) as required under the provisions of the Serious Crime Act 2007. Following an extensive public consultation exercise, the Code was laid before the National Assembly and approved in 2008.

Under the legislation, the Auditor General may carry out data matching exercises for the purpose of assisting in the prevention and detection of fraud, as part of an audit or otherwise. The Auditor General may require certain bodies to provide data for data matching exercises. Currently these are all local government bodies (as defined in the Public Audit (Wales) Act 2004¹  and NHS bodies in Wales. Other bodies may participate in its data matching exercises on a voluntary basis where the Auditor General considers it appropriate. The requirements of the Data Protection Act 1998 continue to apply.

The Auditor General may disclose the results of data matching exercises to bodies that have provided the data and to the auditors that he appoints. The Auditor General may also disclose both data provided for data matching and the results of data matching to the Audit Commission, the Comptroller and Auditor General for Northern Ireland, the Auditor General for Scotland, the Accounts Commission for Scotland and Audit Scotland, for the purposes of preventing and detecting fraud.

The processing of data by the Auditor General in a data matching exercise is carried out with statutory authority. It does not require the consent of the individuals concerned under the Data Protection Act 1998.

¹The definition of local government bodies in the Public Audit (Wales) Act 2004 covers unitary authorities, community councils, committees of local authorities, including joint committees of two or more local authorities, port health authorities, National Park authorities, conservation boards, police authorities, fire and rescue authorities, internal drainage boards, probation boards and probation trusts.