Guidance on deletion of definite match pension identifiers (PeIs)

Overview

This guidance explains how pension providers and schemes, or their third-party connection providers, should delete pension identifiers (PeIs) registered as definite matches following: 

• Registration errors: Such as technical or administrative errors causing duplicate PeIs being registered for the same user and the same pension.
• Matching errors: Where the wrong user has been matched to the pension.

This helps the Money and Pensions Service (MaPS) and regulators differentiate between PeI deletions in the central digital architecture’s management information. In particular, visibility of deletions of erroneous matches supports understanding and assessment of risk within the ecosystem, informing service launch readiness. 

We request that pension providers and schemes (or their third-party connection providers) follow this guidance. We intend to update the technical standards in due course to make this differentiation part of the compulsory framework. 

The available deletion reasons for deletions of definite match PeIs 

The technical standards set out the possible PeI deletion reasons and transition pathways in paragraph 121:

A registered PeI can then be deleted for one of 4 reasons. Only the first 2 are possible for PeIs registered as match-yes: 

1. The pension is no longer reportable (for example, it has crystallised or transferred): Given the deletion_reason of asset-removed. 
2. It was registered erroneously: Given the deletion_reason of match-withdrawn.
3. There has been no contact within 30 days or the possible match cannot be resolved: Given the deletion_reason of  match-timeout. 
4. The possible match is confirmed not to be a match: Given the deletion_reason of match-no. 

As per the diagram, for possible match PeIs the available deletion reasons are: 

• asset-removed 
• match-withdrawn 
• match-timeout 
• match-no 

For definite match PeIs, the available deletion reasons are: 

• asset-removed 
• match-withdrawn 

This guidance addresses an ambiguity in the technical standards around the use of 'match-withdrawn'. In the diagram above, the use case for definite match deletions with reason code 'match-withdrawn' is described as 'registered erroneously'. The description in paragraph 100 refers to the use case of ‘an erroneous match made’.

When to use 'match-withdrawn' for definite match PeI deletion 

Pension providers and schemes should distinguish between:  

• Registration errors: Such as technical or administrative errors causing duplicate PeIs being registered for the same user and the same pension. 
• Matching errors: Where the wrong user has been matched to the pension. 

This expands the use cases for the ‘asset-removed’ deletion reason to include the new use case of technical/administrative errors causing duplicate registrations of definite match PeIs relating to the same (correctly matched) user. This is in addition to the specified use cases of a pension falling out of scope for dashboards through being crystalised or being transferred out. 

This avoids the need for MaPS and directly connected organisations (DCOs) having to investigate the circumstances of definite match PeI deletions, deleted with the reason code ‘match-withdrawn’, while supporting the differentiation between matching errors and registration errors.  

In addition to deleting incorrectly matched PeIs, if a member’s pensions information is disclosed to someone other than the member, pension providers and schemes, as data controllers, and their third-party processors (administrators and connection providers), should investigate, assess and document the incident and make any required notifications in relation to any rectification and data breach reporting.

MaPS may monitor matching errors but is not responsible for identifying, investigating or reporting any resulting personal data breach. 

What if this change cannot be implemented immediately?

If a DCO needs to make technical or system changes to support the requested use of ‘match-withdrawn’ for definite match PeI deletion only for matching errors and the use instead of ‘asset-removed’ for cases of registration errors relating to the correctly matched individual, MaPS requests that the DCO then:

• records, for every time it deletes a definite match PeI with the reason ‘match-withdrawn’ the reason for the deletion and whether it was a case of the wrong person being matched, or a registration/administrative/technical registration error relating to the correctly matched person
• manually reports this information to MaPS on a calendar monthly basis via the PDP support portal until the DCO is able to make the requested change to definite match PeI deletion reasons

Does this apply to DCO PeI deletions following CDA user account deletion?

No – this applies to DCOs deleting PeIs from the CDA. Once users’ CDA accounts have been deleted, removing all PeIs, rectification of DCO records in their systems as per the User account deletion in the central digital architecture (CDA) guidance is simply to reconcile DCO records with the CDA state, and the deletion reasons as per the technical standards need not apply, as the PeIs have already been removed from the CDA.