Legal Aid Agency data breach: information for members
Led by our president, Richard Atkinson, the Law Society has been actively engaging with the LAA every day to raise solicitors’ concerns and get clarity on processes during the contingency phase – especially urgent billing arrangements.
We’re in regular contact with Ministry of Justice (MoJ) ministers, interested parliamentarians and legal media.
The LAA has also created a web page to share the latest updates following the cyber-attack.
Payments
The LAA has confirmed it is able to make payments to firms.
However, a range of different billing arrangements have had to be set up.
Crime lower
For lower crime work, the LAA has received manual submissions from or been in touch with all criminal providers.
All firms will receive their monthly payment within the usual timeframe.
Crown Court
For Crown Court work, the LAA has confirmed it is now able to process bills for work under the Advocates’ Graduated Fee Scheme (AGFS) and Litigators’ Graduated Fee Scheme (LGFS).
Payments will begin during the week commencing 2 June but there will be a backlog.
The LAA advises firms to continue to submit bills via Claims for Crown Court Defence (CCCD) in the normal way.
Civil
The LAA has set up a civil payment contingency scheme.
Details for this have been sent to firms and shared on the LAA website.
Firms will need to opt in every week to receive a payment.
To opt in, you must let the LAA know by midday each Monday to make that week’s payment run, starting from 2 June.
The Solicitors Regulation Authority (SRA) has confirmed that payments should be paid into your office account.
The SRA does not consider that this money is client money.
But, even if it were, legal aid payments for costs are excluded from the requirement for client money to be paid promptly into the client account.
We argued strongly against firms having to opt in weekly. It will cause undue bureaucracy for both firms and the LAA.
The LAA has said it will review the arrangements after a fortnight.
Value added tax (VAT)
Payments may include sums that would be due as VAT on a final bill.
We do not believe VAT is due on these payments.
However, you should make sure you can meet your VAT liabilities when you are eventually able to submit your final bills.
Financial hardship
If you believe your firm will suffer undue hardship despite these payment arrangements, speak to your contract manager.
They may be able to provide further assistance.
New legal aid orders
The LAA still cannot accept any new orders other than urgent applications for civil legal aid.
There is currently no indication of when this might change.
We recognise that priority had to be given to payment mechanisms.
However, the current situation is unacceptable.
We continue to press the LAA to address this as a matter of urgency.
For applications for new legal aid orders, the LAA has indicated it will agree to backdate orders for all cases, including indictable only cases.
The LAA expects to be able to restore the MAT number process imminently.
LAA call centre and frequently asked questions (FAQs)
The LAA advised it will have additional capacity for its call centre from Tuesday 27 May.
Visit the LAA web page for updates on the cybersecurity incident.
Read answers to frequently asked questions provided by the LAA.
Next steps
In the longer term, the LAA will launch new or revamped systems and will notify members what they need to do to operate on those systems.
Priority is being given to crime. Civil and family will move to the new system afterwards.
We do not feel we have enough clarity yet to indicate when these new systems will be available.
We are continuing to raise with the LAA all the practical questions members are flagging to us. This includes:
- highlighting the stress and cost the incident is placing on our members, and
- working with the LAA to minimise the impact on providers, who are being adversely affected by this major breach through no fault of their own
We strongly recommend firms keep a record of any time and costs incurred as a result of the breach, in case it becomes appropriate to make a claim for compensation to the LAA.
Online portal
The LAA’s online portal remains offline.
All providers should have received guidance directly from the LAA around what to do while the online portal is unavailable.
This includes:
- civil applications: if you cannot use delegated functions and have an imminent court hearing, contact the LAA customer services team on 0300 200 2020
- crime applications: providers are currently unable to gain date stamps for applications. When applications can be submitted via the portal again, include the intended submission date in the ‘Further information’ section and LAA caseworkers will backdate as appropriate
- crime lower and legal help monthly submissions: if you haven’t submitted your April CWA data, email your total monthly submission value to reconcilitation@justice.gov.uk by 20 May
More information on legal aid applications and billing contingencies can be found in the LAA bulletin (updated 21 May).
Informing clients
As the data controller, the LAA is responsible for informing individuals whose personal data may have been affected by the breach.
The LAA has notified them through its public statement.
Firms do not need to take any additional action.
If your clients’ personal data may have been affected, the National Cyber Security Centre (NCSC) has guidance on how they can protect themselves from the impact of a data breach.
What we know
According to the LAA, a significant amount of personal data belonging to individuals who applied for legal aid through its digital service from 2010 onwards may have been stolen.
“It is extremely concerning that members of the public have had their personal data compromised in this cybersecurity incident and the LAA must get a grip on the situation immediately,” said Law Society president Richard Atkinson.
“It is the LAA’s responsibility to contact all the legal aid applicants whose data has been compromised.”
We continue to emphasise the need for the LAA to provide clear and timely information to legal aid providers and to take urgent steps to prevent future breaches.
Impact on legal aid providers
“Legal aid firms are small businesses providing an important public service and are operating on the margins of financial viability.
“Given that vulnerability, these financial security concerns are the last thing they need,” said Richard.
At the current time, the LAA is unable to field queries from individuals about the impact of the breach.