Re: This is just getting ....
NI Cards say on them that they are not proof of anything. It's a cheap plastic card with punched numbers, I could knock one up from bog-standard office/conference card kits in about 3 minutes with any details you liked.
However, I would have just brought in the lawyers in year 1 and got it sorted rather than let someone freeload at my expense for 20 years and then only complain when you're marked as dead.
I have sympathy for your situation occurring. I don't have much sympathy for you letting it linger for 20 years, because by then it's pretty much impossible to work out what is what because the records just don't go back that far. 20 years ago, the system probably wasn't even mainly IT-based (though there might have been an IT frontend of some kind for various things).
That said, IT projects always turn to junk. I'd put the blame squarely on the fact that most of the people involved in designing the system have zero knowledge of IT. That's fine for the USERS, not for the implementers and not for the project managers. And invariably it will end up late, over-budget, not fit for purpose but the contracts won't have anything that holds anyone accountable for that. Then next decade we run the gauntlet again with another new system rather than fixing the old one.
I would have infinitely more confidence in a government IT project if, when I walked in the door, they were using desktop PCs with precisely ONE ICON to interface with a 1980's teletype system that has been running forever and looks as ugly as hell. I would then have a subconscious expectation that it would actually do what it is supposed to.
I blame general purpose operating systems. Back when you had a screen where the only way to progress WAS to type 1, 2, 3, 4 or 5, the systems were designed well, under control, not subject to user whims about their data entry, and pretty much stopped intrusion and abuse at the front door because you could only do what you were told to and only through the provided interfaces.
I'd love to hear why any IT project for something like this needs a general purpose operating system as the front-end, except as a carrier for some limited, secured, cross-platform interface.