Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ----- Original message -----
- From: casework@ico.org.uk
- To: [redacted]
- Subject: Your DPA query about the DWP,MWS and UJM[Ref. RFA0580147]
- Date: Fri, 15 May 2015 [redacted]
- 15 May 2015
- *Case Reference Number RFA0580147*
- Dear [redacted],
- Thank you for your enquiry in relation to the role of the DWP in
- relation to information held by work programme (WP0 contractors,
- www.myworksearch.co.uk[1] and the Universal Job Match (UJM) system.
- We want to know how organisations are doing when they are handling
- information rights issues. We also want to improve the way they deal
- with the personal information they are responsible for. Reporting your
- concerns to us will help us do that.
- Our role is not to investigate or adjudicate on individual concerns but
- we will consider whether there is an opportunity to improve the practice
- of the organisations we regulate. We do this by taking an overview of
- all concerns that are raised about an organisation with a view to
- improving their compliance with the Data Protection Act 1998.
- In broad terms, the DWP is data controller for the all the information
- processed by all WP contractors dealing with work programme participants
- (customers) on behalf of the DWP. This is because the WP contractors are
- only processing the customers’ information while performing functions of
- the DWP on the DWP’s instruction.
- The most common occasion when information might be held by a WP
- contractor about DWP customers that is not within the data
- controllership of the DWP (and instead fall within the WP contractor’s
- own data controllership) is when professional standards type complaints
- are made by customers to the work programme contractor about the
- contractor’s staff. In such circumstances it is the WP contractor who
- would be data controller for the information processed in the course of
- its handling of the complaint made by the DWP customer about the
- contractor’s employee.
- At this time we consider it reasonably clear that the DWP is data
- controller for the personal data held, and processed, by its contractors
- in the course of their normal functions – including MWS. Because it is
- considered within the reasonable expectations of the customers that the
- DWP is the data controller it is not essential for this to also be
- explicitly stated in the terms and conditions.
- We do however appreciate your concern about this matter. We have
- therefore recorded your concern about this and will see if it is shared
- by other people.
- You then ask about the DWP’s data controllership over information kept
- on UJM. I can advise you that the DWP is the data controller for the
- customer information kept on UJM. The DWP cannot however arbitrarily
- access and use the information that a customer keeps in their UJM
- account for considering the customer’s entitlement to benefits.
- To use the customer’s UJM data for considering a customer’s entitlement
- to benefits the DWP needs the specific permission of the customer. This
- is because of the fair processing requirement of the first data
- protection principle.
- While the DWP is already the data controller for the information, it
- would be considered ‘unfair’ for the UJM information to be used to
- consider the customer’s JSA (or similar benefit) claim without the prior
- permission of the customer being obtained by the DWP.
- I hope that this information is helpful to you.
- Yours sincerely,
- [redacted]
- ____________________________________________________________________
- The ICO's mission is to uphold information rights in the public
- interest, promoting openness by public bodies and data privacy for
- individuals.
- If you are not the intended recipient of this email (and any
- attachment), please inform the sender by return email and destroy all
- copies. Unauthorised access, use, disclosure, storage or copying is not
- permitted.
- Communication by internet email is not secure as messages can be
- intercepted and read by someone else. Therefore we strongly advise you
- not to email any information, which if disclosed to unrelated third
- parties would be likely to cause you distress. If you have an enquiry of
- this nature please provide a postal address to allow us to communicate
- with you in a more secure way. If you want us to respond by email you
- must realise that there can be no guarantee of privacy.
- Any email including its content may be monitored and used by the
- Information Commissioner's Office for reasons of security and for
- monitoring internal compliance with the office policy on staff use.
- Email monitoring or blocking software may also be used. Please be aware
- that you have a responsibility to ensure that any email you write or
- forward is within the bounds of the law.
- The Information Commissioner's Office cannot guarantee that this message
- or any attachment is virus free or has not been intercepted and amended.
- You should perform your own virus checks.
- __________________________________________________________________
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
- Cheshire, SK9 5AF
- Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.org.uk
- Published with permission from ICO
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement