Universal Job Match adverse processing of personal data

----- Original message -----
From: casework@ico.org.uk
To: [redacted]
Subject: Your DPA query about the DWP,MWS and UJM[Ref. RFA0580147]
Date: Fri, 15 May 2015 [redacted]

15 May 2015

*Case Reference Number RFA0580147*

Dear [redacted],

Thank you for your enquiry in relation to the role of the DWP in
relation to information held by work programme (WP0 contractors,
www.myworksearch.co.uk[1] and the Universal Job Match (UJM) system.

We want to know how organisations are doing when they are handling
information rights issues. We also want to improve the way they deal
with the personal information they are responsible for. Reporting your
concerns to us will help us do that.

Our role is not to investigate or adjudicate on individual concerns but
we will consider whether there is an opportunity to improve the practice
of the organisations we regulate. We do this by taking an overview of
all concerns that are raised about an organisation with a view to
improving their compliance with the Data Protection Act 1998.

In broad terms, the DWP is data controller for the all the information
processed by all WP contractors dealing with work programme participants
(customers) on behalf of the DWP. This is because the WP contractors are
only processing the customers’ information while performing functions of
the DWP on the DWP’s instruction.

The most common occasion when information might be held by a WP
contractor about DWP customers that is not within the data
controllership of the DWP (and instead fall within the WP contractor’s
own data controllership) is when professional standards type complaints
are made by customers to the work programme contractor about the
contractor’s staff. In such circumstances it is the WP contractor who
would be data controller for the information processed in the course of
its handling of the complaint made by the DWP customer about the
contractor’s employee.

At this time we consider it reasonably clear that the DWP is data
controller for the personal data held, and processed, by its contractors
in the course of their normal functions – including MWS. Because it is
considered within the reasonable expectations of the customers that the
DWP is the data controller it is not essential for this to also be
explicitly stated in the terms and conditions.

We do however appreciate your concern about this matter. We have
therefore recorded your concern about this and will see if it is shared
by other people.

You then ask about the DWP’s data controllership over information kept
on UJM. I can advise you that the DWP is the data controller for the
customer information kept on UJM. The DWP cannot however arbitrarily
access and use the information that a customer keeps in their UJM
account for considering the customer’s entitlement to benefits.

To use the customer’s UJM data for considering a customer’s entitlement
to benefits the DWP needs the specific permission of the customer. This
is because of the fair processing requirement of the first data
protection principle.

While the DWP is already the data controller for the information, it
would be considered ‘unfair’ for the UJM information to be used to
consider the customer’s JSA (or similar benefit) claim without the prior
permission of the customer being obtained by the DWP.

I hope that this information is helpful to you.

Yours sincerely,
[redacted]


____________________________________________________________________


The ICO's mission is to uphold information rights in the public
interest, promoting openness by public bodies and data privacy for
individuals.


If you are not the intended recipient of this email (and any
attachment), please inform the sender by return email and destroy all
copies. Unauthorised access, use, disclosure, storage or copying is not
permitted.

Communication by internet email is not secure as messages can be
intercepted and read by someone else. Therefore we strongly advise you
not to email any information, which if disclosed to unrelated third
parties would be likely to cause you distress. If you have an enquiry of
this nature please provide a postal address to allow us to communicate
with you in a more secure way. If you want us to respond by email you
must realise that there can be no guarantee of privacy.

Any email including its content may be monitored and used by the
Information Commissioner's Office for reasons of security and for
monitoring internal compliance with the office policy on staff use.
Email monitoring or blocking software may also be used. Please be aware
that you have a responsibility to ensure that any email you write or
forward is within the bounds of the law.

The Information Commissioner's Office cannot guarantee that this message
or any attachment is virus free or has not been intercepted and amended.
You should perform your own virus checks.

__________________________________________________________________


Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF

Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.org.uk

Published with permission from ICO