Ms Jen Persson
xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
27th October 2017
Dear Ms Persson
ATISN 11602 - School workforce data collection in Wales: privacy impact assessment
Thank you for your request which I received on 2nd October 2017. You asked for:
With regards the School workforce data collection in Wales:-
1. A copy of the privacy impact assessment for the new collection, including any
assessment of the necessity and proportionality of the collection of National
Insurance numbers and of the third parties with whom these data will be shared
whether this be a formal PIA or what has been used to make the assessment under
the government "minimum mandatory measures 2008". ;
2. the consultation responses made and listed on page 21 of the published responses
to the consultation ‘School workforce data collection in Wales’;
3. the communications plans / documents or template of information to be used to
communicate this personal confidential data collection to the data subjects (the
people from whom the data comes, both current and future workforce).
4. the documentation regards the planned future release process, how applications and
decisions will be made, with what oversight, and transparency of release, such as an
online third-party release register to inform the data subjects where their data has
gone.
Please see the Welsh Government’s response to requests as follows:-
1. A copy of the privacy impact assessment for the new collection, including any
assessment of the necessity and proportionality of the collection of National
Insurance numbers and of the third parties with whom these data will be shared
whether this be a formal PIA or what has been used to make the assessment under
the government "minimum mandatory measures 2008".
Rydym yn croesawu derbyn gohebiaeth yn Gymraeg. Byddwn yn ateb gohebiaeth a dderbynnir yn Gymraeg yn Gymraeg ac ni fydd
gohebu yn Gymraeg yn arwain at oedi.
We welcome receiving correspondence in Welsh. Any correspondence received in Welsh will be answered in Welsh and corresponding
in Welsh will not lead to a delay in responding.
Parc Cathays / Cathays Park
Canolfan Cyswllt Cyntaf / First Point of
Caerdydd / Cardiff
Contact Centre 03000255968
CF10 3NQ
Ebost Email:Gareth.thomas2@gov.wales
I have concluded that the information that you have requested for your first question
is exempt from disclosure under section(s) 35 of the Freedom of Information Act,
formulation of government policy. The reasons for applying these exemptions are set
out in full at Annex A to this letter.
2. the consultation responses made and listed on page 21 of the published responses
to the consultation ‘School workforce data collection in Wales’;
See
Annex A for a copy of the responses to the consultation.
3. the communications plans / documents or template of information to be used to
communicate this personal confidential data collection to the data subjects (the
people from whom the data comes, both current and future workforce).
No document currently exists for communicating this data collection to data subjects.
A privacy notice will be distributed to each member of the workforce covered by the
Regulations and data collection in adherence to the General Data Protection
Regulations (GDPR) which will come into force from May 2018. The privacy notice
will include what information is collected; the basis for collecting the information; the
purpose for collecting the information and how it will be used; how the information will
be collected and stored; individual’s rights to access their data and with whom the
information may be shared with in accordance with law. The privacy notice is
currently being developed and will be distributed to all individuals affected by the
regulations prior to the implementation of the School Workforce Data Collection.
4. the documentation regards the planned future release process, how applications and
decisions will be made, with what oversight, and transparency of release, such as an
online third-party release register to inform the data subjects where their data has
gone.
All organisations that want access to individual data (whether identifiable or
anonymised) must complete a Data Access Agreement (DAA) which is signed off by
the Information Asset Owner at Welsh Government. The DAA places certain
obligations upon the organisation in respect of what they can and cannot do with the
data. Minimum standards must be maintained in relation to information security, as
specified in the Security Aspects Letter. All data must be securely destroyed at the
end of the project, or in most cases when one calendar year has passed.
The Welsh Government maintains a database of all requests for access to data,
including the requesting organisation and the outcome. Whilst this is not currently
published by Welsh Government, details of requests for access to data would be
made available if requested.
See
Annexes B and
C for copies of the Data Access Agreement template and
Security Aspects Letter template respectively.
If you are dissatisfied with the Welsh Government’s handling of your request, you can ask
for an internal review within 40 working days of the date of this response. Requests for an
internal review should be addressed to the Welsh Government’s Freedom of Information
Officer at:
Information Rights Unit,
Welsh Government,
Cathays Park,
Cardiff,
CF10 3NQ
or Email
: xxxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxx.xxx.xxx.xx
Please remember to quote the ATISN reference number above.
You also have the right to complain to the Information Commissioner. The Information
Commissioner can be contacted at:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.
However, please note that the Commissioner will not normally investigate a complaint until it
has been through our own internal review process.
Yours sincerely
Gareth Thomas
Workforce Strategy Unit
Education and Public Services
Annex A
I have decided to withhold the privacy impact assessment for the new school workforce data
collection with due consideration of the exemptions identified under sections 35(1)(a) of the
Freedom of information Act 2000.
This exemption states that:
(1) information held by a government department is exempt information if it relates to
(a) the formulation or development of government policy.
Section 35 is a qualified (public interest tested) exemption. This means that in order to
engage it, I must show that the public interest in withholding the information is greater than
the public interest in releasing it.
This Annex sets out the reasons for the engagement of section(s) 35 of the Freedom of
Information Act and our subsequent consideration of the Public Interest Test.
Section 35 is a qualified (public interest tested) exemption. This means that in order to
engage it, I must show that the public interest in withholding the information is greater than
the public interest in releasing it.
Public Interest Test
In order to satisfy the public interest test in relation to the exemption, it is necessary to
conclude that the public interest arguments in favour of withholding the information are
sufficient to
outweigh the public interest arguments in favour of release.
Public interest arguments in favour of disclosure
I recognise that the public has an interest in understanding the Government's
considerations in the development of policies which impact upon individuals themselves. To
release information now, may promote awareness of the issues that Government is
currently considering, as well as enhancing public scrutiny of the Government's policy
making decisions.
Public interest arguments in favour of withholding
Whilst there is a public interest argument to support the view that the public should be able
to see and scrutinise how government reaches the decision it makes regarding the
collection and use of individuals’ information, I do not believe it is in the wider public interest
to make public information that would be likely to harm the Welsh Government’s ability to
develop government policy in an effective and efficient manner.
Rydym yn croesawu derbyn gohebiaeth yn Gymraeg. Byddwn yn ateb gohebiaeth a dderbynnir yn Gymraeg yn Gymraeg ac ni fydd
gohebu yn Gymraeg yn arwain at oedi.
We welcome receiving correspondence in Welsh. Any correspondence received in Welsh will be answered in Welsh and corresponding
in Welsh will not lead to a delay in responding.
Parc Cathays / Cathays Park
Canolfan Cyswllt Cyntaf / First Point of
Caerdydd / Cardiff
Contact Centre 03000255968
CF10 3NQ
Ebost Email:Gareth.thomas2@gov.wales
Good governance relies on decisions being made after a detailed scrutiny of all factors and
possibilities. Disclosure of incomplete information relating to the development of the school
workforce data collection would not allow for adequate or proper scrutiny by the public whilst
the PIA is still reviewed.
I am aware that as a general rule, the sensitivity of information is likely to reduce over time
so that the age of the information or timing of the request may be relevant in determining
whether to apply the exemption, or where the public interest may lie. In this case, however,
the PIA in its current draft form is being reviewed and relates to policy which is still in
development. The document will be reviewed in light of continued discussions with key
interested parties. Premature disclosure is therefore unlikely to give a complete picture of
any final outcomes and may be contrary to the public interest if it results in inaccurate or
incomplete information being published.
Balance of public interest test
In conclusion, I believe that the balance of the public interest falls in favour of withholding
this information as the document will be reviewed throughout the development of the school
workforce data collection and will be subject to change prior to implementation.