Dear Department for Work and Pensions,

Please provide all records relating to the data breach which you became aware of in August 2023 relating to special category data being obtained from medical professionals using implied consent.

Any records which identify specific data subjects are not required.

The DWP's notification of the data breach to the ICO should be included in your response.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

cso.foi@dwp.gov.uk,

1 Atodiad

Dear James Kelsall,

I am writing in response to your request for information, received 15th
September.

Yours sincerely,

DWP Central FoI Team

Dear Department for Work and Pensions,

I do not believe it is necessary for clarification to be provided and I expect this matter to be internally reviewed. My initial request contains enough information for the relevant data breach to be identified.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

Dear Department for Work and Pensions,

While I do not believe that your clarification request is reasonable (and have therefore requested an internal review), I have provided some clarification below in the hope that it may allow my request to continue being processed while the internal review is taking place.

You have requested "further details of the data breach you are referring to such as the exact date the breach took place, the type(s) of special category data being obtained, and which medical professionals were involved".

I am unable to provide the dates on which the data breach occurred. The data breach did not occur on a single date, but over an extensive period. The data breach was occurring between January 2023 and April 2023, although it is likely that the extent of the breach is far greater (potentially several years).

The type of special category data obtained is primarily health data. I do not have any specific reason to believe that any other special category data has been obtained, although I cannot definitively rule it out.

I believe that is is likely that the medical professionals involved are all doctors (although I cannot definitively rule out other medical professionals being involved), and it is likely to be limited to just those working in GP practices (although again I cannot definitively rule out medical professionals working in other environments). Due to the extensive nature of the data breach, it is likely that a significant number of medical professionals are involved.

It may also be useful to note that this data breach relates to UC113 forms being sent to medical professionals by a DWP data processor (Maximus, the operator of the Centre for Health and Disability Assessments) using implied consent. Due to misleading claims made on a letter sent to medical professionals with the form (the letter states that valid consent is held, but implied consent is not valid), medical professionals have routinely returned the completed form without challenging the validity of the consent, which has resulted in the DWP unlawfully receiving medical data relating to an unknown number of benefit claimants.

It is likely that ESA113 forms are similarly affected by this breach (I believe that the form is functionally identical to the UC113 form). I am unable to ascertain if this data breach extends to any other DWP benefits.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

cso.foi@dwp.gov.uk,

1 Atodiad

Dear James Kelsall,

I am writing in response to your request for information, received 10th
October.

Yours sincerely,

DWP Central FoI Team

freedom-of-information-request@dwp.gov.uk,

4 Atodiad

Dear James Kelsall,

I am writing in response to your request for information, received 10th
October.

Yours sincerely,

DWP Central FoI Team

Dear Department for Work and Pensions,

You have still not provided any response to my original request of the 15th of September 2023. My request stated:

"Please provide all records relating to the data breach which you became aware of in August 2023 relating to special category data being obtained from medical professionals using implied consent.

Any records which identify specific data subjects are not required.

The DWP's notification of the data breach to the ICO should be included in your response."

This is clearly a valid request and therefore requires a response.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

1 Atodiad

Dear Mr Kelsall,
 
Here is a copy of the reply we sent to you on 4 October:
 
Yours sincerely,
 
DWP Central Freedom of Information Team

dangos adrannau a ddyfynnir

IR2023/77276 clearly stated "The additional information you provided is being considered and we have reviewed your original 
request.  A response to the original request will be sent separately".

The only response that you have provided since then treated my clarification as a distinct request (FOI2023/79020).

You committed to providing a new response to the original request, and have failed to do so.

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

Dear Department for Work and Pensions,

You have still not responded to my original request. I have now submitted a complaint to the ICO.

Your Internal Review from the 31st of October 2023 clearly agreed with my assertion that the clarification request was unreasonable, and it clearly indicated that a response would be provided to my original request.

You did respond to the clarified request, but this response was not a valid or complete response to my original request (in fact it wasn't even a valid or complete response to the clarified request, but that is largely irrelevant as the clarification request has clearly been deemed inappropriate). Your own Internal Review of your request for clarification (IR2023/77276) clearly stated that "A response to the original request will be sent separately". You never sent any such response.

A response to my original request was due on the 13th of October. As of the 10th of December, you have not provided any response to my request, and my Internal Review request of the 23rd of November was refused without consideration.

You have unlawfully withheld information which I am entitled to recieve, and you have refused to respond to my attempts to follow-up on this matter. Your handling of this request has been grossly incompetent (this is a regular issue), and I now have no option but to escalate this matter to the ICO.

THIS EMAIL IS PURELY INFORMATIONAL. IT DOES NOT CONSTITUTE A FREEDOM OF INFORMATION REQUEST OR AN INTERNAL REVIEW REQUEST.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

Gadawodd James C Kelsall anodiad ()

ICO Reference: IC-276211-T4H2

On the 19th of December 2023 the ICO issued a letter to the DWP asking it to provide a response within 10 working days.

Dear Department for Work and Pensions,

I will remind you that a response to request FOI2023/70986 is significantly overdue.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

Gadawodd James C Kelsall anodiad ()

I have now asked the ICO to escalate this matter, as the DWP has failed to respond within the 10 working day deadline given by the ICO previously.

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

1 Atodiad

Dear Mr Kelsall

Following communications with the Information Commissioner’s Office, please see attached revised response.

Kind regards
DWP Freedom of Information Team

dangos adrannau a ddyfynnir

Dear Department for Work and Pensions,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'Data Breach Records'.

The ICO instructed the DWP to provide a response within 10 working days of the 19th of December 2023. Your response was not provided within this time. You have failed to acknowledge, explain, or apologise for this delay.

You have also failed to acknowledge, explain, or apologise for your failure to correct the "error" after I complained about it in November 2023. You failed entirely to respond to my complaint about this issue. This was clearly not a single error as you seemingly suggest, but a series of errors spanning several months.

In any case, your response does not appear to be truthful. You claim that no records are held in relation to any data breach, but your data protection team have previously corresponded with the ICO about that data breach (and the ICO is currently considering that case), so clearly you must have records relating to that breach.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/d...

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...

freedom-of-information-request@dwp.gov.uk,

1 Atodiad

Dear James Kelsall,

I am writing in response to your request for information, received 15th
January.

Yours sincerely,

DWP Central FoI Team

Dear Department for Work and Pensions,

You appear to have entirely misunderstood my request, and it is unclear how the misunderstanding has occurred.

In your Internal Review, you state that "We consider our consent statement on the UC113, UC50, and ESA50 to be lawful and hence do not constitute a data breach whenever a GP releases information with the consent of a claimant".

My request specifically stated that the breach in question related to "special category data being obtained from medical professionals using IMPLIED CONSENT".

An unknown number of medical professionals have released information to the DWP WITHOUT consent because the DWP had claimed it held consent when it was actually using implied consent (where the consent is required to be explicit). The DWP has been aware of this breach since August 2023 (if not earlier), and the ICO case reference for the breach is IC-258791-F1R8.

Your claim that "The department is unaware of any data breach, including any that have been passed to the ICO" is clearly false, and I will now be making a new complaint to the ICO regarding this matter.

Yours faithfully,

James C Kelsall

DWP freedom-of-information-requests, Adran Gwaith a Phensiynau

Thank you for contacting the Department for Work and Pensions (DWP).
 
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
 
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
 
 
Timescales for responding
 
Freedom of Information (FOI) Requests
 
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
 
Internal Review (IR) Requests
 
You can normally expect a response within 20 working days.
 
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
 
 
Receiving a response from us
 
Please note that email FOI and IR responses will be issued from
[email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.  
 
 
Further Information
 
Should you have any further queries in connection with your FOI or IR
request please contact us.
 
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
 

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.gov.uk/government/organisati...