DWP Central Freedom of
Information Team
Caxton House
6-12 Tothill Street
London
SW1H 9NA
Frank Zola
freedom-of-information-
xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
xxxxxxx@xxx.xxx.xx
DWP Website
Our Ref: FOI2021/72481
29 September 2021
Dear Frank Zola,
Thank you for your Freedom of Information (FoI) request received on 7 September. You
wrote:
“Please provide information that your Restart providers, due to the GDPR and the Data
Protection Act 2018 cannot mandate participants to create an account with and or use
providers employment and health related portals, as they al appear to grant providers
direct access to all of users personal data and account use data?
As DWP and it's Restart providers can be both Data Control ers and Data Processors, it
would appear that al the personal data that is generated by account holders or users of
these portals is processed by your providers on behalf of the DWP. Please provide
information that confirms this.
For example your provider Reed in Partnership uses a portal called the:
[1] Online Career Centre
https://reedinpartnership.careercentre.me/ accessed via reedrestart.co.uk
Noting it's Privacy Policy says:
5. WHO WE MAY SHARE PERSONAL DATA WITH (RECIPIENTS OR CATEGORIES
OF RECIPIENTS OF THE PERSONAL DATA)
"(a) As part of providing the Services, we may disclose your personal data to your
Institution [Reed] (which may include their administrators, coaches and other authorised
personnel)"
7. RIGHTS OF INDIVIDUAL USERS
"(c) You may withdraw your consent to our future processing of your personal data (and
stop using the Services) at any time by submitting a request in writing to your Institution
or to us at xxxxxxxx@xxxxxxxxx.xxx"
https://reedinpartnership.careercentre.me/privacy/reed-in-partnership
1
But Reed's Restart Induction Pack makes no mention that use of it's 'Online Career
Centre' appears to be entirely voluntary. (see 7, (c) above). Unlike Reed's Wellness
portal https://www.workplacewellnessportal.com/ also accessed via reedrestart.co.uk
which does state:
"Please note that the health assessment is not mandatory, and therefore, should you not
provide us with consent, we would unfortunately not be able to carry out the health
assessment" https://www.workplacewellnessportal.com/login/data-privacy-policy
Though again Reed's Induction Pack does not state the 'Wellness' portal "is not
mandatory"
https://www.whatdotheyknow.com/request/restart_providers_induction_pack#incoming-
1868029
Other portals include:
[2] IWORKS PARTICIPANT PORTAL
CPA 3a Ingeus Gtr Man
[3] Seetec’s Online Portal
CPA 4a Seetec Pluss
https://www.whatdotheyknow.com/request/restart_providers_induction_pack
in the past DWP created it's own employment portal cal ed Universal Jobmatch (UJ)
and DWP staff like a Work Coach could not access benefit claimants UJ account(s) and
data unless they gave consent by explicitly opting-in. I am unable to find any information
that your Restart providers have included any equivalent fully informed explicit opt-in
consent for [1] and [2] and [3] for any Restart participant who creates and uses a portal
account and or is, once an account is created has the option to prevent Restart providers
staff from viewing and accessing account users data
[Please provide information that confirms your Restart providers cannot issue a
Mandatory Activity Notice for participants to create an account on and or use any Restart
providers own or commissioned employment or health portal, for which they are a Data
Processor or Data Controller? ] Noting:
Universal Jobmatch Equality analysis, version 5
2013
"7.17 Advisers will only be able to access a JSA claimant’s Universal Jobmatch account
with the consent of the claimant (even where the JSA claimant has been mandated to
create a profile and a public CV in Universal Jobmatch)."
https://www.bl.uk/britishlibrary/~/media/bl/global/social-welfare/pdfs/non-secure/u/n/i/
universal-jobmatch-euqality-analysis-version-5-j2414.pdf pdf”
2
DWP Response
The information you have requested is not held, the department has not specified to the
Restart providers all activities that cannot be mandated.
The Restart programme has been designed to focus on positively engaging participants, so
that mandation is considered only where other attempts have failed. Providers will be
expected to engage participants by emphasising the advantages of participation.
Participants and providers wil agree a plan of activities which are achievable and reasonable
in their circumstances and will move participants closer to employment. Where the participant
refuses to engage, the provider may mandate them to undertake an activity. Where they fail
to undertake this without good reason, they could be sanctioned.
Restart providers have the following requirements to consider when mandating participants:
Providers are encouraged to use other channels and must make non-mandatory attempts
to engage with participants before considering a mandation
Providers must not mandate participants to undertake the same activity where a sanction
is already in place, or a compliance doubt is outstanding.
Providers are required to notify the Department for Work and Pensions (DWP) every time a
participant fails to undertake a mandatory activity. On receipt of this, the DWP wil follow the
decision-making process. It will always be the DWP who make the decision on whether a
sanction should be imposed.
With regard to the issues you raise around handling of data, we can confirm in the case of
Restart, Schedule 11 of the contract states that for data shared between the parties, DWP
and the Provider are Joint Controllers. Where data is not shared, the parties are independent
controllers.
If you have any queries about this letter, please contact us quoting the reference number
above.
Yours sincerely,
DWP Central Freedom of Information Team
Department for Work and Pensions
----------------------------------------------------------------------------------------------------------------------------
Your right to complain under the Freedom of Information Act
If you are not happy with this response you may request an internal review by e-mailing
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@xxx.xxx.xx or by writing to: DWP Central FoI Team, Caxton
House, 6-12 Tothill Street, London, SW1H 9NA.
Any review request should be submitted within two months of the date of this letter.
If you are not content with the outcome of the internal review you may apply directly to the
Information Commissioner’s Office for a decision. General y, the Commissioner cannot make
a decision unless you have exhausted our own complaints procedure. The Information
Commissioner can be contacted at: The Information Commissioner’s Office, Wycliffe House,
Water Lane, Wilmslow, Cheshire SK9 5AF.
Website:
ICO Contact Information or telephone 0303 123 1113.
3
4