Appropriate policy document - DPA Special Category data
Dear Department for Work and Pensions,
Under the Freedom of Information Act, I am requesting a copy of the DWP's "appropriate policy document", outlining your compliance measures and retention policies for special category data, with regard to the Data Protection Act 2018.
Yours faithfully,
M Downing
Thank you for contacting the Department for Work and Pensions (DWP).
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
Timescales for responding
Freedom of Information (FOI) Requests
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
Internal Review (IR) Requests
You can normally expect a response within 20 working days.
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
Receiving a response from us
Please note that email FOI and IR responses will be issued from
[email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.
Further Information
Should you have any further queries in connection with your FOI or IR
request please contact us.
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
References
Visible links
1. https://www.gov.uk/government/organisati...
Dear M Downing,
I am writing in response to your request for information, received 14th
May.
Yours sincerely,
DWP Central FoI Team
Dear Department for Work and Pensions,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'Appropriate policy document - DPA Special Category data'.
The response to my FOI request confirmed that the requested information is held, but claims an exemption under Section 21(1) of the Freedom of Information Act because they claim that the information is reasonably accessible and in the public domain. However, I do not think that the information is reasonably accessible, and this has certainly not been demonstrated by DWP. I am not aware of any mechanism by which I could reasonably access the information, short of an FOI request.
Responses to FOI requests should be reasonably helpful in accessing the information in question if it is not reasonably accessible to the requester, even if it is in the public domain.
Would it be possible for you to detail a clear mechanism by which I can reasonably access the requested information outside of FOIA? In particular the current version of the requested information?
The response given links two documents detailing DWP policies on data processing and retention, however I fail to see the relevance of these documents as they are not an appropriate policy document so do not together fall within the scope of the FOI request. They do not comply with the requirements of an appropriate policy document within the meaning of Schedule 1 of the DPA 2018, particularly since the linked Benefits DDRG was written years before the GDPR and DPA 2018 were drafted. The DWP IMP also does not on its own form an appropriate policy document, so this does not form a complete response.
A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/a...
Yours faithfully,
M Downing
Thank you for contacting the Department for Work and Pensions (DWP).
This is an automated confirmation that your request for information has
been received by the DWP Freedom of Information mailbox and will be
processed accordingly.
Please note that this mailbox is for Freedom of Information (FOI) or
Internal Review (IR) requests only – If you have submitted a non FOI or IR
related email then we may not be able to action it.
Timescales for responding
Freedom of Information (FOI) Requests
If your email is a valid FOI request, as per Section 8 of the FOI Act
2000, you can normally expect a response within 20 working days.
Internal Review (IR) Requests
You can normally expect a response within 20 working days.
We will respond to all valid FOI and IR requests within our statutory
timescales, if we are unable to do so then we will contact you to explain
why. Please note that we are not able to process your FOI or IR request in
any shorter timescales that you may indicate.
Receiving a response from us
Please note that email FOI and IR responses will be issued from
[email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk by your email account
provider.
Further Information
Should you have any further queries in connection with your FOI or IR
request please contact us.
More information on the DWP can be accessed on gov.uk here –
[1]https://www.gov.uk/government/organisati...
References
Visible links
1. https://www.gov.uk/government/organisati...
Dear M Downing,
I am writing in response to your request for information, received 23rd
June.
Yours sincerely,
DWP Central FoI Team
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now
James C Kelsall left an annotation ()
The linked Benefits Document and Data Retention Guide was unveiled as a result of a 2013 request for the policy - it had been updated less than a month before it was provided. It seems ridiculous to suggest that it has not been updated again in the 10+ years since that response.
The original request and response is available at https://www.whatdotheyknow.com/request/d....
Your request should have been responded to by providing the current version of the policy, not a version that is more than 10 years old.
I will also note that the policy cannot take account of the Data Protection Act 2018 as it was issued years before the act.
There's pretty solid evidence within the policy must have been updated - it contains one or more @dwp.gsi.gov.uk email addresses- these addresses were withdrawn more than four years ago.
The DWP Information Management Policy is the current version available on the DWP's website, but it does not constitute a full response to your request by itself.
I'd recommend requesting an internal review of this, they have clearly not provided a complete response to your request.