Consent to Share Sensitive Personal Data with private Companies Heywood Ltd & EDM Group

Alan Caulfield made this Freedom of Information request to Scottish Public Pensions Agency

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

Scottish Public Pensions Agency did not have the information requested.

Dear Scottish Public Pensions Agency,

SPPA have taken over the administration and payment of Police pensions in Scotland. Personal data has been transferred from Police Scotland to SPPA via two private companies: Heywood Limited, suppliers of pension software used by SPPA, and EDM Group, contracted the task of scanning documents.
1.Please specify any action taken or considered to obtain consent of Police Pensioners to process their personal data prior to transfer?
2.Please specify any action taken or considered to obtain explicit consent in respect of pensioners sensitive personal data?
3.Please specify any action taken or considered to obtain pensioners consent to disclose their processed data to third party private companies ie. Heywood Ltd and EDM Group?
4.Please supply copies of any correspondence, documents, e mails between SPPA and Police Scotland relevant to obtaining consent of data subjects prior to transfer of Police pensions to SPPA?

Yours faithfully,

Alan Caulfield

Scottish Public Pensions Agency

I am not in the office and my emails are not being read. Please contact
[email address]

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Scottish Public Pensions Agency

Dear Mr Caulfield,
 
Thank you for your request for information under the Freedom of
Information (Scotland) Act 2002 dated 29^th November 2014 concerning
consent to share sensitive personal data.
 
Your request was received on 29^th November 2014 and we will respond in
accordance with FOISA by 5^th December 2014.
 
If you have any queries, please contact me quoting case number
FoI/14/01949.
 
Kind regards,
 
Jonathan Sharp
 
Jonathan Sharp | Corporate Communications Manager | Scottish Public
Pensions Agency | 7 Tweedside Park | Galashiels | TD1 3TE | Tel: 01896
892469
 
 
 

show quoted sections

 

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Scottish Public Pensions Agency

1 Attachment

Dear Mr Caulfield,
 
Thank you for your request for information under the Freedom of
Information (Scotland) Act 2002 dated 29th November 2014, concerning
consent to share sensitive personal data. Please find a response attached
this email.
 
 
Kind regards,
 
Jonathan Sharp
 
Jonathan Sharp | Corporate Communications Manager | Scottish Public
Pensions Agency | 7 Tweedside Park | Galashiels | TD1 3TE | Tel: 01896
892469
 
 
 

show quoted sections

 

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Dear Scottish Public Pensions Agency,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Scottish Public Pensions Agency's handling of my FOI request 'Consent to Share Sensitive Personal Data with private Companies Heywood Ltd & EDM Group'.

[Thank you for your reply.

The fair processing notice referred to in your response dated September 2014, didn’t go out to some Edinburgh Police pensioners until 7th October 2014. This left no time for anyone wishing to check the accuracy of information being passed by to SPPA, to do so. Requests to Edinburgh Pensions manager in October 2014, to inspect data about to be passed to SPPA via private companies went unanswered.

A recent Data Protection Subject Access Request currently under review by SPPA Chief Executive, reveals relevant information may be missing . Meanwhile Sensitive personal (medical and financial) information unrelated to the Police pensions being administered by SPPA, has been reprocessed by private companies and currently retained by SPPA. This information was obtained from the Benefits Agency under the Audit Commission data matching exercise in 2010.

There should have been active communication and sufficient notice to enable individuals to signify their preference and give informed agreement. Some pensioners have not been afforded any choice in the handling of their personal information.
]

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/c...

Yours faithfully,

Alan Caulfield

Dear Scottish Public Pensions Agency,

Please note information received from Audit Scotland regarding retention of data Matching material.
https://www.whatdotheyknow.com/request/r...

Yours faithfully,

Alan Caulfield

Dear Scottish Public Pensions Agency,

Please acknowledge review request dated 17th December 2014.

Yours faithfully,

Alan Caulfield

Scottish Public Pensions Agency

Dear Mr Caulfield

Thank you for your request of 17 December 2014 for a review of our response to your request under the Freedom of Information (Scotland) Act 2002 (FOISA) concerning consent to share sensitive personal data.

I have been asked by Neville Mackay, Chief Executive of SPPA, to carry out the review because I was not involved in handling your original request. I will be looking at the case afresh to establish whether the original response should be confirmed (with or without modification or a fresh decision should be substituted) and that your request was handled in accordance with our procedures and legislative requirements.

We received your review request on 17th December 2014 so I will respond in accordance with FOISA by 20th January 2015.

If you have any queries, please contact me quoting case number FOI/14/01949

Steven Robertson
Corporate Communications

show quoted sections

Scottish Public Pensions Agency

This message has been hidden. The response included the requester's address Please contact us if you have any questions. If you are the requester, then you may sign in to view the message.

Dear Scottish Public Pensions Agency,

Dear Ms Brown

You have published my private address on the website (what do they know) in relation to a freedom of information request.

This personal information was not included in my original FOI.

I certainly did not want or expect this information to be published on the internet by SPPA.

Please rectify this matter as soon as possible.

Yours faithfully,

Alan Caulfield

Scottish Public Pensions Agency

1 Attachment

Dear Mr Caulfield,

Thank you for your request for a review under the Freedom of Information
(Scotland) Act 2002 dated 7 January 2014, concerning the transfer of
personal data to the SPPA via private companies. Please find a response
attached to this email.

Kind regards,

 

Steven Robertson

Corporate Communications

 

Steven Robertson | Corporate Communications | Scottish Public Pensions
Agency | 7 Tweedside Park | Galashiels | TD1 3TE | Tel: 01896 893276

 

show quoted sections

 

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Gretchen Storme left an annotation ()

The address provision breaks Data Protection Act privacy & confidentiality laws. It will also breach the Financial Services body legislation regarding those same issues. The ICO for Scotland and the relevant public body ombudsman may also help. Surprised they actually published that on this website.... Not the standard one would expect.