DWP Policy to NOT Comply With The Subject Access Rights Under The Data Protection Act

The request was refused by Department for Work and Pensions.

Dear Sir or Madam,

Having had the opportunity to study the DWP Subject Access Response Guide (SARG) obtained under the FOI request made here http://www.whatdotheyknow.com/request/su... , I am shocked to discover that the document instructs employees of the DWP to not provide Data that should automatically be provided.

The SARG Guide States at section 154;

"If the customer specifically requests audit trail information it can be provided to the customer,
subject to any exemptions. However, do not include audit trail information as part of a response
to a routine subject access request. Only include it if they specifically ask."

It is noted that nowhere within the published and previously available information on making a Subject Access Request does it advise applicants that they will have to ask for this Audit Data explicitly to obtain it, even though such data is caught fully under the Subject Access Provisions of The Data Protection Act.

1.) When did the DWP adopt this policy of not fully complying with the Subject Access Provision of The Data Protection Act 1984/1998 and started to fail to comply fully with the Act?

2. Provide full copies of any and all policy documents, other than SARG, operated, used or held by the DWP as to this withholding of Data in breach of a Lawful Subject Access Request.

3. Identify who is the person and their contact details who should be contacted to first object to such breaches of |The Data Protection Act and also who is responsible for providing this Audit Data as it was on the date a Subject Access Request was lawfully made to the DWP.

Yours faithfully,

white.mark.a

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received at the DWP Central FoI Team.

We will forward your request to the relevant information owner within the
Department who will respond to you direct.

Should you also have any further queries in connection with this request
do please contact us.

For further information on the Freedom of Information Act within DWP
please click on the link below.

[1]http://www.dwp.gov.uk/foi/

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

References

Visible links
1. http://www.dwp.gov.uk/foi/

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

1 Attachment

Dear Mr White

Please find attached response to your query.

Yours sincerely,

Central FoI Team
Department for Work and Pensions

show quoted sections

Dear Sir or Madam,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'DWP Policy to NOT Comply With The Subject Access Rights Under The Data Protection Act'.

A full history of my FOI request and all correspondence is available on the Internet at this address:
http://www.whatdotheyknow.com/request/dw...

I specifically note that the response states;

"In practice, this is done by the Data Protection Officer sending the customer a “SANTA01” letter to clarify which information they are seeking when the request is not specific or clear. I enclosed a copy of the SANTA01."

This does not make sense. "I enclosed" indicates past action. There has been no past action that is evident!

If it is meant to read I enclose - the enclosure has been omitted!

Could you please clarify what you are saying and why!

I have however been able to locate a copy of the SANTA01 refereed to, using this Foi Request which obtained a Copy of the DWP Subject Access Response Guide ( SARG ). the FoI request can of course be found here - http://www.whatdotheyknow.com/request/su...

Having Studies the SANTA01 form there is no mention of anyone having to have previous knowledge of which Data is being processed by the DWP! It is also noted that SARG has not been in the Public Domain or even available via the DWP website.

the SARG guide states;

"Audit Trail Information

154 If the customer specifically requests audit trail information it can be provided to the customer,
subject to any exemptions. However, do not include audit trail information as part of a response
to a routine subject access request. Only include it if they specifically ask."

It is noted that the DWP policy states that a SANTA01 Form whousl be sent to as person making a Subject Access Request where phrases such as “all the personal information you hold on me” are used in the original request. It is evident that where a Data Subject uses such a phrase the SANTA01 only has the function to obtain specific operands and not to reduce the scope of the Subject Access Request.

There is no exemption within The Data protection Act Subject Access provisions for Data such as Audit data and Audit Data Trails to be withheld when a Subject Access Request is made. Any and all Data caught under the definition of Data within the Act are to be supplied except where there is a lawful exemption. there is No Blanket Exemption for Audit Data - Audit trail Data and as such It is to be supplied automatically when a Subject Access Request is Received.

The SANTA01 Form mentions nothing of Audit Data and it's function is not to decide which Data Are to be provided but to seek relevant operands and identifiers which a Data can Controller can reasonably request as per Section 7(3) of the Data Protection Act which states;

"A data controller is not obliged to comply with a request under this section unless he is supplied with such information as he may reasonably require in order to satisfy himself as to the identity of the person making the request and to locate the information which that person seeks."

The SARG document acts to alter the intent and explicit application of the Data protection Act 1998 and to withhold data that is caught fully within the definitions of The Act.

Again you are requested

1.) When did the DWP adopt this policy of not fully complying with the Subject Access Provision of The Data Protection Act 1984/1998 and started to fail to comply fully with the Act?

For clarity please provide date in the form "day - month - year"

2. Provide full copies of any and all policy documents, other than SARG, operated, used or held by the DWP as to this withholding of Data in breach of a Lawful Subject Access Request.

Again these are DOCUMENTS and POLICY STATEMENTS in their own right and which will need to be provided in Acrobat Pdf Format.

3. Identify who is the person and their contact details who should be contacted to first object to such breaches of The Data Protection Act and also who is responsible for providing this Audit Data as it was on the date a Subject Access Request was lawfully
made to the DWP.

That is name - Salutation - Christian name Surname, Job Title, Correspondence Address.

Please do not Obstruct the Obligations that the DWP have under the Freedom Of Information Act. Such conduct tends towards Maladministration as defined by the DWP and which can be found Here - http://www.dwp.gov.uk/publications/dwp/2...

Provide the required information within the time limits of the legislation, or earlier at your convenience.

Yours sincerely,

white.mark.a

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received at the DWP Central FoI Team.

We will forward your request to the relevant information owner within the
Department who will respond to you direct.

Should you also have any further queries in connection with this request
do please contact us.

For further information on the Freedom of Information Act within DWP
please click on the link below.

[1]http://www.dwp.gov.uk/foi/

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

References

Visible links
1. http://www.dwp.gov.uk/foi/

white.mark.a left an annotation ()

It seems that the DWP will do anything to not provide a straight answer!

You ask for three facts and get waffle by return. You are even obliged to explain what the term "Name" means and even "Date" so that there can be no further deliberate misunderstanding!

It seems that when it comes to data protection and the use of Data Waffle is all that occurs and that is why so much Data Within the DWP is wrong!

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

1 Attachment

Dear Mr White

Please find attached response to your request for internal review,
received on 30 January 2009.

Yours sincerely,

Central FoI Team
Department for Work and Pensions

show quoted sections

Dear Mr Rob Molan DWP Adelphi Freedom-of-Information-Request,

Thank you for your response which is bemusing and enlightening at the same time.

However, within your response you have embedded a Hyper link to resources which you refer to as "DWP - how to handle subject access requests".

Could you please provider a working link to this resource so that the veracity of your response can be checked before a full response can be provided, or that it can be agreed that the DWP have in fact complied with the Original FOI request.

Yours sincerely,

white.mark.a

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received at the DWP Central FoI Team.

We will forward your request to the relevant information owner within the
Department who will respond to you direct.

Should you also have any further queries in connection with this request
do please contact us.

For further information on the Freedom of Information Act within DWP
please click on the link below.

[1]http://www.dwp.gov.uk/foi/

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

References

Visible links
1. http://www.dwp.gov.uk/foi/

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

Dear Mr White

Thank you for your email dated 17 March 2009 referring to an embedded
hyperlink to DWP's Publication Scheme, which explains how to access a
current version of the Subject Access Request Guide (SARG). We are sorry
that the original link did not work.

Please find attached the working link, as requested.

http://www.dwp.gov.uk/foi/infofinder/Our...
_of_information__and_or__Data_protection/109.asp

I hope this is helpful.

If you are not satisfied with my handling of your request please tell me
why within two calendar months of the date of this letter. I will then
arrange for someone to conduct an internal review of your request and
the handling of it. The review will be conducted by another officer,
usually of a more senior grade to me. This person will have taken no
part in the original handling of your request. You will be advised you
of the reviewing officer's decision in writing.

If you have any queries about this letter, please contact us.

If you are not content with the outcome of the internal review you have
the right to apply directly to the Information Commissioner to look into
the way your request has been handled. Please note that generally the
Commissioner cannot make a decision unless you have first exhausted
DWP's own complaints procedure. The Commissioner can be contacted at:

FoI Complaints Resolution
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Fax: 01625 524 510

Email: [email address]

Yours sincerely.

Central FoI Team
Department for Work and Pensions

show quoted sections

Dear DWP Adelphi Freedom-of-Information-Request,

Dear Sirs

Not Only have still not provided the information originally requested in the FOI request, but the hyper link that you have embedded in you none response does not work either!

It results in a page which reads;

" * Sorry, that page cannot be found

Sorry, that page cannot be found"

I believe that this is what is referred to as a 404 error message - and is caused by broken and misdirected hyper links.

The the code for the link you have embedded is incorrect and non functional!

Evidently the DWP are set upon not providing the policy documents which the DWP have to support the following;

From The DWP Subject Access Response Guide (SARG)

"Audit Trail Information

154
If the customer specifically requests audit trail information it can be provided to the customer,
subject to any exemptions. However, do not include audit trail information as part of a response
to a routine subject access request. Only include it if they specifically ask. "

DWP Subject Access Request Guide (SARG)
which can be found on this link

DWP Subject Access Request Guide (SARG) HTML Format -
http://www.whatdotheyknow.com/request/42...

and

DWP Subject Access Request Guide (SARG) Acroabt Pdf Format - http://www.whatdotheyknow.com/request/42...

DWP Subject Access Request Guide (SARG) MS Word Format - http://www.whatdotheyknow.com/request/42...

There is no exemption under the Subject Access Provisions of the Data Protection Act 1998 which allows for this Audit Data to be withheld or any part of that Act that requires the Data Subject to request it.

The DWP Published Guidance on Subject Access Requests states;

"The Data Protection Act 1998

The Data Protection Act (the DPA) sets rules for the way organisations treat personal information about you. It applies to paper and computer records.

The DPA allows you to find out what information is held about you on computer and in some paper records.

How can I find out what information you have about me?

If you want to see the information we have about you, please tell us exactly what information you want to see. This will help us to provide you with a better service. We will send you a copy of the information we have, if any, as soon as possible and at the latest within 40 calendar days.

You must ask for the information in writing and give us information that allows us to be sure of your identity and address.

For example, tell us your:
Full name
Address
Date of birth
National Insurance (NI) number.

If you have any other reference numbers we use, such as a Child Benefit number, or any other information you think might help us to identify you, please also include this.

Can I see all the information held about me?

Normally you can see all the information we have, but there are some exceptions. These exceptions are mainly to do with:

the way benefit fraud is detected or prevented
catching or prosecuting offenders
assessing or collecting taxes or duty
making sure our staff are safe.

In some cases your right to see certain health or medical information may be limited. The law requires us to delete or remove any information which, in the opinion of a medical professional, would be likely to cause you serious harm if we disclosed it to you.

Where to send requests for information

If you know which office deals with the information you want, address your request to “the Data Protection Officer” and send it to that office. Otherwise, please address your request to “the DataProtection Officer” and send it to the DWP office nearest to where you live. You can find the address of your nearest office in the phone book or on our website: www.dwp.gov.uk

What should I do if this information is wrong or I ish to complain about how you have handled my information?

You should first contact the office which deals with your case. If you are not satisfied with their response
you should then make a complaint. Details on how to complain are availble at:

www.dwp.gov.uk/contact/complaintsappeals...

If after taking this action you are still not satisfied you can make a complaint to the Information
Commissioner. Details of their website are in the next section.

Further information

DWP is the Data Controller for the purposes of the Data Protection Act. DWP’s registration as a
Data Controller is in the Public Register of Data Controllers, which can be found on the
Information Commissioner’s website: www.ico.gov.uk.

If you want to know more about what information we have about you, or the way we use your information, you can contact any of the Department’s offices. You can also ask your local council what information they hold about you."

The Full original document in Acrobat Pdf Format can be found http://www.dwp.gov.uk/DWP-your-personal-... from the DWP website.

It is noted that it does not state that a Data Subject is required to specifically request Audit Data.

This public document fails to advise that Audit Data is to not be supplied, and has to be specifically requested - even whilst such Audit Data is caught fully under the Definitions of Personal Data as given in the Data Protection Act 1998, Part 1, Preliminary,

Basic interpretative provisions

“personal data” means data which relate to a living individual who can be identified—
(a)

from those data, or
(b)

from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;"

http://www.opsi.gov.uk/Acts/Acts1998/ukp...

Since the DWP have introduced a Guidance To Data Protection Officers (DPOs) which tell them to ignore the Basic Interpretative Provisions of the Data Protection Act, there has to be a policy that supports this decision and the redrafting of the DWP Subject Access Response Guide to support this position.

It is noted that the DWP have stateed they redrafted SARG to specifically include instructions to Employees to not Provide Audit Data.

Again as per the Original FOI request that remains unanswered -

1.) When did the DWP adopt this policy of not fully complying with the Subject Access Provision of The Data Protection Act 1984/1998 and started to fail to comply fully with the Act?

For your clarity - that would be a date, as in Day - Month - Year. Formats such as 10/12/2003 or full dates such as 4th July 2007 can be used to provide this requested informtion.

2. Provide full copies of any and all policy documents, other than SARG, operated, used or held by the DWP as to this withholding of Data in breach of a Lawful Subject Access Request.

For your clarity - this would be any of the documents used to introduce this policy - and would also identify who knew of this and who agreed to it>

3. Identify who is the person and their contact details who should be contacted to first object to such breaches of The Data Protection Act and also who is responsible for providing this Audit Data as it was on the date a Subject Access Request was lawfully
made to the DWP.

For your clarity - That would be name as is Salutation, first name or initial, Surname and Job Title.

As for the person who is obliged to supply the Audit Data Caught under a lawfully issued Subject Access Request that can also be provided in the above format. Their contact address would also be most appropriately supplied.

None of this information has been supplied including the name and contact details of who should be complained to when the DWP fail to comply with the Data Protection Act.

It has been stated;

"The Department does not regard audit data trails as being covered by an exemption from the Data Protection Act. "

If this is the position of the DWP there must be a relevant written record of this being proposed as policy, agreed as policy and then adopted as policy - with these being relevant policy documents. These have been asked for and not supplied under the Originating FOI Request.

Should I be asking the Data Contreoller - the Rt Hon James Purnell MP for the policy documents directly if the FOI team are unable to locate and provide them?

If there should be no supporting documentation upon which the policy to not provide all "Personal Data", then the DWP would be in a most difficult position to have the Data Controller explain why the Data Protection Act is not being complied with.

Kindly have the awaited and Originating FOI request complied with.

Yours sincerely,

white.mark.a

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received at the DWP Central FoI Team.

We will forward your request to the relevant information owner within the
Department who will respond to you direct.

Should you also have any further queries in connection with this request
do please contact us.

For further information on the Freedom of Information Act within DWP
please click on the link below.

[1]http://www.dwp.gov.uk/foi/

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

References

Visible links
1. http://www.dwp.gov.uk/foi/

DWP Adelphi Freedom-of-Information-Request, Department for Work and Pensions

1 Attachment

Dear Mr White

Please find attached a response to your request.

Your sincerely,

Central FoI Team
Department for Work and Pensions

show quoted sections

alex b left an annotation ()

DWP are a bunch of lost clowns, just interested in wage packets at the end of the month.