ICO Ref: RFA0833480 and DWP ESA50, UC50 and ESA1 forms on the matter of opt-in consent and the ESA65B form

The request was successful.

Dear Information Commissioner's Office,

RFA0833480

Please disclose copies of the information and correspondence you have sent to the
DWP on the matter of it's ESA50, UC50 and ESA1 forms not complying with the
2018 Data Protection Act and the GDPR, concerning the DWP sending sensitive
personal data to claimant Doctors and DWP doing so knowingly without any claimant opt-in consent. This data is sent using likes of the ESA65B form.

My request covers the period May 2018 to date.

Forms

ESA50 https://www.gov.uk/government/publicatio...

UC50 https://www.gov.uk/government/publicatio...

ESA1 https://www.gov.uk/government/publicatio...

ESA65B https://mrfrankzola.wordpress.com/?s=esa...

Yours faithfully,

Frank Zola

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Frank Zola left an annotation ()

Recent emails to the ICO related to this foi request

Completed 'case review and service complaint form', sent today
https://ico.org.uk/make-a-complaint/comp...

Along with email:

"17 Dec 2019, 16:30 by frankzolamr @ tutanota.com:

Dear [redacted]

Further to your letter of 9 July 2019 case ref RFA0833480 (extract below*), I am writing to further complain that the DWP did amend the ESA50 on 5/12/19 to comply with GDPR/DPA2018 but on 16/12/19 they removed the amended version and re-uploaded the non compliant 2018 version.

More details https://mrfrankzola.wordpress.com/2019/1...
ESA50 – 5/12/19 version (pdf) – ESA50 12/19
https://mrfrankzola.files.wordpress.com/...

ESA50 – 16/12/19 version (pdf) – ESA50 05/18
https://mrfrankzola.files.wordpress.com/...

Via
https://www.gov.uk/government/publicatio...

I would also like the ICO to advise whether the DWP should be contacting claimants so DWP can refresh consent, for claimants who have since the GDPR/DPA2018 came into force have never been given the opt-in choice to the ESA50/UC50 and ESA1 statement

“I agree to my doctor or any doctor treating me, being informed about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”

The DWP inform Doctors by sending them the DWP #ESA65B letter and this 3/12/19 article
http://webcache.googleusercontent.com/se... shows how Drs/GPs find this letter detrimental and the Z2K charity have a long standing campaign for this letter to be scrapped
https://www.z2k.org/scrap-the-letters/

The DWP's own guidance on data protection and consent clearly states they should seek to refresh consent when they had been relying upon the 1998 Data Protection Act but the consent no longer complies with GDPR/DPA2018 for existing claims, to quote:

"Refresh consent for people already in the process It is unlikely that consent obtained under the requirements of the 1998 Data Protection Act will be considered valid under the GDPR. When the consent forms and process have been updated to comply with the GDPR, existing consent should be refreshed using the new process in most circumstances."
https://www.whatdotheyknow.com/request/5...

I consider there have been material change since your July response and expect the ICO will respond to all the concerns above.

When you reply, please advise whether the ICO does consider that the DWP should seek to refresh consent for all ESA and UC claimants who currently have an ESA or UC claim and have signed forms that have the statement? You have remained silent on this questions in the past and this is despite your own guidance that states consent should be refreshed

“I agree to my doctor or any doctor treating me, being informed about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”

If the ICO is unable to answer questions of DWP refreshing consent in the above context, please treat this email as an advanced complaint, noting:

"Refresh your consents if they don't meet the GDPR standard"
https://ico.org.uk/for-organisations/gui...

Thanks
Frank Zola"

Frank Zola left an annotation ()

* "Extract
“we have in fact contacted DWP about the issues you raised with us. We took the view* that DWP has not complied with its data protection obligations, because its ESA1, ESA50 and UC50 forms do not provide a way for claimants opt in to the statement “I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”
*[Doctors are “informed” by use of the DWP ESA65B ‘fit-notes’ letter]
ICO July 2019 response to March 2019 complaint"

*This not sent with above email to the ICO

Information Commissioner's Office

1 Attachment

18 March 2020

 

Case Reference Number IRQ0912395

 

Dear Mr Zola,

We write in response to your recent request for information. We received
your request on 22 February 2020 and we are now in a position to respond.
 
We have dealt with your request in accordance with your ‘right to know’
under section 1(1) of the Freedom of Information Act 2000 (FOIA).
  
Request
 
In your email you asked:
 
RFA0833480 
 
Please disclose copies of the information and correspondence you have sent
to the DWP on the matter of it's ESA50, UC50 and ESA1 forms not complying
with the 2018 Data Protection Act and the GDPR, concerning the DWP sending
sensitive personal data to claimant Doctors and DWP doing so knowingly
without any claimant opt-in consent. This data is sent using likes of the
ESA65B form. My request covers the period May 2018 to date.
 
Response
 
We can confirm that we hold information in scope of your request. Please
find attached the correspondence sent by the ICO to the Department for
Work and Pensions (DWP) regarding the compliance of its ESA50, UC50, and
ESA1 forms with GDPR and DPA18.
 
Personal data relating to the initial complainant and the DWP contact
officer has been redacted pursuant to section 40(2) of the FOIA.
 
Section 40(2) is an absolute exemption which does not require
consideration of the public interest test of the type required by a
qualified exemption.
 
Section 40(2) exempts information in response to a request if it is
personal data belonging to an individual and it satisfies one of the
conditions listed in the FOIA. The condition contained in section
40(3A)(a) applies—that disclosure would breach one of the data protection
principles. The principle is that:
 
“Personal data shall be processed lawfully, fairly and in a transparent
manner...”
 
As you may appreciate, disclosure under the FOIA is effectively a
disclosure to the wider world and we have taken into account that the
correspondence is held in relation to a complaint initially made by an
individual. We do not consider that disclosing this personal data to you
via the whatdotheyknow.com website is necessary or appropriate in order to
satisfy your information request and the requirements of the FOIA.
 
We also consider that the DWP employee with whom the ICO corresponded does
not have a public facing profile and therefore has no expectation that
their name and direct contact information would be disclosed to the wider
world via the FOIA. In the circumstances of this request there is no
strong legitimate interest that would override the prejudice to the rights
and freedoms of this employee. We have therefore taken the decision that
disclosing this information to you would be unlawful.
 
This concludes our response to your information request.

Review Procedure
 
If you are dissatisfied with this response and wish to request a review of
our decision or make a complaint about how your request has been handled
you can write to the Information Access Team at the address below or
e-mail [ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under the Freedom of Information Act.
 
A copy of our [1]review procedure can be accessed from our website.

Yours sincerely
 

Shannon Keith
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Service
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 313 1636  F. 01625 524510  [2]ico.org.uk  [3]twitter.com/iconews
For information about what we do with personal data see our [4]privacy
notice.
Please consider the environment before printing this email

 
 

References

Visible links
1. https://ico.org.uk/media/1883/ico-review...
2. http://ico.org.uk/
3. https://twitter.com/iconews
4. https://ico.org.uk/global/privacy-notice/

Frank Zola left an annotation ()

Frank Zola left an annotation ()

"we are now aiming to have the ESA1 and
ESA50 live from mid-August and can share copies with you once they have been published. "
https://www.whatdotheyknow.com/request/6...
21/7/20 update
https://mrfrankzola.wordpress.com/2020/0...

Frank Zola left an annotation ()

DWP has published a new UC50 form

New 2021 UC50 Work Capability Assessment form, that lets you easily stop the DWP telling your GP to stop issuing ‘Fit-Notes’
This follows on from the same changes being made for the ESA1 claimant form and the ESA WCA form.
https://mrfrankzola.wordpress.com/uc50