IRIS Data Protection Impact Assessments

Owen Stevens made this Freedom of Information request to Department for Work and Pensions

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was refused by Department for Work and Pensions.

Dear Department for Work and Pensions,

The request
Please provide:
1. all Data Protection Impact Assessments (DPIAs) carried out for the Integrated Risk and Intelligence Service (IRIS) since 2019;
2. information indicating whether or not each DPIA was sent to the ICO;
3. any written advice or formal warnings provided by the ICO regarding each DPIA;
4. (if relevant) documented reasons for not carrying out a DPIA, whether after the creation of IRIS or whether after the expansion of IRIS in 2021.

Background
IRIS was created, in response to fraud risks at the start of the Covid-19 pandemic, by merging the Department’s Risk and Intelligence Service, Cyber Resilience Team, and Serious and Organised Crime investigators.

IRIS is developing automated data matching rules and Transaction Risking through the use of algorithms – applying risk scores to cases and enabling the targeting of cases determined to be high risk. The department views the rollout of risk models, alongside an increased use of data analytics and greater automation, as being part of a long-term strategic transformation required to address fraud and error (https://assets.publishing.service.gov.uk... & https://www.gov.uk/government/publicatio...) .

By September 2020 the department claimed that IRIS was assessing the risk of fraud on cases according to 84 different categories and carrying out investigations on cases determined as being high risk (https://committees.parliament.uk/oralevi...). The department received extra funding in 2021 which it plans to use to expand IRIS and further develop transaction risking (https://questions-statements.parliament.... & https://questions-statements.parliament....).

IRIS coordinated the detection of, and response to, fraud risks from organised crime groups seeking to exploit COVID-19. There is now a team which reviews and takes action on cases identified by IRIS as being a high fraud risk. DWP have since reinstated benefit for some individuals who had had their benefit suspended but have since been able to show that they are entitled to benefit (https://questions-statements.parliament....).

Kate Osamor MP described being contacted by constituents whose benefit had been suspended, for as long as 11 months, by a team acting on information provided by IRIS (https://hansard.parliament.uk/Commons/20...).

Why I expect there to be one or more DPIAs for IRIS
ICO guidance states that a DPIA must be carried out before processing personal data when the processing is likely to result in a high risk to the rights and freedoms of individuals. Processing likely to result in a high risk includes extensive processing activities, including profiling, where decisions have legal effects, and where new technologies are used (https://ico.org.uk/for-organisations/gui...).

ICO guidance goes on to state that a DPIA must always be carried out when using systematic and extensive profiling or automated decision-making to make significant decisions about people, use profiling or automated decision-making to help make decisions on someone’s access to a benefit, use profiling on a large scale, combine and match data from multiple sources (https://ico.org.uk/for-organisations/gui...).

Yours faithfully,

Owen Stevens

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

DWP Central FOI Team,

This message has been hidden. Response to another request. If you are the requester, then you may sign in to view the message. Please contact us if you have any questions.

Dear Department for Work and Pensions,

This response is not responding to my FOI request and is intended to have been sent to someone else. Would it be possible to provide a response to my request?

Yours faithfully,

Owen Stevens

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

Operations FOI Team,

1 Attachment

Dear Owen Stevens,

I am writing in response to your request for information, received 6th
February. Please accept my apologies for the incorrect response that was
issued to you yesterday.

Yours sincerely,

DWP Central FoI Team

Dear Department for Work and Pensions,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'IRIS Data Protection Impact Assessments'.

You have not provided a breakdown of the number of hours you would expect each stage - searching, retrieving, and reviewing - to take.

I don't accept that searching for the documents would take any significant amount of time. The DWP Data Protection Officer is responsible for monitoring DWP's compliance with DPIA requirements. The DPO should be able to quickly tell you the location of the relevant DPIA(s). The DPO's details are here: https://www.gov.uk/government/organisati...

Similarly, retrieving documents would involve minimal staff time. It is unclear why this would be any more time consuming than sending an email.

I don't accept that an extensive review would be required to ensure that the requested documents meet the criteria of the request. The request is based on fundamental aspects of the DPIA process and each aspect should be well documented.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/i...

Yours faithfully,

Owen Stevens

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
 
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
 
Please note that email FOI responses will be issued from
[1][email address]
 
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request please
contact us.
 
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

freedom-of-information-request@dwp.gov.uk,

1 Attachment

Dear Owen Stevens,

I am writing in response to your request for information, received 24th
February.

Yours sincerely,

DWP Central FoI Team

Owen Stevens left an annotation ()

Complaint submitted to ICO

Owen Stevens left an annotation ()

ICO ref IC-160077-Z7M0

DWP freedom-of-information-requests, Department for Work and Pensions

1 Attachment

Dear Owen Stevens,

I am writing in response to your request for information, originally
received 6th February. Following your complaint to the ICO where they have
confirmed that costs likely applied at the time of your original request
we agreed to supply you with a fresh response based on the processes which
are in place at this time.

Yours sincerely,

DWP Central FoI Team

 

 

 

show quoted sections

Owen Stevens left an annotation ()

I have requested that the ICO continue to investigate the complaint