IRIS Data Protection Impact Assessments
Dear Department for Work and Pensions,
The request
Please provide:
1. all Data Protection Impact Assessments (DPIAs) carried out for the Integrated Risk and Intelligence Service (IRIS) since 2019;
2. information indicating whether or not each DPIA was sent to the ICO;
3. any written advice or formal warnings provided by the ICO regarding each DPIA;
4. (if relevant) documented reasons for not carrying out a DPIA, whether after the creation of IRIS or whether after the expansion of IRIS in 2021.
Background
IRIS was created, in response to fraud risks at the start of the Covid-19 pandemic, by merging the Department’s Risk and Intelligence Service, Cyber Resilience Team, and Serious and Organised Crime investigators.
IRIS is developing automated data matching rules and Transaction Risking through the use of algorithms – applying risk scores to cases and enabling the targeting of cases determined to be high risk. The department views the rollout of risk models, alongside an increased use of data analytics and greater automation, as being part of a long-term strategic transformation required to address fraud and error (https://assets.publishing.service.gov.uk... & https://www.gov.uk/government/publicatio...) .
By September 2020 the department claimed that IRIS was assessing the risk of fraud on cases according to 84 different categories and carrying out investigations on cases determined as being high risk (https://committees.parliament.uk/oralevi...). The department received extra funding in 2021 which it plans to use to expand IRIS and further develop transaction risking (https://questions-statements.parliament.... & https://questions-statements.parliament....).
IRIS coordinated the detection of, and response to, fraud risks from organised crime groups seeking to exploit COVID-19. There is now a team which reviews and takes action on cases identified by IRIS as being a high fraud risk. DWP have since reinstated benefit for some individuals who had had their benefit suspended but have since been able to show that they are entitled to benefit (https://questions-statements.parliament....).
Kate Osamor MP described being contacted by constituents whose benefit had been suspended, for as long as 11 months, by a team acting on information provided by IRIS (https://hansard.parliament.uk/Commons/20...).
Why I expect there to be one or more DPIAs for IRIS
ICO guidance states that a DPIA must be carried out before processing personal data when the processing is likely to result in a high risk to the rights and freedoms of individuals. Processing likely to result in a high risk includes extensive processing activities, including profiling, where decisions have legal effects, and where new technologies are used (https://ico.org.uk/for-organisations/gui...).
ICO guidance goes on to state that a DPIA must always be carried out when using systematic and extensive profiling or automated decision-making to make significant decisions about people, use profiling or automated decision-making to help make decisions on someone’s access to a benefit, use profiling on a large scale, combine and match data from multiple sources (https://ico.org.uk/for-organisations/gui...).
Yours faithfully,
Owen Stevens
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
Dear Department for Work and Pensions,
This response is not responding to my FOI request and is intended to have been sent to someone else. Would it be possible to provide a response to my request?
Yours faithfully,
Owen Stevens
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
Dear Owen Stevens,
I am writing in response to your request for information, received 6th
February. Please accept my apologies for the incorrect response that was
issued to you yesterday.
Yours sincerely,
DWP Central FoI Team
Dear Department for Work and Pensions,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'IRIS Data Protection Impact Assessments'.
You have not provided a breakdown of the number of hours you would expect each stage - searching, retrieving, and reviewing - to take.
I don't accept that searching for the documents would take any significant amount of time. The DWP Data Protection Officer is responsible for monitoring DWP's compliance with DPIA requirements. The DPO should be able to quickly tell you the location of the relevant DPIA(s). The DPO's details are here: https://www.gov.uk/government/organisati...
Similarly, retrieving documents would involve minimal staff time. It is unclear why this would be any more time consuming than sending an email.
I don't accept that an extensive review would be required to ensure that the requested documents meet the criteria of the request. The request is based on fundamental aspects of the DPIA process and each aspect should be well documented.
A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/i...
Yours faithfully,
Owen Stevens
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
This is an automated confirmation that your request for information has
been received by the DWP FOI mailbox.
If your email is a valid Freedom of Information request, as per Section 8
of the FOI Act 2000, you can normally expect a response within 20 working
days.
Please note that email FOI responses will be issued from
[1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.
Should you have any further queries in connection with this request please
contact us.
Information on the Department for Work and Pensions can be accessed on
gov.uk here - [2]http://www.gov.uk/dwp
References
Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp
Dear Owen Stevens,
I am writing in response to your request for information, received 24th
February.
Yours sincerely,
DWP Central FoI Team
Dear Owen Stevens,
I am writing in response to your request for information, originally
received 6th February. Following your complaint to the ICO where they have
confirmed that costs likely applied at the time of your original request
we agreed to supply you with a fresh response based on the processes which
are in place at this time.
Yours sincerely,
DWP Central FoI Team
Owen Stevens left an annotation ()
I have requested that the ICO continue to investigate the complaint
Dear Owen Stevens
I am writing in response to your request for information, originally
received on 24th February. We are issuing our revised response to your
business address as the WDTK record is not currently open to receiving
this information. If you need to have this information resent to the WDTK
record then you will need to make arrangements for that account to be
reopened and advise us accordingly.
Yours sincerely,
DWP Central FoI Team
Dear Owen Stevens
I am writing in response to your request for information, originally
received on 24th February. We are issuing our revised response to your
business address as the WDTK record is not currently open to receiving
this information. If you need to have this information resent to the WDTK
record then you will need to make arrangements for that account to be
reopened and advise us accordingly.
Yours sincerely,
DWP Central FoI Team
Dear Owen Stevens
I am writing in response to your request for information, originally
received on 24th February. We are issuing our revised response to your
business address as the WDTK record is not currently open to receiving
this information. If you need to have this information resent to the WDTK
record then you will need to make arrangements for that account to be
reopened and advise us accordingly.
Yours sincerely,
DWP Central FoI Team
Dear Owen Stevens
I am writing in response to your request for information, originally
received on 24th February. We are issuing our revised response to your
business address as the WDTK record is not currently open to receiving
this information. If you need to have this information resent to the WDTK
record then you will need to make arrangements for that account to be
reopened and advise us accordingly.
Yours sincerely,
DWP Central FoI Team
Owen Stevens left an annotation ()
ICO decision notice: https://ico.org.uk/media/action-weve-tak...
I do not currently intend to appeal further
Note that the following ICO decision notice, regarding a request made by a different requester, was published on the same day: https://ico.org.uk/media/action-weve-tak...
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now
Owen Stevens left an annotation ()
Complaint submitted to ICO