We don't know whether the most recent response to this request contains information or not – if you are Frank Zola please sign in and let everyone know.

Lack of claimant consent to process health information for ESA and Work Capability

We're waiting for Frank Zola to read recent responses and update the status.

Dear Department for Work and Pensions,

Further to your FOI2019/25761 reply of 8 August 2019 https://www.whatdotheyknow.com/request/5... concerning ' 'Lack of claimant consent to send their personal data to GPs, using the ESA65B letters', can you confirm that the DWP will also be retrospectively obtaining GDPR compliant consent from all claimants who signed and dated the ESA1, ESA50 and UC50 forms Declaration Sections as the above reply states amongst other related issues:

"The consent wording included in the declaration sections on ESA forms is being revised and will be removed from the declaration"

as the ICO has said the ESA1, ESA50 and UC50 form Declarations do not comply with the GDPR, to quote:

"We [ICO] took the view that DWP has not complied with its data protection obligations, because its ESA1, ESA50 and UC50 forms do not provide a way for claimants opt in to the statement “I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”
https://mrfrankzola.files.wordpress.com/...

If the DWP is not going to seek ESA1, ESA50 and UC50 GDPR compliant claimant opt-in consent retrospectively please provide information you hold on why and information about ICO guidance you hold that says the DWP do no need retrospective consent to comply with the GDPR?

Yours faithfully,

Frank Zola

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been accepted by the DWP FoI mailbox.
 
By the next working day your request will be forwarded to the relevant
information owner within the Department who will respond to you direct. 
 
If your email is a Freedom of Information request you can normally
expect a response within 20 working days.
 
Email FOI responses will be issued from [1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request do
please contact us.
 
[2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

no-reply@dwp.ecase.co.uk on behalf of DWP Strategy Freedom of Information, Department for Work and Pensions

1 Attachment

Dear Frank Zola,

I am writing in response to your request for information, received 8th
August.

Yours sincerely,

DWP Central FoI Team

Dear Department for Work and Pensions,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department for Work and Pensions's handling of my FOI request 'Lack of claimant consent to process health information for ESA and Work Capability'.

With regards my request:

"can you confirm that the DWP will also be retrospectively obtaining GDPR compliant consent from all claimants who signed and dated the ESA1, ESA50 and UC50 forms Declaration Sections

If the DWP is not going to seek ESA1, ESA50 and UC50 GDPR compliant claimant opt-in
consent retrospectively please provide information you hold on why and information about ICO
guidance you hold that says the DWP do no need retrospective consent to comply with the
GDPR? "

You have not provided any information on whether the DWP is seeking retrospective consent from claimants who signed your GDPR invalid ESA1, ESA50 and UC50 statement:

“I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”

as since 23rd of May 2018 the GDPR/Data Protection Act 2019 required the DWP to meet it's Data PRotection Act obligations by ensuring claimants did opt-in to the statement:

“I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”

Therefore no valid opt-in claimant consent to the above statement has existed since 23rd of May 2018 and as such the GDPR/Data Protection Act 2019 is required to retrospectively obtain opt-in consent to any claimant who has never been given a choice to opt-in to the above statement.

In summary please provide information that the DWP is or is not retrospectively obtaining consent from claimants to send the ESA65B letters to GPs after claimants signed the invalid ESA1, ESA50 and UC50 Declaration, since that they agree to the statement:

“I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…”

The GDPR and ICO opinion clearly show that your ESA1 and ESA50 and UC50 forms DO NOT comply with the GDPR higher standards of opt-in consent and since 23 May 2019 the DWP has been required to obtain GDPR valid consent " fresh consent " [see footnote] and if it has not done so since this date it is required to retrospectively obtain GDPR complaint consent from 23 May 2018 to date. An explanation from the ICO is shown below

Footnote on "fresh consent"

"Can we carry on using existing 1998 Act consents?

You are not required to automatically ‘repaper’ or refresh all existing 1998 Act consents in preparation for the GDPR. But it’s important to check your processes and records in detail to be sure existing consents meet the GDPR standard.

Recital 171 of the GDPR makes clear you can continue to rely on any existing consent that was given in line with the GDPR requirements, and there’s no need to seek fresh consent. However, you need to be confident that your 1998 Act consent requests already met the GDPR standard and that consents are properly documented. You will also need to put in place compliant mechanisms for individuals to withdraw their consent easily, and tell people they have the right to withdraw consent (if you haven’t already done so).

On the other hand, if existing 1998 Act consents don’t meet the GDPR’s high standards or are poorly documented, you need to seek fresh GDPR-compliant consent, identify a different lawful basis for your processing, or stop the processing. If you decide to rely on a different lawful basis, you need to ensure that your continued processing is still fair and transparent. This means you need to take all reasonable steps to tell individuals that you are relying on a new lawful basis and explain what that basis is. You should also minimise their loss of control over the data by giving them the chance to opt out if possible.

Our consent checklist sets out the steps you should take to seek valid consent under the GDPR. This checklist can also help you review existing consents and decide whether they meet the GDPR standard, and to seek fresh consent if necessary."
https://ico.org.uk/for-organisations/gui...

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/l...

Yours faithfully,

Frank Zola

DWP freedom-of-information-requests, Department for Work and Pensions

This is an automated confirmation that your request for information has
been accepted by the DWP FoI mailbox.
 
By the next working day your request will be forwarded to the relevant
information owner within the Department who will respond to you direct. 
 
If your email is a Freedom of Information request you can normally
expect a response within 20 working days.
 
Email FOI responses will be issued from [1][email address]
We recommend that you add this address to your email contacts otherwise
the response may be treated as Spam or Junk mail.  
 
Should you have any further queries in connection with this request do
please contact us.
 
[2]http://www.gov.uk/dwp
 
 

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.gov.uk/dwp

no-reply@dwp.ecase.co.uk on behalf of DWP Strategy Freedom of Information, Department for Work and Pensions

1 Attachment

Dear Frank Zola,

I am writing in response to your request for information, received 6th
September.

Yours sincerely,

DWP Central FoI Team

We don't know whether the most recent response to this request contains information or not – if you are Frank Zola please sign in and let everyone know.