Subject Access Request Guide (SARG) Page 1 of 104
Total Page:16
File Type:pdf, Size:1020Kb
Subject Access Request Guide (SARG) Page 1 of 104 Subject Access Request Guide (SARG) (A guide to handling requests for personal information held by DWP from customers, staff or third party representatives) Contents About this guide Purpose Contact details Introduction What is a data subject? Identifying a SAR: What is a Subject Access Request (SAR)? Sample questions about what is a SAR – with answers Request made verbally quoting the Disability Discrimination Act 1995 or the Equality Act 2010 Request made by email Personal information held by other government departments or bodies Personal information held by Child Maintenance Group (CMG) Requests for information held by organisations providing services to DWP (Providers) Requests for information covered by normal business made by: • customer • a solicitor/third party • in relation to Appeals Checklist of DPO responsibilities during the Subject Access Request Process Publicising your role Time limits Effective Date of a Subject Access Request Charges http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 2 of 104 Repeat requests Ownership: Ownership of the Subject Access Request Response required from receiving Business Unit only Transfer of SAR to correct DPO Subject Access Requests for Personal Injury Compensation Records Initial Action: Confirming identity Providing the right information Contact via telephone for clarification of minor issues Subject Access Requests made by a DWP customer or appointee/Power of Attorney Subject Access Requests made by current or ex-members of staff Subject Access Requests made by solicitors or other third parties Subject Access Request Rights Consent • Copy of Form of consent acceptable to DWP Multiple SARs from solicitors or other third parties in relation to one customer Subject Access Requests made by: • Solicitors directly received by CRU • a Litigation friend • a Member of Parliament (MP) or former MP for • a customer’s information • their own information • Employers • Unemployment history requested • Employment history requested How to handle the Further Information standard letters when SAR received from: http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 3 of 104 A DWP customer or appointee/Power of Attorney • SANTA01 not required • SANTA01 required § SANTA01 not returned § SANTA01 completed and returned A solicitor/third party • SANTA01S or SANTA03 not required • SANTA01S or SANTA03 required • SANTA01S or SANTA03 not returned • SANTA01S completed and returned • SANTA03 completed and returned Handy Tip (if Further Information letters are consistently returned to the wrong office) Contact via telephone for clarification of minor issues Gathering Information: Taped conversations/recorded calls • Non ESA call • ESA call Closed-Circuit Television (CCTV) footage Centre for Health Disability Medical Services records Information held by organisations providing services to DWP (Providers) Audit Trail Information Personal Data contained in Emails Customer Information System (CIS) data How to request Data Protection (DP) prints from DWP computer systems • Requesting Data Protection Prints • What to do if a requested Data Protection print is not received • Appeals Service – now HMCTS http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 4 of 104 • Armed Forces Independence Payment (AFIP) • Attendance Allowance (AA) • Benefit Cap Application System (BCAS) • Bereavement Benefit • Call Booking System (CBS) • Carers Allowance (CA) • Central Processing Team Management Service (CPTMS) • Child Benefit (ChB) • Child Maintenance Group (CMG) • Customer Information System (CIS) • Customer Management System (CMS) • Customer Tracker Database • Decision Making and Appeals System (DMAS) • Disability Living Allowance (DLA) • Employment and Support Allowance (ESA) • Incapacity Benefit • Income Support • Industrial Injuries Scheme Benefits • Jobseekers Allowance (JSA) • Labour Market System (LMS) • Local Payment System (LPS) • Maternity Allowance • Medical Services Referral System (MSRS) • New Tax Credits (NTC) • Overpayment Calculation System (OpCalc) • Overpayment Decision System (OpDec) • Overpayment Recovery System (OpRec) http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 5 of 104 • Payments Repository Computer System (PRCS) • Pension Credit • Pensions and Overseas Awarding System • Personal Independence Payment (PIP) • State Pension including State Pension Forecasts • Severe Disablement Allowance • Social Fund • Universal Jobmatch • Vaccine Damage Payment • War Pension/Armed Forces Compensation Scheme • Widows Benefit • Winter Fuel Payments Data found or not found: Data found Data exists but cannot be found • SAR made by customer • SAR made by solicitor/third party Data should exist but has been destroyed in error • SAR made by customer • SAR made by solicitor/third party No data held for customer Preparing a SAR response: Weeding and destruction Potentially offensive material Providing SAR prints in large font Drafts – providing drafts in response to a SAR Complaint files http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 6 of 104 Exemptions • General Information • Importance of completion within timescales • Risks associated with incorrect disclosure/withholding of data • Incorrect Addresses • How to prepare exempt personal information • Keeping a record of exempt personal information • Telling the customer or solicitor/third party information has been withheld • The Exemptions: • Crime and taxation • Allegations of fraud • Medical data or the health of the customer • Information supplied by doctors • Research, history and statistics • Human Resource issues • Third Party data • Key considerations when deciding if third party data should be disclosed • Third party information on fraud files • Staff names • Legal Advice (Legal and Professional Privilege) • Unacceptable Customer Behaviour (UCB) markings • Exempt Data - sample questions and answers Issuing a SAR response: DPO action before issuing a SAR response Method of response to the customer or solicitor/third party Response to be posted Customer requests response to be e-mailed http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 7 of 104 Response to be sent on disk Request by customer to view/collect data at a DWP office Subject Access Requests made by solicitors – customer wishes to see their information SANTA05 Tear- Off returned by customer • Some information to be sent to the solicitor/third party • All information to be sent to the solicitor/third party • No information to be sent to the solicitor/third party SANTA05 Tear- Off not returned by customer Retaining documents on completion of all action Clearance date of a Subject Access Request Enquiries following a response to a Subject Access Request: • the customer believes they have not received all the data held on him/her • The solicitor / third party believes they have not received all the data held on the customer o Customer consented to only some information to be sent to the solicitor/third party o All information to be sent to the solicitor/third party • The customer disputes the accuracy and/or the relevance of the data • The solicitor/third party disputes the accuracy and/or the relevance of the data • The customer or solicitor/third party does not understand the data • The customer finds some of the data offensive • The customer or solicitor/third party is unhappy that the response was not issued within the 40 days allowed • Customer alleges damage/damage and distress • Requests for Assessment by the Information Commissioner • Customer or solicitor/third party is dissatisfied with third party data being withheld • Documents returned because they cannot be delivered • Court costs or an application for court costs • Requests from customers to stop processing personal information or to delete their personal information from our computer systems http://intralink/1/corp/sites/infodir/kimd/dataprotection/dp/sars/DWP_D028720.asp 06/07/2015 Subject Access Request Guide (SARG) Page 8 of 104 A brief outline to the changes to this guide About this Guide This guide provides information and advice on how to deal with requests by customers and staff for personal information held about them by DWP. These are known as Subject Access Requests (SARs). Purpose This guide is for use by Data Protection Officers (DPOs) and their Deputies throughout DWP and aims to provide the basic information they need to handle SARs. Contact Details DPOs may also contact Data Sharing and Data Protection Policy for more detailed guidance on the SAR process, including handling follow up queries from customers or their representatives. Introduction The purpose of the Data Protection Act 1998 (DPA, or “the Act”) is to protect the rights of individuals about whom personal data is obtained, recorded, held or disclosed. Under section 7 of the DPA, individuals have the right to see and/or receive a copy of all their personal information held about them, unless certain Exemptions apply, on both electronic and clerical records. This includes taped telephone calls and CCTV footage. What is a data