Privacy notice

Department for Work and Pensions Data Sharing

Department for Work and Pensions (DWP) - UK General Data Protection Regulation (UK GDPR) compliance

Rights of data subjects

Rights:

If yes, are any additional actions required.

If no, why this right does not apply.

The right to be informed (Articles 13 and 14)

 

DWP and Welwyn Hatfield Borough Council (WHBC) have appropriate processes in place which provide adequate information to customers to ensure they know how and why their data is being used and their rights and responsibilities.

The right of access

(Article 15) (Subject Access Request)

Subject access request data will be shared by WHBC providing there is no Special Category Data included, as defined within UK GDPR.

If the request relates to Special Category Data being included, WHBC will liaise with DWP via before releasing any information.

The right to rectification

(Article 16)

Where data has been shared and it is then identified that the information was inaccurate and has subsequently been rectified, DWP and WHBC have a responsibility to notify the appropriate organisation. DWP will notify and supply corrected data to WHBC.

The right to erasure

(Article 17)

We are processing data under Article 6(1)(e) however, DWP and WHBC have processes and procedures in place to handle any requests received. In circumstance that a right to erasure is successful, DWP and WHBC will follow proper procedures.

The right to restrict processing (Article 18)

All the data covered by DWP and WHBC is derived from a number of DWP, HMRC, Home Office and local authority sources. If applicable, the relevant organisation will undertake action regarding restriction of processing and corrected data will be supplied to the other parties.

The right to data portability (Article 20)

The right to portability only applies where the processing is carried out on the basis of consent or contract and it is automated. Therefore, it does not apply to this processing.

The right to object (Article 21)

DWP and WHBC have processes in place to advise customers of their right to object.

Rights related to automated decision-making including profiling (Article 22)

WHBC do not have permission to conduct automated decision-making with DWP, HMRC and/or Home Office data.

Data sharing initiatives  

DWP data is data which WHBC may access and only make use of for the limited purposes of administering the following: 

  • Housing Benefit (HB) and any associated counter fraud & error and overpayment recovery activity
  • Local Council Tax Reduction (LCTR) schemes and any associated recovery of LCTR errors
  • Local Welfare Provision (LWP)/Scottish Welfare Fund (SWF)
  • Adult Social Care Financial Assessments (ASCFA)
  • Discretionary Housing Payment (DHP)
  • Disabled Facilities Grant (DFG)
  • Disability Adaptation Grant (DAG)
  • Single Housing Benefit Extract (SHBE)
  • Blue Badge Scheme
  • European Union Settlement Scheme (EUSS)

HMRC data is:

  • Tax credits data made available to WHBC for the limited purpose of administering:
    • HB
    • LCTR schemes and any associated recovery of LCTR errors
    • ASCFA
    • DHP
    • DFG
    • DAG
    • LWP
  • Earnings and non-state pension data shared via the Verify Earnings and Pensions portal for the administration:
    • HB
    • LCTR schemes and any associated recovery of LCTR errors
    • DHP
    • DFG
    • DAG
  • Earnings data shared via LCTR data share for the administration of:
    • LCTR
    • ASCFA
    • Discretionary Housing Payment
  • Earnings and non-state pension data shared via the DWP system for accessing customer information to:
    • Support ASCFA
    • Check the earnings of non-dependants listed on HB claims 
    • Support the HB debt recovery process 

Information sharing and data retention

All data made available and shared with WHBC, are to be processed only for defined purposes, subject to the exceptions described below.

If WHBC wishes to use data made available by DWP for a specific purpose, for another purpose, it must seek permission from DWP.

WHBC will not share any data made available by DWP with anyone else (whether in the Private, Public or Third party sectors), including any internal project teams/consultants without permission from DWP.

Data made available by DWP is not retained for longer than is necessary and will be destroyed securely in line with NCSC and ICO guidelines such as: Practical methods for destroying documents that are no longer needed.

Lawfulness of processing

The supply of data by DWP to WHBC is permitted by specific provisions of primary and secondary legislation.

In addition, in order to comply with data protection legislation, one of the lawful bases for processing described in Article 6(1)(e) must apply and, for special category data, one of the conditions in Article 9(2)(b).

Re-use of data/lawful basis

In some circumstances data supplied by DWP can be re-used for another purpose.

If WHBC wish to make a request to re-use data, we will identify both an appropriate lawful basis (under article 6 of the UK GDPR) and a statutory power in order to process personal data made available by DWP.

WHBC will ensure that any re-use request is lawful.

Permission will be sought directly from HMRC, in relation to any re-use requests for data derived from HMRC.  WHBC will not onwardly disclose any data derived from DWP, HMRC and/or Home Office data without a response from DWP.

Lawful means of disclosure of HMRC information

HMRC information is bound by statutory legislation under the Commissioners for Revenue and Customs Act 2005 (CRCA). S18 of the CRCA makes it clear that any HMRC information should not be disclosed unless there is a lawful authority to do so. If any disclosures are made, they will meet the requirements of the Data Protection Act 2018, the Human Rights Act 1998 and UK GDPR.

HMRC tax credit and earnings information is first shared with DWP for social security purposes, and HMRC provides authority for DWP to onwardly disclose this information to WHBC for the specific purposes of administering HB or LCTR. Section 127 (5) of the Welfare Reform Act 2012 allows DWP to onwardly disclose information which is held for the purposes of functions relating to Tax Credits, earnings, Child Benefit or Guardians Allowance to an authority administering HB or LCTR, or to a person authorised to exercise any function of such an authority relating to such a benefit, for use in the administration of such a benefit.

Where HMRC data has been made available to WHBC, it may not be re-used for another purpose unless the law allows it. In particular, WHBC will identify an appropriate statutory power and lawful basis (and condition for processing if necessary) for the further use.

Data sharing/re-use

Where WHBC are considering how best to use and share data we hold they should continue to take account of the provisions of the Data Protection Legislation, in addition to the SSAA 1992, WRA 2012 and The Social Security (Information-sharing in relation to Welfare Services, etc.) Regulations 2012 (“2012 Regs”).

Lawful basis and condition for processing under UK GDPR

Article 6 of the UK GDPR stipulates that you must have a valid lawful basis in order to process personal data.

The lawful basis here is Article 6(1)(e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Article 9 of the UK GDPR stipulates that you must also have a condition for processing special category data, for example, data concerning health or revealing racial or ethnic origin.

The condition for processing here is Article 9(2)(b) (processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Domestic law or a collective agreement pursuant to Domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject). The associated condition in Schedule 1, Part 1, para. 1 of the DPA 2018 will be met.

The purpose for which data is shared

DWP provides data to WHBC for use in the administration of HB.

DWP provides data to WHBC for use in checking the accuracy of information relating to HB and where appropriate, amending or supplementing such information.

DWP provides data to WHBC in order to support the prevention, detection, investigation or prosecution of benefit offences. Data sharing is intended to ensure that the right amount of HB is paid to the right people at the right time.