DWP Data Protection, A Joke

It has come to my attention that the Data Protection Act is being abused by the DWP and they are regularly in breach of the new regulations concerning the protection of your private data and this is done in several ways, one of the most common is that they turn a computer screen around containing your data and anyone within that field of view can see the data, this is illegal.

More concerning is the fact that all jobcentres now have security staff from major companies such as G4S and others, these are NOT DWP employees and the DWP have rules to follow concerning the protection of your private data, yet these contractors masquerade as DWP staff and often greet people entering a jobcentre and act like jobcentr staff and ask personal questions when they have absolutely no powers to do so, and the jobcentre managers let them get away with it, but it gets worse.

In many cases these alleged security staff wander around the jobcentre and behind the counters and jobcentre staff where they have a full view of all the computer monitors which contain the personal details of anyone any member of legitimate jobcentre staff are dealing with, your private information. If there is any dispute they will often stand behind jobcentre staff where they have a full view of the computer and well within earshot of any conversations which are occuring, so not only can they see all your private data, they can also hear your private business and hear your conversations.

What do the new regulations say:


3 Terms relating to the processing of personal data
.
(1) This section defines some terms used in this Act.
.
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
.
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—
.
(a) an identifier such as a name, an identification number, location data or an online identifier, or
.
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
.
(4)“Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—
.
(a) collection, recording, organisation, structuring or storage,
.
(b)adaptation or alteration,
.
(c) retrieval, consultation or use,
.
(d) disclosure by transmission, dissemination or otherwise making available,
.
(e) alignment or combination, or
.
(f) restriction, erasure or destruction,



8 Lawfulness of processing: public interest etc
.
In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for—

(a) the administration of justice,
.
(b) the exercise of a function of either House of Parliament,
.
(c) the exercise of a function conferred on a person by an enactment or rule of law,
.
(d) the exercise of a function of the Crown, a Minister of the Crown or a government department, or
.
(e) an activity that supports or promotes democratic engagement.

Now we have our first problem and that is that of disclosure, it clearly states that they can only get you to disclose data that is necessary for the performance of a task, for the DWP this is a name, address, and NI number, when they begin asking for personal information such as for identification such as a bank card, telephone numbers, date of birth, and even a driving license or photo identification they are not applicable to any function or task.


56 General obligations of the controller
.
(1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.
.
(2)Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.
.
(3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.

This means that every DWP branch or office MUST have a policy or policies which prohibit or prevent the security or other non DWP staff from gaining access to the visible areas of the computer monitor, or within the vicinity of hearing when personal data is being discussed.