Memorandum of Understanding (MoU) Between Scottish Ministers (SM) and Secretary of State for Work and Pensions (SSWP) on joint working arrangements

12. Information Sharing

12.1. This section does not relate to personal data. It relates to information as defined in paragraph 4.3, that is any piece of documentation, statistical information, financial information, contracts and other information that does not contain personal data. Data Sharing Agreements exist and capture issues and terms relating to the sharing of personal data.

12.2. SM and SSWP recognise the need to share information, as deemed appropriate and proportionate for the purposes of implementation of the devolved powers and the successful administration of benefits across the UK. The Scotland Act 2016 introduces a new legal gateway, at section 34, which is available for disclosure of information from DWP to SG officials and vice-versa for the purpose of a social security function.

12.3. This section outlines information sharing that is generic, cross-cutting or ad hoc in nature. If DWP is able to meet the request to provide information, it may share the information in a different format to the one requested.

12.4. In order to baseline its policy and implementation options proposals, the Social Security Programme needs to understand the current social security policy and delivery environments, as deployed by DWP. Similarly, the Employment Services Programme needs to understand the current employment support policy and delivery environments, client volumes and costs, as deployed by DWP.

12.5. In both instances, this requires a largely one-way, transfer of background information on current benefits and current employment support programmes and delivery arrangements, from SSWP to SM, including relevant changes proposed to these by DWP as part of their own policy development, implementation and corporate planning.

12.6. Alongside that immediate need for access to information, the successful implementation of the provisions in the Scotland Act 2016 relating to Social Security and Employment Support Programmes will depend on a shared understanding of policy development and implementation plans by SM and SSWP. There may be occasions when SG officials make information requests on reserved benefits and employment programmes and services to ensure best possible outcomes for both administrations and claimants. On an on-going basis, both parties will share relevant information on devolved and, where appropriate, reserved benefits due to issues such as, but not limited to, passporting benefits and uprating.

12.7. In relation to new policy proposals, SG officials may approach DWP for advice in general terms on its emerging policies. Detailed policy, costings and flexibility work would be chargeable; DWP will provide an estimate of the likely cost of such work, and SM may decide to meet that cost or withdraw its request.

12.8. Both SSWP and SM may ask for reimbursement of costs linked to current policies, analytical, financial or operational information that is not in a readily available format to share.

12.9. For all information that is shared between SM and SSWP

12.9.1. All information shared between SM and SSWP is done so under the Information Sharing process described in paras 12.2 – 12.8. All parties will only share information where it is lawful to do so.

12.9.2. SSWP will use the legal basis for sharing information in order to support SM in their legitimate functions including transition and discovery phases, as the law allows.

12.9.3. Either party shall sign single-signature confidentiality agreements, where it is deemed necessary. The agreements shall include the names of staff from the requesting organisation that require to access information deemed confidential by either party.

12.9.4. DWP and SG officials must identify appropriate arrangements for information to be requested in writing and also to appropriately manage these requests.

12.9.5. Requests for information are to be made in writing (usually by email). Any verbal requests must be followed up in writing.

12.9.6. All email communications within the terms of this MoU, including those within SG, must be from and to appropriate Government email addresses. All parties will put in place data handling strategies. These will be available to be viewed by either party on request.

12.9.7. If one party agrees to provide information but cannot do so within 15 working days of the date of the request, it will give the other an estimate of when the information will be provided.

12.9.8. Once information has been shared, or all parties have been notified that the information cannot be provided, para 12.15 and 12.17 refer below, then the information request will be closed within 15 working days, unless sufficient business justification is provided.

12.9.9. If information requested by SM is not available to SSWP as standing data, and so would need a specific query of IT systems, or otherwise incur significant cost, SSWP will give SM an estimate of the cost of the query. In that case, SM may either agree to pay the cost of the query or withdraw the request.

12.9.10. Information relating to commercial arrangements may be subject to confidentiality restrictions. If information requested by SM or SSWP would require a supplier to be paid to give an estimate, SM or SSWP may either agree to pay the cost of obtaining the estimate or withdraw the request.

12.10. Confidentiality Agreements

12.10.1. Both parties shall ensure staff are aware of their obligations and responsibilities under the Civil Service Codes when handling in particular confidential commercially sensitive information.

12.10.2. The identification of a requirement for confidentiality agreements is the responsibility of the party that will provide the information. Either party must ensure that information that is provided under confidentiality agreements referred to in 12.9.3 is only accessible by named authorised persons. Any access outside of this will be treated as if it were a breach of the confidentiality agreement(s).

12.10.3. Notification of the confidentiality agreement to be signed must go to the designated SPoCs detailing the reason that the agreement is required, and the request for information to which the confidentiality agreement is applicable. Either party may be requested to provide, at any time, audit information about access to documentation and storage for documents provided under the overarching confidentiality agreement as is reasonable. This should be provided within 5 working days of the request.

12.10.4. The process for the provision and the audit of all information that has been provided under a confidentiality agreement is to be agreed by both parties. Should a member of SG staff who previously had access no longer require access, arrangements must be made to remove their access to paper and electronic information and a record must be retained. The receiving party must ensure that information that is provided under any confidentiality agreement is only accessible by authorised persons. Any access outside of this will be treated as if it were a breach of the Confidentiality Agreement.

12.11. Information Handling

12.11.1. For all information received, which is not already in the public domain, the receiving party has a responsibility to keep audit records of the location of and access provided to all information.

12.11.2. Information will be stored and managed appropriately, in accordance with all applicable data protection legislation, principles, articles and recitals.

12.11.3. It is the responsibility of the receiving organisation to manage the appropriate access to all information provided under this MoU and to ensure that it is used in line with the terms of this MoU.

12.12. Audit

12.12.1. Either party may be requested to provide, at any time, audit information about access to documentation and storage for documentation as deemed reasonable. This should be provided within 5 working days of the request.

12.12.2. Both parties must have in place appropriate information handling strategies that detail the methods in which information handling is achieved. Appropriate sections of the strategies must be shared at the request of either party.

12.13. Publication and Announcement

12.13.1. Any information that has been provided under this MoU that is not in the public domain, and unless otherwise stipulated by the information owner, must not be published or announced without prior written consent from the other party. Acquisition of written consent would be co-ordinated by the relevant SPoCs.

12.13.2. Similarly, where either party is in doubt as to whether something can be released, the relevant SPoC must be contacted in sufficient time to provide guidance.

12.13.3. Each party should use all reasonable endeavours to provide as much notice as possible to the other party of any publication of any research pertaining to the benefits being devolved. Publication of statistics will fall under the statutory 28 day pre-publication rule. Any requests for specific statistics to be shared 24 hours before publication should be done in accordance with the official statistics guidance.

12.14. Information that may be provided to SM

12.14.1. Requests for information made by either the Social Security Programme or the Employment Services Programme will be dealt with by DWP officials on a case by case basis.

12.14.2. Information that can be provided includes any operational and administrative detail that is available for the administration of the devolved benefits and employment support powers.

12.14.3. Details of centralised and overarching functions may also be requested by SM and may be shared as appropriate.

12.14.4. Where commercial contracts are in place that impact the administration of any of the devolved benefits or centralised functions, requests for information that include commercially sensitive information will be managed on a case by case basis. It is understood that it will sometimes be necessary to provide information that is not available within the public domain to SM for the purposes of understanding the current position and risk. DWP and SG officials will work together to identify the best solution to get access to this information. The confidentially agreement clauses above will apply unless agreed otherwise. SSWP may, on occasion, request confidentiality agreements to be signed when deemed appropriate.

12.15. Information that may not be provided to SM

12.15.1. In the absence of a legal basis for doing so, SSWP will not provide to SM individual benefit claimant information or service user information, or information from which details of the social security or the employment support affairs of individuals or businesses (or other legal persons) may be inferred.

12.15.2. SSWP will not provide information to SM that gives insight into decision making by the present or previous UK governments where political viewpoints are included. However, the evidence base for decisions may be shared, as appropriate.

12.16. Information that may be provided to SSWP

12.16.1. Requests will be dealt by SG officials on a case by case basis. Examples include, but are not limited to, programme and governance documentation, joint working, aligned communications, relevant analysis, emerging policy thinking where there is potential impact on existing or future DWP policy, services or operations and agreed policy decisions.

12.16.2. Where commercial contracts are in place that impact the administration of any of the devolved benefits or centralised functions, requests for information that include commercially sensitive information will be managed on a case by case basis. It is understood that it will sometimes be necessary to provide information that is not available within the public domain to DWP for the purposes of understanding the current position and risk. SG officials and DWP will work together to identify the best solution to get access to this information. SM may, on occasion, request confidentiality agreements to be signed when deemed appropriate.

12.17. Information that may not be provided to SSWP

12.17.1. In the absence of a legal basis for doing so, SM will not provide to SSWP individual benefit claimant or service user information, or information from which details of the social security or the employment support affairs of individuals or businesses (or other legal persons) may be inferred.

12.17.2. SM will not provide information to SSWP that gives insight into decision making by the present or previous SG administrations where political viewpoints are included. However, the evidence base for decisions may be shared, as appropriate.

12.18. Use of information provided to (and by) SM:

12.18.1. In order to enable the Scottish Fiscal Commission (SFC) to deliver its duties in preparing independent forecasts on devolved social security expenditure in Scotland, SG officials may share information with SFC that SG officials have received from DWP. This sharing is exempt from the conditions stipulated in clause 12.18.4 and does not need to be approved by the DWP SPoC. SFC are permitted to publish this information to the extent that it directly supports its forecasts. This MoU should not be a primary route for SFC data, so no requests for additional DWP data should be made via SG following revised sign-off of this MoU.

12.18.2. SM, SSWP,SG and DWP officials are subject to the Official Secrets Act 1989, the Data Protection Act 2018, UK General Data Protection Regulation (UK GDPR) Social Security (Scotland) Act 2018, the Scotland Act 1998 and 2016, Welfare Reform Act 2012, Computer Misuse Act 1998, Regulation of Investigatory Powers Act 2000, Regulation of Investigatory Powers (Scotland) Act 2000, Access to Health Records Act 1990, Equality Act 2010 and Human Rights Act 1998 with regard to information each party receives from each other. Information supplied by DWP to SG that is to be held in confidence under the terms of this MOU will be exempt from disclosure under the Freedom of Information (Scotland) Act 2002, by virtue of section 3(2)(a)(ii) of that Act. Information supplied by SG to DWP will not be subject to a similar exemption from the Freedom of Information Act 2000.

12.18.3. In case of either party looking to release information into the public domain which has been provided under this MoU, then, unless the relevant Freedom of Information legislation requires disclosure, the party holding the information cannot do so without the prior consent by the party that provided the information. In these situations, the relevant SPoCs will coordinate the appropriate response on a case by case basis.

12.18.4. SM will treat all information passed to it by SSWP that is not already in the public domain as "Official – Sensitive" and will restrict access to the same to those with a genuine business need within SG. Unless required to release such information under the Freedom of Information (Scotland) Act 2002, SM and SG officials will not forward the information to third parties or put it into the public domain (directly or indirectly) without the prior agreement of the relevant DWP SPoC.

12.18.5. Similarly, SSWP will treat any such information provided to it by SM, within the context of requests made under this MoU, as "Official – Sensitive" and will restrict access to the same to those with a genuine business need within DWP. Unless required to release such information under the Freedom of Information Act 2000, SSWP and DWP officials will not forward the information to third parties or put it into the public domain (directly or indirectly) without the prior agreement of the relevant SG SPoC.

12.18.6. Unless specifically agreed otherwise (for example Universal Credit Choices Management Information), SM recognise that information SSWP shares under this MoU remains SSWP information. Once SM has used that information as part of its evidence to formulate policy, analysis or plans, the said policy, analysis and plans are the property of SM. As such SM may also share and publish these policies, analysis and plans externally at their sole discretion. However, if, as part of that publication or sharing, SM wish to directly quote any information that SSWP has provided to SM, past or present, authorisation will be sought in advance.

12.18.7. Unless specifically agreed otherwise, SSWP recognise that information SM share under this MOU remains SMs' information. Once SSWP has used that information as part of its evidence to formulate policy, analysis or plans, the said policy, analysis and plans are the property of SSWP. As such SSWP may share and publish these policies, analysis and plans externally at their sole discretion. However, if, as part of that publication or sharing, SSWP wish to directly quote any information that SM has provided to SSWP, authorisation will be sought in advance.

12.18.8. Where information is to be published or shared externally as part of any aligned communications activity, SSWP and SM will agree the content of this information in advance of its publication through the Communications group.

12.19. Security and Assurance

12.19.1. In managing the information provided, all parties will:

• Use the information only for the purposes described in this MoU.
• Continue to hold the information only as long as there is a business need to keep it;
• Ensure that only civil servants, special advisors, Ministers, partners, and suppliers who have a genuine business need to see the information will have access to it and use it appropriately; and
• Report any information losses.

12.19.2. If any party to the agreement forwards or shares (verbally or in writing) information shared under this MoU to/with third parties or puts it into the public domain without the agreement of the other party's SPoC, whether deliberately or inadvertently, the other party to the agreement may suspend the operation of this MoU or specific Annexes thereto if it deems this appropriate.

12.20. Resolving Issues

12.20.1. Any complaints, problems or issues specific to the information provided under this MoU, or apparent breaches of its terms, will be discussed by SG and DWP SPoCs, who will agree a course of action in line with the agreed escalation process as previously outlined at Section 4 and 5 of this MoU.