Work First Scotland: privacy impact assessment

5. Questions to identify privacy issues

5.1 Involvement of multiple organisations

• The delivery of Work First Scotland will involve the Scottish Government, the Department for Work and Pensions and SG service providers contracted by the Scottish Government; Momentum Skills ( www.momentumskills.org.uk), Remploy ( www.remploy.co.uk) and Shaw Trust ( www.shaw-trust.org.uk) and Statutory Referral Organisations.

5.2 Anonymity and pseudonymity

• The project does not require the matching of data sources together to produce new data.

5.3 Technology

• The transfer of a payment file between DWP and SG will require a new interface between DWP’s Provider Referral and Payment System ( PRAP) and SG’s Scottish Government Enterprise Accounting System ( SEAS). The payment file transferred at this stage will include the customer’s National Insurance number. This process will trigger an automatic outcome-based payment by the SEAS system to the SG service provider. This process will take place via the Government Gateway and will not have substantial potential for data intrusion.
• Management information will be transferred between DWP and SG via secure email and Bravo. These are not new systems. In some instances personal data will be transferred. A full account of the data being transferred is provided at Annex A.

5.4 Identification methods

• The customer’s National Insurance number will be used as a unique identifier.
• There will be no new or substantially changed identity authentication requirements.

5.5 Personal data

• Personal data will be transferred from DWP to SG service providers and from SG service providers to SG Contract Management personnel. In some instances this will include sensitive data such as information about a customer’s health.
• In some cases, SROs will introduce customers to the SG service provider as a potential Work First Scotland customer.
• This information will be used by SG service providers to ensure that the service being provided is appropriate to the customer’s needs. Sharing of this information will be restricted to staff of the SG service providers who are delivering the service and a limited number of SG staff who require the data to carry out compliance and quality assurance checks to ensure that services are being delivered to a satisfactory standard.
• A full account of the data being transferred and the purpose is provided at Annex A. Access to this information will be limited to those with a direct need to use the information to benefit the customer and assure the quality of the service and will be transmitted and stored securely.
• The process of referral from DWP work coaches will mirror the existing DWP process of referral to current DWP service providers, as these service providers will also be contracted by the SG under WFS. Under WFS the DWP Work Coach will complete the referral and required data handling on behalf of the SG, sharing personal data with SG service providers at the point of referral.
• During the customer’s time participating in WFS SG service providers may engage with DWP work coaches in order to effectively deliver the service. Where a customer has given the appropriate consent, DWP work coaches will continue to engage with the customer for DWP purposes. A leaver plan will be provided to DWP by the SG service provider when the customer leaves WFS without securing employment. This is to help the DWP work coach assess what further support would benefit the customer.
• SG will use personal data held by SG service providers to allow SG to report – in Ministerial briefings and statistical publications - on the demographic characteristics of customers on the programmes. This data will be held in accordance with SG service providers’ security plans, and anonymised data shared with SG.
• With the customer’s consent, SG and SG service providers may share data with employers, other training providers and for the purposes of developing marketing materials.
• With the customer’s consent SG may contact the customer to invite them to take part in evaluation activities.
• These changes will apply to approximately 3,300 individuals.
  
• Data from SG service providers will be cross-referenced with data from PRaP for the purposes of quality assurance to allow the production of summary statistics and Ministerial briefings.

5.6 Changes to data handling procedures

• There will not be new or changed data collection policies or practices that may be unclear or intrusive, the data collection will mirror existing DWP and SG service provider processes.
• There will not be changes to data quality assurance or processes and standards that may be unclear or unsatisfactory?
• There will not be new or changed data security access or disclosure arrangements that may be unclear or extensive
• There will not be new or changed data retention arrangements that may be unclear or extensive.
• There will not be changes to the medium of disclosure for publicly available information in such a way that the data becomes more readily accessible than before.

5.7 Statutory exemptions/protection

• The data processing will not be exempt in any way from the Data Protection Act or other legislative privacy protections.
• The project does not involve systematic disclosure of personal data to, or access by, third parties that are not subject to comparable privacy regulation

5.8 Justification

• The project’s justification does not include significant contributions to public security measures.
• During 2015 SG consulted extensively to inform the development of Scotland’s employability services. Following careful and independent analysis of the responses received, the key principles and values of the Scottish
  Approach to employability which will underpin devolved employability services in Scotland from 1 April 2017 were set out in March 2016 in Creating a Fairer Scotland: A New Future for Employability Support in Scotland ( http://www.gov.scot/Resource/0049/00498123.pdf)
  As part of the continued Fairer Scotland discussion, the Scottish Government’s Employability Programme Division engaged the Central Government Digital Transformation Service ( CGDTS) and User Research and Engagement ( URE) teams to explore the personal experiences of people engaging with employability services. 21 organisations and over 150 individuals participated and the report completed in December 2016.
• The justification for the new data handling is not unclear or unpublished

5.9 Other risks

• There are no risks to privacy not covered by the above questions