The Generic Provider Guidance – Chapter 5
The following issues are addressed in this memo.
The introduction of the Customer Consent form within Chapter 5 to enable DWP to validate job related outcomes does not provide clarity whether this form can be used by both DWP and the Provider.
As part of the payment validation process for job related outcomes Providers are required to obtain customer consent to allow DWP to contact their employers. A customer consent form has been designed for this purpose and can be found at Annex 1 of Chapter 5 of the Generic Provider Guide.
This consent form has been designed to ensure that DWP is compliant with DPA requirements for the purpose of contacting employers and cannot be altered. This consent form will not entirely cover the responsibilities of the Provider. Therefore to comply with Data Protection legislation,Providers must have a customer declaration and ensure that this declaration is included in the customer’s induction pack which gives authority for the Provider to collect, process and share customer information. The declaration should be completed and signed by the customer and kept on file by the Provider. Details of what must be included in the customer declaration are given below.
Customer Consent to Sharing/Disclosure of Personal Information
Providers are reminded that they are required to obtain customer consent prior to their collecting of customer’s personal information and sharing/disclosure of such information with the Department and/or other providers.
In addition, the customer must give clear written consent for the provider to use customer personal information when contacting employers to obtain evidence of employment.
These consents must be given by the customer before any information disclosure takes place.
The following notice was published in the ‘Notices to Providers’ section of the ‘Supplying DWP’ page on the DWP Website on 6 May 2008:
Compliance with Data Protection Act and Information Disclosure
All contracted employment providers must, as a matter of urgency, review the arrangements they have in place for collecting, processing and sharing customer information.
It is important to remind a customer of the DWP confidentiality statement which they signed when they first made a claim to benefit. However, a customer’s signature which only acknowledges awareness of the DWP Confidentiality Statement does not constitute “consent” at all and does not enable any sort of data sharing or disclosure. It simply provides a degree of assurance that DWP will handle personal data fairly and lawfully.
There is no specific legislative “enabler” which gives a provider the ability to gather or share customer’s information with a third party, for example an employer or another training provider, for the purpose of placing the customer into training/work and obtaining outcome-related payments from DWP. The informed consent of the individual must be obtained beforehand, in line with the requirements of the Data Protection Act.
The information disclosure consent form must, as a minimum, contain the following information:
- What customer’s information your organisation will collect
- why the organisation needs the information, for example for the purpose recording the numbers of customers placed into training and/or employment , monitoring the effectiveness of the service and reporting outcomes to DWP and claiming associated payments
- how the information will be stored
- when and why the information will be shared with a third party, for example an employer will be contacted when the customer starts work within so many weeks of leaving provision for the purpose of obtaining evidence of employment so that a job outcome payment can be claimed from DWP
Your organisation needs to make it clear to customers that giving consent is voluntary and that refusal to give consent or withdrawal of an existing consent will not affect any benefit they may be entitled to.
Authorisation to contact an employer to obtain evidence of employment must be expressly stated by the Provider and consented to by the customer before any information disclosure takes place.