ICO forces DWP to require claimant consent (“opt-in”) before #ESA65B ‘fit-note’ letters can be sent to GPs

we have in fact contacted DWP about the issues you raised with us. We took the view that DWP has not complied with its data protection obligations, because its  ESA1, ESA50 and UC50 forms do not provide a way for claimants opt in to the statement I agree to my doctor or any doctor treating me, being informed* about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…
*[Doctors are “informed” by use of the DWP ESA65B ‘fit-notes’ letter]
ICO response to March 2019 complaint (copy below)

More broadly the complaint response also suggests the ICO has required the DWP to review how it obtains consent [see footnote] to obtain and share (process) claimants personal data.

“We provided guidance to DWP, and advised DWP to review and amend other forms currently being used by DWP where the same issue exists, to prevent future similar complaints about how DWP obtains consent.” [emphasis added]
ICO response to March 2019 complaint (copy below)

New ICO complaint.

A follow up complaint has been sent to the ICO, suggesting they require the DWP to cease and desist sending any new ESA65B letters, as to date claimants have never ‘opted-in‘/consented to the ESA50/UC50 and ESA1 statement: “I agree to my doctor or any doctor treating me, being informed about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…” as required by the Data Protection Act 2018/GDPR.
(This follow up came after a suggestion from Z2K)

 

 

 

 

 

 

 

A key difference now is how under the GDPR consent has far higher standards compared to the 1998 Data Protection Act, an example on the DWPs past opinion is:

“The claimant also consents to this by completing the relevant declarations
when making a claim or completing the WCA questionnaire.” [emphasis added]
FoI 1973 reply: ‘ ‘Where a client “fails” the WCA – does the DWP tell GPs not to issue a medical certificate?‘ – July 19th 2011

The Information Commissioner (ICO) complaint responses now confirm the above approach is no longer valid consent, under the GDPR.

ICO may never have forced the DWP to take this action without the Z2K ‘Scrap The Letters’ campaign. > @Z2K_trust > @ellaabraham > #ESA65B

Note: (29/7/19) See Footnote 1 of ‘ICO tells DWP to “stop” issuing the #ESA65B ‘fit-note’ letters’ which covers two 2017 DWP FOI replies on claimant consent and the ESA65B letter. Cited in ‘YOU can prevent the DWP interfering in the patient/doctor’s relationship‘ and ‘#DoNotConsent to a Doctor/GP being told your Work Capability Assessment decision… #StopTheLetter (ESA65B) Now

Update: (10/7/19)

Correspondence has been sent to the BMA and RCGP and the Work and Pensions Committee, forwarding them the ICO letter and asking them to support a call for the DWP to cease and desist sending ESA65B letters and rescind all past copies sent to GPs.

 

 

 

 

 

Z2K has also created a spoof ESA65B letter, highlighting the letters real objectives.

 

 

 

Update: (16/7/19)

The DWP has released it’s internal guidance concerning claimant consent to obtain and share (process) their personal data, the disclosures also show how the DWP has failed to comply with its own Data Protection guidance for the ESA1, ESA50 and UC50 forms.

Related:

“But there is nothing on the ESA claim form and the ESA/UC work capability questionnaire that give a claimant a way not to agree/consent to the letter being sent, or explain how to withdraw consent at a later date, which are Data Protection Act 2018/GDPR requirements.”
MPs Committee to investigate claimant consent to send DWP #ESA65B letters to GPs? – #ScrapTheLetters @Z2K_trust‘ – April 27th 2019

.
ICO complaint response of July 9th 2019, for March 22nd 2019 complaint.

Footnote

 

ICO: Guidance on consent (Guide to Data Protection – Guide to the General Data Protection Regulation (GDPR) – Lawful basis for processing)

“Consent should be obvious and require a positive action to opt in. Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, and user-friendly.”
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/

The ESA1, ESA50 and UC50 forms bundle multipleterms and conditions“, in one claimant dated and signed ‘Declaration’ with an I “declare“, I “understand“, I “agree” (x 2) and I “also understand” statement. The I “agree” statements also contain multiple ways the DWP and others can obtain personal data from multiple sources and for multiple purposes, let alone sending a GP an ESA65B letter suggesting a claimant has agreed to ‘their  doctor or any doctor treating them, being informed about the Secretary of State’s determination on limited capability for work, limited capability for work-related activity, or both…

cropped esa-50-capability-for-work-questionnaire

ESA1 claim form for Employment Support Allowance - esa1 pdf

 

.

.

.

.

 

Advertisements