Data request

benno

I find it strange that IAS (Independent Assessment Service) who carry out reviews have no data control policy as such.  My review like many others is well overdue and extended again. My health has got worse and of that has led to further difficulties in how I manage day to day activities (ADLs).  I received a text to say they now have my review, so I called them and asked for the information they hold on me, which is my right under DPA/GDPR. They informed they could not and needed to go through DWP. I wanted to know what evidence has been sent by DWP as do not trust them as wanted to prepare for the review and have access to the same information they would have.  They told me they could not do that and to request that through DWP. I informed I had previously done a SAR with DWP and got a lot of useless information and just needed what IAS hold.  They are doing on my request but are going through DWP.  I believe this is wrong and illegal as a company they should have their own policy and process and find it highly dubious that they do not.  This would be the same when they refuse to provide after interview reports, stating you need to go to DWP. Does anyone have legal knowledge and can this be challenged.

benno

It is my legal right, not about money 

MW123

@benno

Firstly, you need to clarify whether IAS is acting as a data controller or a data processor in this context. Under the GDPR, a data controller determines the purposes and means of processing personal data, while a data processor processes personal data on behalf of the controller.

If IAS is acting as a data processor, they may not have direct control over the data they process, as they would be following instructions from the data controller, which in this case seems to be the DWP.

However, if IAS is a data controller for the personal data they collect during the review process, they should have their own data control policies and procedures in place to comply with GDPR requirements.

Protecting your privacy and being able to see your own information are basic rights.  It's essential for organisations to respect these rights to build trust and prevent misuse of personal data.

benno

MW123 said:

@benno

Firstly, you need to clarify whether IAS is acting as a data controller or a data processor in this context. Under the GDPR, a data controller determines the purposes and means of processing personal data, while a data processor processes personal data on behalf of the controller.

If IAS is acting as a data processor, they may not have direct control over the data they process, as they would be following instructions from the data controller, which in this case seems to be the DWP.

However, if IAS is a data controller for the personal data they collect during the review process, they should have their own data control policies and procedures in place to comply with GDPR requirements.

Protecting your privacy and being able to see your own information are basic rights.  It's essential for organisations to respect these rights to build trust and prevent misuse of personal data.

Thanks for that information. I am concerned that a company like IAS (Atos) who are undertaking the serious work of assessments and reviews are only data processors and as with my initial concern, just  following orders from DWP, creating a situation where IAS can operate without accountability and DWP can lay blame with them also avoiding accountability.  They would be dealing with highly sensitive information as just a data processor.  Seems dubious to me. 

Adrian_Scope

Note from online community team:

Where possible we like all discussions to continue, but we’re choosing to pause this discussion for now so things can cool down and we can review it. For more information, please read our  online community house rules.

We will review it and if we are satisfied the discussion can continue, we will hope to un-pause it by lunch time tomorrow. 

Rosie_Scope

Note from online community team:

Following review, we have now unpaused this discussion.

Please remember that all discussions on Scope’s online community should remain civil, supportive, and safe.