The Department for Work and Pensions website was updated yesterday with almost all of the information that we requested through our FOIA request
The Work and Pensions Longitudinal Study webpages Background Information and Safeguards and List of Uses now include links to other documents which go a very long way towards the level of transparency which was promised over a year ago:
- The terms of reference for the Ethics Committee, in Microsoft Word format
- Details of applications in a Microsoft Excel spreadsheet
- "DWP have consulted with the Information Commissioner's Office on the above safeguards, and will continue to do so, with the view that the Information Commissioner will audit the Work and Pensions Longitudinal Study during 2004/5. A preliminary audit has been conducted by Enterprise Privacy Group (.pdf) under contract to DWP."
The minutes etc. of the Ethics Committee are also promised to be published on the web site soon.
c.f. below for the reassurances given about the number of Security Incidents which might have compromised the massively valuable combined Department for Work and Pensions and Inland Revenue combined Data Sets
Reply from the Department for Work and Pensions, after only 18 working days:
Dear XXX,This letter is in response to your request for information relating to the Work & Pensions Longitudinal Study of 09/01/2005.
Information relating to the WPLS ethics committee
The Terms of Reference for the Ethics Committee were published on the WPLS pages of the DWP website yesterday and are attached here for convenience
The minutes of the meetings are awaiting clearance so are not currently available. We are working through the issues to get these placed on the website in the near future. I will notify you when they are posted on the website.
Business cases removed from the WPLS pages of the DWP website.
Relevant details for the business cases you referred to are in the attached table.
In all cases they were removed from the website because the access to WPLS data had come to an end. This was because either:-
- The work access was granted for had been completed
- The length of time the business case was for had come to an end
- The data was not being used so my team removed access
Security IncidentsThe DWP defines a security incident as:-
- A deliberate attempt, whether successful or not, to compromise Departmental assets, including information and audit trail information; or
- Any accident resulting in a loss of departmental assets
There have been no such security incidents, deliberate or accidental, by departmental staff detected by or notified to us.
As with any large organisation there have been viruses attached to e-mails that have been sent to staff in the department. The departmental firewall would stop these before they reached data systems used for the WPLS. None of these have been targeted at WPLS and none have affected the workstations from which WPLS is accessed.
In addition to these formally defined security incidents DSU maintains a record of breaches in procedures designed to protect data it is responsible for. Such breaches in procedures may not result in a formal security incident.
Since the WPLS was launched there have been no breaches in procedure detected by or notified to us for any file using the full dataset of DWP and IR merged data (i.e. database versions 1, 2 and 3 as stated on the website).
There have been 6 recorded breaches relating to separate components of WPLS affecting DWP owned data only:-
- 2 cases of personal data sent by e-mail ) recipient had legal right to data ) no loss of data
- 2 CDs lost in transit by courier ) contents were password protected ) no loss of data
- 1 data tape left unattended ) within DWP premises and seized by DSU until claimed ) no loss of data
- 1 CD sent to the wrong recipient ) file password protected and CD recovered ) no loss of data
There have also been a small number of other breaches detected by or notified to us where the data was not a part of the WPLS. Again in these cases there was no loss of data.
I trust the information to be posted on the website soon will answer the first part of your request and that the information above answers the second and third parts.
Yours sincerely,
AAA BBBData Sharing Strategy and Compliance.
Data Services Unit,
Information & Analysis Directorate,
Department for Work & Pensions,
Level 2, Kings Court, 80 Hanover Way, Sheffield S3 7UF
Tel: 0114 209nnnn
Fax: 0114 209nnnn
Mob: nnnnn nnnnnn
