UK FOIA requests - Spy Blog

Dear XXX,

This letter is in response to your request for information relating to the Work & Pensions Longitudinal Study of 09/01/2005.

Information relating to the WPLS ethics committee

The Terms of Reference for the Ethics Committee were published on the WPLS pages of the DWP website yesterday and are attached here for convenience

The minutes of the meetings are awaiting clearance so are not currently available. We are working through the issues to get these placed on the website in the near future. I will notify you when they are posted on the website.

Business cases removed from the WPLS pages of the DWP website.

Relevant details for the business cases you referred to are in the attached table.

In all cases they were removed from the website because the access to WPLS data had come to an end. This was because either:-

• The work access was granted for had been completed

• The length of time the business case was for had come to an end

• The data was not being used so my team removed access

Security Incidents

The DWP defines a security incident as:-

• A deliberate attempt, whether successful or not, to compromise Departmental assets, including information and audit trail information; or

• Any accident resulting in a loss of departmental assets

There have been no such security incidents, deliberate or accidental, by departmental staff detected by or notified to us.

As with any large organisation there have been viruses attached to e-mails that have been sent to staff in the department. The departmental firewall would stop these before they reached data systems used for the WPLS. None of these have been targeted at WPLS and none have affected the workstations from which WPLS is accessed.

In addition to these formally defined security incidents DSU maintains a record of breaches in procedures designed to protect data it is responsible for. Such breaches in procedures may not result in a formal security incident.

Since the WPLS was launched there have been no breaches in procedure detected by or notified to us for any file using the full dataset of DWP and IR merged data (i.e. database versions 1, 2 and 3 as stated on the website).

There have been 6 recorded breaches relating to separate components of WPLS affecting DWP owned data only:-

• 2 cases of personal data sent by e-mail ) recipient had legal right to data ) no loss of data

• 2 CDs lost in transit by courier ) contents were password protected ) no loss of data

• 1 data tape left unattended ) within DWP premises and seized by DSU until claimed ) no loss of data

• 1 CD sent to the wrong recipient ) file password protected and CD recovered ) no loss of data

There have also been a small number of other breaches detected by or notified to us where the data was not a part of the WPLS. Again in these cases there was no loss of data.

I trust the information to be posted on the website soon will answer the first part of your request and that the information above answers the second and third parts.

Yours sincerely,

AAA BBB

Data Sharing Strategy and Compliance.
Data Services Unit,
Information & Analysis Directorate,
Department for Work & Pensions,
Level 2, Kings Court, 80 Hanover Way, Sheffield S3 7UF
Tel: 0114 209nnnn
Fax: 0114 209nnnn
Mob: nnnnn nnnnnn