Department for Work and Pensions – Reprimand (United Kingdom, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP). DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data protection impact assessment (DPIA) was completed before implementing the application into CM Appeals. This is because DWP did not consider it necessary due to the application already being used in other service areas of DWP (such as Personal Independent Payment (PIP) Appeals). However, the redaction requirements for CM appeals are different from the other service areas the application was already implemented in. As such, the redaction functionality of the application was not tested to confirm it was compatible with CM Appeals. This resulted in CM Appeals bundles being sent to individuals unredacted, resulting in the personal data of 16 data subjects being inappropriately disclosed to third parties.
Source checks
Source retrieval not recorded.
No automated check recorded.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP). DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data protection impact assessment (DPIA) was completed before implementing the application into CM Appeals. This is because DWP did not consider it necessary due to the application already being used in other service areas of DWP (such as Personal Independent Payment (PIP) Appeals). However, the redaction requirements for CM appeals are different from the other service areas the application was already implemented in. As such, the redaction functionality of the application was not tested to confirm it was compatible with CM Appeals. This resulted in CM Appeals bundles being sent to individuals unredacted, resulting in the personal data of 16 data subjects being inappropriately disclosed to third parties.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for Department for Work and Pensions in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
31 October 2022
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. Department for Work and Pensions - United Kingdom (2022). Retrieved from cookiefines.eu
Last updated: