This page sets out our privacy notice related to data provided to us by the Department for Work and Pensions (DWP). It explains how we comply with General Data Protection Regulation (GDPR) regulations.
In order to deliver our statutory function of the provision of careers advice and guidance to school pupils and the adult population in Wales, it is necessary for us to collect and use (or ‘process’) their personal data. The purpose of this notice is to allow us to be open, honest, and upfront about the purpose of why we collect their personal data, and also to identify the sources and type of data we receive from other organisations.
We believe that if our customers are well informed and know from the outset what personal data we hold about them, how we will use it, for what purpose and who it may be shared with, they will be more confident that their personal data is being used in the right way and their privacy is protected.
Data Controller
Career Choices Dewis Gyrfa Ltd trading as Careers Wales is the data controller for the personal data we process. We are registered as a data controller with the Information Commissioner’s Office (ICO), registration number: Z276256.
Purpose
The purpose of this privacy notice is to provide information about how we use, collect and share the data that we receive from the Department for Work and Pensions. This notice covers the following areas:
1. Why we process the personal data
The purpose of this data share is for DWP to provide Careers Wales with the details of people aged 16 to 24 who make a claim or have terminated their claim for Universal Credit. The reason for sharing is to provide careers advice and employment support to young people who are not in employment, education, training or who are in employment and eligible for universal credit.
This data sharing enables Careers Wales to better identify and support young people and adults into learning and training and employment support, and thereby improve their chances of obtaining a job or allowing them to progress with their current career choice. Careers Wales has an ongoing commitment and/or a number of statutory duties to support young people aged 16 to 24 and adults into work, education or training through our Careers Information, Advice and Guidance services. We also provide a range of supporting services to the employed and unemployed.
We have identified as they become older that the proportion of people aged 16 to 24 whose records are not up to date rises significantly, as they are less likely to be in education and more likely to be living away from the family home. This data allows us to improve the accuracy of the data we hold within our management information systems.
2. Our lawful basis for processing personal data
Our lawful basis for receiving and processing the DWP data set is:
- Public Task, Article 6(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Both DWP and Careers Wales functions include provision of support in the fields of training and employment
3. Who and where we get the personal data from
We receive the data direct from the Department for Work and Pensions.
4. The categories of personal data we process
Personal data is defined under the General Data Protection Regulation (GDPR) as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier.' We receive data from the DWP under their legal sharing powers: Regulations 13(b)(vi) and (v) of the Social Security (Claims and Information) Regulations 1999, made under section 72 of the Welfare Reform and Pensions Act 1999, in conjunction with the Welfare Reform and Pensions Act 1999 (Section 72) (Relevant Authority) Designation Order 2010
Personal data we receive:
- Forename
- Surname
- Address
- Postcode
- Date of Birth
- Date Claim Started
- Date Claim Terminated
- Other Forenames
- Alias Surname
- Alias Forename(s)
- Correspondence Address Lines 1-5
- Postcode
- Customer ID
- Mobile number
- Universal Credit Workgroup
- Children Flag (Yes/No)
- Self Employed Flag (Yes/No)
5. Who we share personal data with
We share the DWP data with the following key organisations to fulfil our statutory functions. It should be noted that not all the personal data outlined above is shared with every organisation. Only relevant information is shared in relation to the purpose.
Here is a list of who we share personal data with and why data is shared:
- Welsh Government - Reporting, Monitoring and Evaluation
- Local Authorities Engagement and Progression Co-ordinators and support services - The Youth Engagement and Progression Framework allows the Local Authority to access our data hub to see the data of customers who are not in education, employment or training to allow targeted support
6. How do we keep your personal data safe?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We also make sure that any third parties that we deal with keep all personal data they process on our behalf secure.
7. How long do we keep your personal data?
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out under Further information.
In some circumstances you can ask us to delete your data.
8. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide. Specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. www.ico.org.uk
Right to Erasure does not apply to DWP and Careers Wales as they are relying on public task lawful basis for processing.
Right to Portability does not apply to DWP and Careers Wales as we are relying on public task lawful basis for processing.
9. Further Information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at: Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH, or Email: personal.data@careerswales.gov.wales