Guidance

COVID-19 Chapter 15: Data sharing between DWP and providers

Updated 15 December 2021

This guidance was withdrawn on 14 April 2022

This guidance is no longer current and is not being updated. Find the latest Work and Health Programme (including JETS) provider guidance’

Applies to England and Wales

This is Work and Health Programme Coronavirus (COVID-19) specific guidance, including Job Entry Targeted Support (JETS).

Due to measures and restrictions imposed during the Coronavirus (COVID-19) period, some elements of the Work and Health Programme have been varied. These variations also reflect the contract variations CV01, CV04 and CV05 & CV06.

The following temporary guidance is for use only during this COVID-19 period, as defined by the period contract variations are in place. Procedures and guidance will revert to pre-COVID-19 versions as these variations are revised or revoked. A full version of the original Work and Health Programme guidance remains in publication for reference.

Introduction (WHP & WHP JETS)

1. The purpose of this chapter is to summarise all the elements of data that will be shared between the department and you. The following paragraphs focus on the customer journey from referral stage through to when they finish the programme. We explain the type of data which will be shared and the sources of this, including the overarching processes in place.

2. As a Provider you will have been required to submit a Security Plan at the procurement stage. Once assured by the Department this demonstrates your suitability to receive and store information as well as confirming that you comply with the DWP Security Policy (which includes compliance with such standards as ISO/IEC27001). Further information about our security procedures can be found in the Generic Provider Guidance Chapter 8 – Information Security).

Data transfer at the start of the programme (WHP & WHP JETS)

3. DWP may send you personal and sensitive information about participants. This will include documents detailing disability status and barriers to work. This data must be securely stored and with procedures in place which allow it to be retrieved from your systems. Some or all the data may be forwarded to your sub-contractors.

4. Individual data items are listed here:

• Personal Information – this information will include the following data fields (Note this list is not exhaustive)
• Full name including title
• National Insurance number (NINO)
• Full address including post code
• Telephone number inc area code
• Other telephone number (mobile)
• Unique PRaP Referral identifier
• Client Number
• Qualifications:
  • Level
  • Subject
  • Outcome
  • Start date
  • End date
  • Basic skills assessment
• Driving Licence
• Employment:
  • Previous job dates
  • Aims (free text Field)
  • Job preferences
  • Preferred hours

5. This information will be largely transferred to you via the Department’s Provider Referral and Payment System (PRaP). If it is not appropriate to use PRaP this information will be shared by email. Further information is provided at paragraphs 10 and 11.

6. PRaP has a robust security accreditation level (IL2) in relation to data storage. This is reviewed annually or whenever there are any system updates/changes. In addition to this other PRaP features include:

• the ability to limit Provider access until they have met the Department’s security standards.
• Access Control – Audits are undertaken every 30 days to ensure the right people have access.
• Provider access via Government Gateway which is a secure internet gateway which has its own security standards (owned by HMRC)

7. Multi Agency Public Protection Arrangement (MAPPA) participants will be referred through PRaP. Further information can be found in Chapter 3 - Acknowledging Referrals, Initial Participant Engagement and Registering a Start.

8. Participants who have been granted Special Client Record (SCR) status will always be referred to you clerically using the SL2 clerical referral form.

Data transfer during the programme (WHP & WHP JETS)

9. When the Department becomes aware of any changes in Participant information, they will notify you via a change of circumstances notification form. Further information can be found in COVID-19 Work and Health Programme including Job Entry: Target Support (JETS) Provider Guidance Chapter 10 – Change of Circumstances and Notifications.

10. Where the Participant is also a benefit claimant, you must notify Jobcentre Plus using the Change of Circumstances notification form WHP07 if you are informed that:

For WHP Core and WHP JETS:

• the Participant has disengaged with you (voluntary participants only)
• the Participant has re-engaged with you following a disengagement (voluntary participants only)

For WHP JETS only:

• when a Participant who has been mandated to attend and participate in the initial appointment with you and does not attend
• after a change in the Participant’s circumstance and through discussions with the Participant, you jointly identify that alternative provision may better support the Participant

11. Further information can be found in COVID-19 Work and Health Programme including Job Entry: Target Support (JETS) Provider Guidance Chapter 10 – Change of Circumstances and Notifications and COVID-19 Work and Health Programme including Job Entry: Target Support (JETS) Provider Guidance Chapter Chapter 3b Acknowledging Referrals, Initial Participant Engagement and Registering a Start.

12. There are also circumstances we expect you to notify the department about for mandated participants such as when they fail to engage with mandated activity or fail to attend. Please see Chapter 5a - Mandation to activity attracting a Low/Lower Level sanction and Chapter 5b - Mandation to activity attracting a Higher Level sanction for further details.

Please Note: Secretary of State has agreed to the temporary suspension of work preparation requirements (including interviews), work search requirements and availability requirements, and their related sanctions. Providers should suspend any mandation of participants to activity and raising compliance doubt referrals, while maintaining support to participants.

13. There is also a requirement for you to notify the Department when you employ a WHP or WHP JETS Participant in your employment business. You must complete a WHP Employment Business Customer Form and provide the following information:

• customer name
• NINO
• date employment commenced

14. You must send this by unencrypted email, at least five days before first salary payment, to the Department’s Payment Team Central Inbox:

prap.support@dwp.gsi.gov.uk

15. The department will be validating employment outcomes using employment and earnings data submitted using HMRC PAYE on line earnings data submitted by employers.

16. We will share some information about participant earnings with you. This will include a Participant’s first pay date and confirmation that they have reached the earning threshold to achieve an outcome. Further information can be found in COVID-19 Work and Health Programme including Job Entry: Target Support (JETS) Provider Guidance Chapter 14 – Validation.

Data transfer at the end of programme (WHP & WHP JETS)

17. You are required to complete Exit Reports for WHP Core and WHPERJ1 for JETS for each Participant listed in COVID-19 Chapter 11. To improve quality and consistency we have developed a standard form for you to complete. Further information on exit reports can be found in COVID-19 Chapter 11 – Programme Completers and Early Exits.

18. You will have considered the level of information needed in the exit report when you developed your systems and processes. This includes (but is not limited to): As JETS is a light touch programme the WHPEREJ1 exit form has been updated to reflect this.

• Participant Surname
• Participant National Insurance number (NINO)
• Summary – How the Participant benefited from the Work and Health Programme, and the progress against the activities undertaken by the Participant whilst on the Work and Health Programme
• Employability – your opinion on the Participants employment prospects, the type of employment which might be appropriate
• Next steps – your recommendations to Jobcentre Plus on the most appropriate next steps for the Participant. There is a minimum word count for this free text entry to ensure a consistent quality referral

19. To help ensure you tailor packages to individuals, you should encourage participants to share with you directly any appropriate information about their previous efforts to secure employment/move closer to the job market as will their JCP Work Coach. As some of these customers are vulnerable we ask you to act sensitively when trying to obtain this information.

20. You may use the DWP templates or you may use your own template providing it has been approved by DWP Further information can be found in COVID-19 Work and Health Programme including Job Entry: Target Support (JETS) Provider Guidance Chapter 11 – Programme Completers and Early Exits.

21. For WHP JETS you must use the streamlined WHPEREJ1 exit form.

Provider receives a request to erase Participant information

22. There may be occasions when you receive a request from a Participant to erase their personal information from your records.

23. Upon receipt of the request you should acknowledge the request from the Participant and issue a holding response immediately detailing that the query will be dealt with within one month.

24. You should forward the details of the request to the following email addresses: data.protectionofficer@dwp.gov.uk and copy in the WHP Enquiries team, email address: whp.enquiries@dwp.gov.uk

25. You will receive a generic email containing a reference number and the actions that you should take from the Data Protection Office (DPO) team. The reference number must be used with all correspondence with the DPO team.

26. Before responding to the Participant, you should then consider the following information before agreeing to any information being removed.

Customers who have been referred to WHP JETs and WHP Core and did not start take the following action:

27. You should consider the following scenarios and take the most appropriate action outlined below when you receive a request to erase a customer’s personal information.

28. For Voluntary customers (JETS and WHP Core). If the customer never started on the programme, there is no requirement to retain any of the personal information as the referral information will be kept on DWP systems.

29. For a Long Term Unemployed (LTU) customer (WHP core).If the customer never started on the programme and were not mandated to any provider interview, before you input a Did Not attend (DNA) code into PRaP, there is no requirement to retain any of the customer personal information as the referral information will be kept on DWP systems.

30. Once you have considered these scenarios, and you agree to the erasure of the customers personal information, you must either issue the accepted letter WHP RTE Acc (letter which approves the request to erase the information) or respond with your own communication.

31. You should then forward the response email (including letter or communication from yourself) with the reference number to the Data Protection Office, email address: data.protectionofficer@dwp.gov.uk and copy in the WHP enquiry inbox, email address: whp.enquiries@dwp.gov.uk

32. All responses must be issued within one month of receipt of the request from the customer and must contain the reference number supplied to you.

Please Note: All additions and changes to the letters (including logos) must be signed off by ESF marketing team at cepesf14-20.marketing-publicity@dwp.gov.uk

33. For all other scenarios you should consider the following and take the appropriate action outlined:

Mandated customer who have not started on the programme

34. For LTU customer (WHP core participants) – If you have mandated the participant to attend an appointment with you which they don’t attend, then mandation activity is undertaken and a DNA is input,you must keep all supporting evidence on the compliance doubt. Further information is detailed in Work and Health Programme Chapter 8 - Raising a Compliance Doubt for LTU participants of the Work and Health Programme Provider Guidance. The supporting evidence should be retained in line with current retention policies.

35. For any JETS Customer who is mandated to attend the initial interview, you must keep all supporting evidence, including the notification letter of the time and date of the interview, the notification that the claimant has not complied and any re compliance information.

36. Under these circumstances, you must follow the guidance and either issue the rejected letter WHP RTE REJ detailing the right of erasure to personal information has been rejected or respond with your own communication to the customer.

37. You must forward the response email (including the letter/communication) with the reference number to the data protection office. email address: data.protectionofficer@dwp.gov.uk and send a copy to the WHP enquiry inbox, email address: whp.enquiries@dwp.gov.uk

38. All additions and changes to the letters (including logos) must be signed off by ESF marketing team at cepesf14-20.marketing-publicity@dwp.gov.uk

Please Note: Under all circumstances you must keep evidence and personal information in line with your own retention periods as outlined in your contracts. Information retained on the mandation activity must be retained for a minimum of 13 months from the date you (the provider) are notified of the decisions maker’s decision

Participants who have started either WHP Core or WHP JETS provision

39. For any Participant who has started on the programme, you must retain all information for official functions and duties, the right of erasure does not apply in these circumstances. The following information must be kept:

• all mandation activity (including evidence)
• all ESF forms including, ESF1420: European Social Fund – ESF Participant Referral Form (Initial), ESF1420: European Social Fund – ESF End Data, etc.
• evidence demonstrating customer journey
• payments
• for mandated customers (on WHP Core and WHP JETS) any mandated information should be retained for a minimum of 13 months from the decision maker’s decision

Please note: this list is not exhaustive

Please Note: For ESF audit purposes, retention is for up to 10 years after the programme ends and their final ESF claim is paid. Further information is provided in Generic Provider Guidance Chapter 11b, Page 4, sections 7 – 20 on ESF Audit requirements.

40. Under these circumstances, you must follow the guidance and either issue the rejected letter WHP RTE REJ detailing the right to erasure of personal information has been rejected or respond with your own communication to the Participant.

41. You must forward the response email (including the letter/communication) with the reference number to the data protection office. email address: data.protectionofficer@dwp.gov.uk and send a copy to the WHP enquiry inbox, email address: whp.enquiries@dwp.gov.uk

Please Note: All additions and changes to the letters (including logos) must be signed off by ESF marketing team at cepesf14-20.marketing-publicity@dwp.gov.uk

42. All responses must be issued within one month of receipt of the request from the Participant and must contain the reference number supplied.

Please Note: Under all circumstances you must keep evidence and personal information in line with your own retention periods as outlined in your contracts. Information retained on the mandation activity must be retained for a minimum of 13 months from the from the date you ( the provider) are notified of the decisions maker’s decision.

Use of Unencrypted Email (WHP & WHP JETS)

43. You must be able to communicate with and receive communications from the Department by unencrypted email as required.

44. Before DWP approves you to use unencrypted email for the first time for a specific process there are steps you must undertake to comply with DWP security requirements. You must email WPD.Security@dwp.gsi.gov.uk with any request to use unencrypted email and comply with the implementation and assurance requirements specified by DWP prior to beginning to use of unencrypted email.

45. Before allowing your sub-contractors to use the unencrypted email for any new process, you must have ensured that the sub-contractor has been formally approved by DWP and you have undertaken any necessary due diligence. Further detail can be found in Generic Provider Guidance Chapter 8 – Information Security.

46. The following processes are the only approved processes that you may use unencrypted email for. You are not permitted to use unencrypted email for these or any other purpose without the written permission of the department.

• Exit Reports
• Raising a Compliance Doubt and notifying participant re-compliance following a sanction
• Reporting Changes of Circumstances
• WHP Employment Business Customer’ Form
• ESF 14-20 form
• WHPS01 form (self-referral)
• List of 500 names and NINOS
• Good news stories.

47. Unencrypted emails sent to you by the Department will always be sent to a dedicated Provider in-box agreed by you and DWP for Work and Health Programme.

48. You must only use unencrypted email for sending information to the Department with the written permission of the Department and in line with existing exemptions. Further detail can be found in Generic Provider Guidance Chapter 8 – Information Security.

49. When you use unencrypted e-mail to send information to the Department you must adhere to the restrictions stipulated within Generic Provider Guidance Chapter 8 – Information Security. The following restrictions relate to the processes in the above paragraph and will include all or part of the following:

• only one record per e-mail (except for the requirements to share information between Prime Providers, their Supply Chain and Third parties)
• standard e-mail content
• standard template completed and included in e-mail
• Email sent from and to a designated inbox

50. Please refer to Generic Provider Guidance Chapter 8 – Information Security for unencrypted email exemptions not specifically detailed above.

51. If you wish to extend the use of unencrypted email to one of your existing DWP approved sub-contractors who was not named on the list you initially supplied, you must supply an updated list to your Supplier Manager and agree a date for the new sub-contractor to begin using the unencrypted email process.

52. If you wish to extend the use of unencrypted email to a sub-contractor who has newly joined your supply chain you must:

• ensure that they have been formally approved by the department
• supply an updated list of your sub-contractors whom you have permitted to use unencrypted email for which unencrypted email process to your supplier manager and agree a start date
• ensure you have completed the necessary assurance process and undertaken the relevant due diligence including confirmation that the sub-contractor is not using any product or service with any offshore elements or links

53. You may forward unencrypted emails to an approved sub-contractor and inboxes within your organisation provided that:

• no more than one Participant record at a time is emailed
• a business need to share the information exists
• the recipient is entitled to receive the information (emails must not be automatically forwarded without ensuring this)

Please note - You must keep a record of where and when you sent the notification form for three months.

54. You may decide that you no longer wish one of your sub-contractors to use unencrypted email for a specific process. You must notify your Supplier Manager as soon as possible and provide an updated list of your sub-contractors whom you have permitted to use unencrypted email process to your Supplier Manager. You must agree a date with the Supplier Manager for when the sub-contractor will cease using the unencrypted email for the specific process.

55. If you send data to the wrong sub-contractor, you must alert the sub-contractor to the error and ensure that they delete the record. You must keep records of the actions taken for three months.

56. If an email was sent to you in error or includes participants with the wrong details (e.g. incorrect NINO) or participants who belong to a different Provider, please notify your Performance Manager.

57. You are not required to retain a record of the emails you have received therefore you must delete the email from your inbox once you have actioned it.

58. There may be occasions when due to circumstances such as IT failure you are temporarily unable to receive or send unencrypted emails.

59. If you anticipate the situation will continue for 48 hours or longer you must ensure that you inform the department and revert to clerical methods until the problem is resolved and you are able to use the unencrypted email again.

60. You must inform the department when you will be able to use unencrypted email again prior to starting to use it. The department will notify colleagues when the clerical process is being used and when unencrypted email is to be re-introduced.

61. Similarly, if the department have an I.T. failure you must suspend using unencrypted email if you are notified to do so by the department.

62. The department will notify you if the problem will last for longer than 48 hours and will ask you to revert to the clerical process if appropriate.

63. Once resolved, the department will notify you when unencrypted email has been re-introduced.

Annex A (WHP & WHP JETS)

List of data items to be shared with Providers (new items may be added at a future date).

Unique PRaP Referral Identifier
Customer Title
Customer Forename
Customer Surname
Verified Address (including postcode)
National Insurance Number
Claimant Reference Number
Telephone Number
Disability Status
Employment – Aims, Job Preferences, Preferred Hours, Employment History, Previous Job Dates
Driving Licence (Y/N) Endorsements
Additional Information
Other Activities
Agreed restrictions
Additional Information (free text on Action Plan)
Voluntary or Mandatory Referral
Mandatory Work Related Activity
JCP Adviser Name (Forename, Surname and Initials)
JCP Adviser Officer Code
Claimant Deceased
Signing Day
Claim Cycle
Claim Pattern
Referral date
Voluntary Early Entry Category
Incident marker
Child care requirements
Balance of Time
Welsh spoken & written indicators
Fast Track Status
Joint Claimant’s name
Joint Claimant’s title
Joint Claimant’s National Insurance Number Disadvantaged group, early entry
Barriers to Work
Additional support / reasonable adjustments (e.g. New Work Capability outcome)
Admission / discharge hospital
Appointee / Power of Attorney
Change of benefit (e.g. off JSA to IS/ESA)
Change of conditionality group/labour market regime which impacts participation on WHP
Changes to participant’s conditionality
Changes that affect participant’s work-related requirements (e.g. Jury service, civic duties, domestic emergency, easements for domestic abuse/violence)
Claim termination / benefit ends
Death
Imprisoned / leaves prison
JSA extended period of sickness
Moves to live abroad
New claim to benefit, for example UC
Partner enters / leaves household
Part-Time education
Period of sickness (restrictions and duration)
Restrictions (for example, attendance)
Starts / ends work (inc p/t, vol, s/e, permitted)
Signing day/cycle (excludes NEA)
Outcome of Self-Employment Gateway Interview and subsequent quarterly interviews (if appropriate)
Claimants first payment date
Claimants earnings reach £1,000
Claimants earnings reach £2,000 (Not applicable to WHP JETS)
Claimant’s earnings reaching the National Threshold of approximately £3000. (Not applicable to WHP JETS)
The actual figure is based on the national minimum wage at any given time, and is therefore subject to change)

Should you require a copy of any of the forms mentioned in this chapter, please email: whp.enquiries@dwp.gov.uk