Data Protection and Coronavirus

Standard

***Data Protection and Coronavirus***

At this unusual time, it is likely that Members’ offices will be receiving a higher number of calls and emails and you may have some questions around communicating with your constituents during this unprecedented health crisis. The ICO have released some guidance which you may find it useful to refer to at this time:

ICO: Data Protectiona and Coronavirus

If you have questions that are not answered in this document, please contact Emma Fyles (Members’ Support Officer, IRIS team) on x2580 or at IRIS@parliament.uk

There is also a wealth of data protection guidance available here:

Data Protection for Commons Members and their Staff

Alternatively you can contact the ICO by calling their helpline on 0303 123 1113.

New MP? Make sure you register with the Information Commissioner.

Standard

Congratulations on being elected/re-elected to Parliament!

One of the most important things you must do right away is to register with the Information Commissioner.

It’s really easy to do, by going to their website here: https://ico.org.uk/registration/new and select ‘Elected representative’ from the drop-down list.  Registration is free for Members of Parliament unless they process personal data for any purpose outside of their role as an MP.  You can find further information about this here: http://www.w4mp.org/w4mp/w4mp-guides/your-office/freedom-of-information-and-data-protection-issues/

You can find lots of useful information about your rights and obligations under the Data Protection Act on the intranet here: https://intranet.parliament.uk/information-management/data-protection-security/data-protection/

 

Data Protection and Freedom of Information

Standard

Data Protection 

Everyone who deals with personal information in a Member’s office has responsibility for the personal data that they handle for the Member, and must comply with the rules of the General Data Protection Regulation (GDPR) which is supplemented by the Data Protection Act 2018 (DPA).  The majority of this personal information will relate to constituency casework, but it also includes information about any identifiable individuals, such as staff and volunteers.  Parliamentary privilege does not exempt Members of Parliament from complying with the DPA with respect to constituency casework, and the requirements of the GDPR and the DPA must be observed. 

The GDPR lays down seven key principles for the handling of personal information.  The information must be: 

  1. used fairly, lawfully and transparently 
  2. used for specified, explicit purposes 
  3. used in a way that is adequate, relevant and limited to only what is necessary 
  4. accurate and, where necessary, kept up to date 
  5. kept for no longer than is necessary 
  6. handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage 
  7. handled responsibly with appropriate measures and records in place to demonstrate your compliance. 

 

Sharing personal data  

In order to allow an MP to fulfil their role as an elected representative, there is a separate piece of legislation – The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 that lays out the specifics around data sharing – for example, allowing Members to handle sensitive personal data (such as health information) in order to take action at the request of individuals, without having to obtain explicit, written consent from that individual. (although please note: if the wishes of the constituent are at all unclear, you should always discuss this with them!)  

The order also allows third parties (such as Government Departments or local authorities) to disclose sensitive personal data to a Member acting on behalf of a constituent where the disclosure is necessary to assist the Member in responding to the individual’s request. The condition is permissive; it does not compel third parties to disclose information to a Member and other organisations may still ask you to demonstrate that you are acting on your constituent’s behalf. 

More information about sharing personal data can be found here. 

 

Registration with the ICO 

The rules around ICO registration have changed. Whereas previously all Members had to register with the ICO and pay a £40 fee, from 1 April 2019 Members were exempted from paying the fee as long as any processing of personal data is done so in relation to their role as an elected representative. 

If the Member processes personal data for any purpose outside of this (for example if the Member runs a secondary business from their office) or if they use CCTV for business or crime prevention purposes in relation to their second business, then they would still be eligible to pay the fee. 

You can find more information about paying the fee in the ICO’s data protection fee guidance 

 

Data Protection and Casework

If you receive a casework request from a third party, perhaps a relative of your constituent, it is important to ensure that you have the consent of the constituent unless it is not reasonably possible to gain that consent.  In order to safeguard an individual’s personal information and comply with the Data Protection Act 2018, many bodies will not respond if the request is made by someone other than the constituent without proof of their consent.

The House of Commons Library has a very useful briefing note on data protection and casework here: Data protection: constituency casework 

 

Political campaigning

Be careful how you use constituents’ email addresses for political campaigning.  According to advice from the Information Commissioner, you need to gain their consent before contacting them with routine newsletters and offer them an opportunity to object. See the guidance link below: 

https://ico.org.uk/media/for-organisations/documents/1589/promotion_of_a_political_party.pdf 

 

Useful links relating to Data Protection: 

On the Parliamentary intranet (network account required): 

Online training 

Introduction to General Data Protection Regulation (GDPR) for Members and their staff 

Data Protection for Members and their Staff 

Information 

Data Protection for Commons Members and their staff 

Members’ Frequently Asked Questions 

Working at home guidance for Members and their staff 

A letter dated 7 January 2020 from the Information Commissioner setting out MPs’ obligations under the Data Protection Act 2018. 

Commons Library Briefing: Data protection: constituency casework 

Guidance on writing a Privacy Notice 

Guidance on how to deal with a Subject Access Request 

Guidance on Data Storage 

External links: 

ICO: Data Protection and Coronavirus 

Data Protection – gov.uk 

Guidance on political campaigning 

 

Requests for access to information 

You may receive a request from a constituent asking for you to provide them with any personal data that you hold about them. This is known as a Data Subject Access Request (DSAR) and, under the GDPR you are legally obliged to provide this information (ensuring you redact any personal data that does not belong to the requester). More information about handling this type of request can be found here.

If the request is for any other information, you are not obliged to provide it. 

The Freedom of Information Act 2000 (FOIA) only applies to public authorities, and Members of Parliament are not public authorities for the purposes of FOIA. The Member can choose to provide information voluntarily if it is felt that it is reasonable and appropriate to do so. You may also refer the requester to a public authority that does hold the information. 

The House of Commons and the Independent Parliamentary Standards Authority (IPSA) are both public authorities for the purposes of the FOIA. This applies to information that they hold in their own right about Members. However, it does not apply to information held by Members regarding their Parliamentary and constituency capacities which is stored physically or electronically at the House of Commons. 

Further guidance on Freedom of Information requests can be found here.

https://intranet.parliament.uk/information-management/data-protection-security/foi/

For general information and guidance on Freedom of Information, Data Protection and Information Security, see here: https://www.parliament.uk/site-information/foi/

You might also find useful our guide ‘Protocol clarified on representing constituents‘. 

 

 

This page was last updated on 20 August 2020

Setting Up the Office

Standard

Setting up the Office

2.1  Choosing the right office(s)
2.2  Furniture, Equipment and Stationery
2.3  Computers
2.4  Email
2.5  Data Registration
2.6  Confidentiality
2.7  Involving Volunteers, Work Experience Students, Interns
2.8  Registering Interests
2.9  Health and Safety Policy for constituency offices
2.10 Dealing with post and deliveries


2.1 Choosing the right office(s)

The tasks performed by MPs’ staff include: research, providing briefings; drafting speeches and articles; casework, including handling letters, emails and calls; press and political work; diary and engagements; and keeping accounts.  Alright, so you do 101 other things as well, but the functions listed above, and who does them, will have a strong bearing on where any MP decides to locate his/her staff.

The choice is clearly between basing the office in Westminster or in the constituency – or a mixture of the two – and there are examples of every permutation.  Given the flexible tools of information technology, there are many tasks which could as well be done up a mountain as at Westminster, but the overriding considerations will be convenience and accessibility.  For example, having access to all the resources at Westminster and also having a visible presence in the constituency.

Here are some questions MPs will wish to answer before choosing the location(s) of their office(s):

  • Do you want constituents to have walk-in access to your staff?  (NB: please consider the security of you and your staff – see our brief comments on security in Section 3.9 on Advice Surgeries in our Everyday Tasks Guide)
  • Do you want to locate your staff in the office of your local constituency party?
  • Do you want to share with a neighbouring MP?
  • Is it most convenient to have a researcher at Westminster?  What happens to this role during parliamentary recesses?
  • Can all press contacts be adequately handled in the constituency?
  • Where is the most efficient place to locate your diary-keeper?
  • Is it possible to handle casework satisfactorily at Westminster?

In your office on the Parliamentary estate at Westminster, phone calls, rent, furniture, cleaning, photocopying costs are not charged to your Office Costs Budget; but you will have to pay for them all (and more) in your constituency office.

New MPs are entitled to a start-up budget, to enable them, amongst other things, to set up a constituency office.

Before you can claim any costs associated with your constituency office, including rent, you must register that property with IPSA.  Further details can be found in the ‘Guidance for MPs’ Business Costs and Expenses’, the latest version of which can be found on the IPSA website.

2.2 Furniture and Equipment and Stationery

At Westminster, standard furniture is provided at no cost.  In the constituency, however, you will have to buy it, although you can use the start-up budget for this.

The biggest items of expense will probably be those unlovely objects, filing cabinets.  Filing is dealt with in more detail further on, but do try to resist the temptation to provide a home for every single scrap of paper that enters your office on the grounds that it-might-come-in-useful-one-day.  With most information available online now, the ability to scan documents, and the wonderful backup from the Commons Library, you can confidently consign 99% of all that bumph to your paper recycling box.  So buy as few good quality filing cabinets as possible and consider looking for bargains in second-hand furniture warehouses.

Desks, chairs, lamps, phones, filing trays, shelving, and all the other bits and pieces you will need can also be found in second-hand places but it’s worth comparing prices with those in the House of Commons preferred stationery supplier’s catalogue which you should have already, or can be found online here: http://www.bbanner.co.uk/  Your Member should have been sent login details already.  If not, please give their helpdesk a call.  Most items are delivered next-day.

If you need any workplace adjustments, please see this guide: http://www.w4mp.org/w4mp/w4mp-guides/workplace-adjustments/

USE OF HOUSE STATIONERY AND POST PAID ENVELOPES (Serjeant at Arms)

Please see here for the current rules on the use of House stationery and post-paid envelopes.

2.3 Computers

Each Member is entitled to loan computers, laptops, mobile devices and printers from Parliament.  The catalogue can be found on the intranet, or you can ask for advice by ringing the Parliamentary Digital Service helpdesk on x2001.

The Parliamentary Digital Service will also arrange for a free broadband installation at the constituency office and you can find more information about that here.

Please note that computers supplied by Parliament are only accessible by people who have security clearance.  Without it, you cannot even log onto a machine.  Therefore, it is very important that new staff apply for their security clearance as soon as possible, in order to avoid delays in getting network access.

Don’t forget to purchase a television licence for your constituency office.  Even if you don’t have a television in your constituency office, you will still need a licence if you watch live TV on your computer or any mobile devices, or download any programmes from BBC iPlayer.  You can find further information here: https://www.tvlicensing.co.uk/check-if-you-need-one and purchase a licence here: https://www.tvlicensing.co.uk/cs/pay-for-your-tv-licence/index.app  You can pay for it on your IPSA card.  You do not need to purchase a television licence for your Westminster office as this is covered by the House authorities.

2.4 Email

The vast majority of MPs’ correspondence comes in by email, and you may be surprised at just how many emails arrive every day – it can often be in the hundreds, so it is important that you agree with your Member how you are going to deal with them.  Some MPs give their staff ‘delegated access’ to their inboxes, which allows staff to monitor and respond to emails on their behalf.  Some MPs have two mailboxes, one of which is accessible by their staff, and one which remains private.  Having a second mailbox can be very useful, for example, if you want to use one specifically for casework.  It is very easy to drag and drop emails between the two mailboxes, if required.

Many Government departments and agencies also have special MP ‘hotline’ email addresses, which are extremely useful.  There is a list of hotlines on the Parliamentary intranet.

2.5 Data Protection Registration

Under the requirements of the Data Protection Act 2018, all MPs’ offices must register with the Information Commissioner.  It is quite a straightforward process and the people who deal with enquiries at the Information Commissioner’s office are very helpful.  Members of Parliament are exempt from paying a registration fee, unless they have CCTV such as a video-entry doorbell which records the images, in which case the £40 fee applies.  You can ring their Information Line on 0303 123 1113 (local rate) or  01625 545 745 (national rate).

You can register online or email them for further information.  Their postal address is Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire  SK9 5AF.   Further information can be found on the Information Commissioner’s website at: https://ico.org.uk/ and there is specific guidance for Constituency casework of Members of Parliament and the processing of sensitive personal data.

Importantly, the ICO’s guidance includes information on whether or not the constituent’s consent is required for them to act.  It says:

“For non-sensitive personal data, Members can usually rely on the implied consent of the constituent as providing the necessary condition.

For sensitive personal data, members can usually rely on the The Data Protection (Processing of Sensitive Personal Data)(Elected Representatives) Order 2002, which also covers the disclosure of such data by organisations responding to Members.”

You can find further guidances on Data Protection on the intranet: https://intranet.parliament.uk/information-management/data-protection-security/data-protection/

There is an excellent House of Commons Library briefing paper on Data Protection and Constituency Casework  which looks at the General Data Protection Regulation, the Data Protection Act 2018, and when MPs can process personal information.

2.6 Confidentiality

Working for an MP involves daily access to confidential information, both political and private.  It should be treated as such and protected from unauthorised disclosure.  Your constituents expect you to deal sensitively and appropriately with any personal information they give you.  Being given confidential information about a constituent can sometimes put you in a tricky situation.  Let’s look at three examples.

A constituent has asked you to contact the Home Office to speed up an application for his wife to join him in this country.  After interminable and inexplicable delays, an Immigration Officer reveals to you over the phone that the reason for the delay is that the wife is being investigated for deception.  This will involve an investigative trip to a remote part of her home country and there will be further delays; he asks you not to reveal this to your constituent.  Meanwhile, your constituent is ringing you three times a week to check progress.

Another example: your MP has written to Social Services on behalf of constituents who say they are being unfairly prevented from having reasonable access to their children who are in a foster home at present.  You receive two replies: one repeating the line that there is an agreement, made in court, that access is only allowed in tightly supervised conditions.  The other reply, marked “Confidential”, informs you that the children have made allegations of sexual abuse against one of their parents, which are currently being investigated.

A third example: you receive an anonymous email (so you can reply to it but you have no idea of the name or postal address of the sender) claiming that a named person is defrauding the Benefits Agency and asking you to pass on this information.

You need to discuss with your MP how you deal with these situations.  It is also important that, despite the pressures on your time, you read all letters from constituents and replies from agencies carefully before forwarding them.  Sometimes you will get what appears to be a very forthright or stark response for forwarding to a constituent.  Don’t underestimate the value of your role in achieving clarity (light but not sweetness, perhaps) for constituents; the unvarnished truth can sometimes help them to move on.

Only in exceptional circumstances should you pursue an issue for a constituent if it has been brought to your attention by someone else: a neighbour or a relative, for example.  Always get the permission (preferably in writing) of the person whose problem you are being asked to help resolve.  Here’s an example of a permission form.

Permission Form

NAME [Please print]________________________________________________________

National Insurance No: _____________________________________________________

ADDRESS _________________________________________________________________

I have instructed my Member of Parliament [NAME] to act on my behalf in this matter and would be grateful if any correspondence or documents could be sent to the address of my MP.
I confirm that I have given my MP permission to pursue these matters and to use all information I have provided, whether written or spoken, and including sensitive personal information.
I understand that this will be done in line with the requirements of the Data Protection Act 2018.

SIGNED___________________________________________________________________

DATE_____________________________________________________________________

2.7 Involving Volunteers, Work Experience Students and Interns

Given that anyone wishing to use a computer must have security clearance, this means that any short-term volunteers or work experience students must not be allowed to use them.  You need to consider this requirement when agreeing to any such positions, and you should never share log in details.  Additionally, anyone who will be working on the Parliamentary Estate must get a Parliamentary pass, even if they’ll only be there for a day or two.   Most pass applications are processed in 5 working days, so get the application in as early as you can, but a few weeks in advance should be fine.

There may be problems about the use of volunteers in any office where paid staff are working, but most of us reckon that, despite some of the drawbacks, there’s a net gain from involving volunteers in our work.

For information on the logistics of having for work experience students in your office, have a look at this guidance note.  It includes information on security and health and safety.  You can also read the information on safeguarding.  You may also find w4mp’s guide to Organising Work Experience in an MP’s Office useful.

There are a host of jobs which suit the skills and time availability of volunteers. Bear in mind a few principles and the arrangement can be mutually beneficial.

  • Manageable Tasks. Most volunteers come in for just a few hours a week so you need to give them manageable tasks which can be completed in that time.  Although some jobs – like culling the archived case files – are endless, make sure that volunteers don’t bite off more than they can chew and leave stacks of un-shredded papers lying around when they go.  You don’t want to have to finish the job when they’ve gone home.
  • Check Reliability. Say, for example you have given your volunteer the job of opening and sorting the post.  As you well know, it’s not just a simple job of opening envelopes and stamping the date received on it.  Sheets need to be fastened together, replies must be linked to existing files, invitations checked against the diary, Order Papers checked for PQs tabled by your MP, stacks of unwanted bumph separated from letters you must answer, etc.  That’s a skill it takes time to develop so it will pay you to tell them how you want it done and check it has been done correctly.  Otherwise, their work will be a drain on your time rather than a bonus.

Make sure volunteers know that their time is valued and that you expect to rely on them being there when they said they would.

  • Silence Please!  Make it clear, right from the start, that there’s work to be done and you don’t have time to sit and chat.  OK, be kind to yourself (and them) and do the chatting during a tea break!
  • What’s in it for the Volunteer?  Well, plenty actually.  A sense of involvement, achievement or helping out; perhaps some experience to be included on their CV (so get them to keep a running list of the tasks they undertake in case you need to write a reference later); and, hopefully, some genuine appreciation from you!
  • Confidentiality Agreement.  However well known the volunteer may be to you, he or she should sign a confidentiality agreement before starting work in your office.  It’s not just about guarding Party strategy.  You will inevitably handle very sensitive material about constituents from time to time and anyone working in the office will fall under the provisions of Data Protection Act 2018.  Here’s an example of a confidentiality agreement which you can use or adapt for your own office.  Let us know if you have an alternative agreement: use the Feedback Form.

Confidentiality Agreement

To be signed by all staff, volunteers, interns, secondees etc.

  1. Work undertaken in the office of _____________ MP involves access to information which is confidential. It should be treated as such and protected from unauthorised disclosure. It is an express condition of your relationship with ________________ MP that you should not divulge to any person outside the office of the MP any confidential information or aid the outward transmission of any such information or data.
  2. This undertaking continues after you cease to work for the MP.
  3. This undertaking applies to all material, including constituents’ casework, research, party political material, statistics, data, reports, etc.
  4. In the case of constituency casework, where it is necessary to relay information, letters, records of telephone conversations etc to third parties, this will always be done only in accordance with the interests of the constituent.

I have read this agreement and I understand and accept the above.

NAME _________________________________________________________

SIGNED  _______________________________________________________

WITNESS * _____________________________________________________

DATE __________________________________________________________

* line manager

Internships:  click here for all you need to know about a) becoming an Intern, and b) finding and looking after an Intern.

2.8 Registering Interests

When you first apply for a parliamentary pass, renew your pass, or change your sponsor you will be given a registration form to complete by the Pass Office.  A Resolution of the House requires that you register:
(1)  any relevant paid employment you are engaged in outside Parliament, and
(2)  gifts or other benefits which relate to your work in Parliament.

The Pass Office forwards the form to the Office of the Parliamentary Commissioner for Standards, where your details are added to the Register of Interests of Members’ Secretaries and Research Assistants.  You will be sent a copy of your entry then and whenever the entry is subsequently amended.  The Register is available for public inspection and is on the internet.  Members’ staff who are not issued with a parliamentary pass are not included on the Register, so if you have security clearance for access to the Parliamentary Network only, then you do not need to register.

Members’ staff may also be asked to assist their sponsoring Member in completing and maintaining his or her correct and up-to-date entry in the Register of Members’ Interests.  The Parliamentary Commissioner for Standards and Registrar of Members’ Interests are available to offer advice to Members and their staff on any aspect of registering and declaring interests.

The relevant telephone numbers are as follows:

Parliamentary Commissioner for Standards: 020 7219 0320
(Personal Assistant): 020 7219 0311
Registrar of Members’ Interests: 020 7219 3277
Assistant Registrar (for Members’ staff): 020 7219 0401

2.9 Health and Safety policy for constituency offices

There is an intranet page dedicated to Safety at Parliament, which may not be directly relevant to constituency offices but still contains some useful information.  There is also a page dedicated to Health and Wellbeing.

 2.10 Dealing with post and deliveries

Courier deliveries (e.g. Amazon, ASOS etc) cannot be made directly to the Parliamentary Estate, nor must passholders meet deliveries outside the Estate and then bring them in.  Deliveries present a huge security risk and these rules must be adhered to at all times.  If you must have items delivered to Parliament, please read the guidance here.