Looks like the use of provider work search engines is mandatory on the WHP!

https://www.whatdotheyknow.com/request/433381/response/1065901/attach/html/2/IR%20515%20reply.pdf.html

I can confirm the Work and Health Programme (WHP) policy intention is that WHP
providers are able to mandate long term unemployed (LTU) participants to undertake
reasonable activity (taking into account the participant’s circumstances) which would
help them find and retain work. Subject to the conditions the provider must follow, as
detailed in our response to your FoI request 3936, this would include the option to
make the use of in-house provider job search engines a mandatory activity for LTU
participants

https://www.whatdotheyknow.com/request/445213/response/1082594/attach/html/2/4792%20Reply.pdf.html

The Department in the case of the WHP is not relying on consent as a condition for
processing, and instead relies on the provisions found in Schedule 2 and 3 of the DPA
which state that the processing is necessary for the exercise of any functions conferred
on any person by or under any enactment and necessary for the exercise of any
functions of the Crown, a Minister of the Crown or a government department.    

And this new FoI is worth watching:

https://www.whatdotheyknow.com/request/work_and_health_programme_job_se

A good find ABC

But it is not "necessary for the exercise of any functions of the Crown, a Minister of the Crown, or a government department" for a claimant to use a third party private company's software. If the DWP can't make the use of UJ mandatory then I don't see how they can make the use of a third party search engine mandatory either.

.........the Work and Health Programme (WHP) policy intention........

Policy intention is not law.

......mandate long term unemployed (LTU) participants to undertake
reasonable activity.........

reasonable - that old chestnut again.


So does that mean that the WHP provider would need to demonstrate that the mandate is reasonable  or would the onus be upon the participant to demonstrate that it is not  (on the grounds of respect for private correspondence / consent to data processing etc.)

This topic requires much more scrutiny.

Absolut wrote:If the DWP can't make the use of UJ mandatory then I don't see how they can make the use of a third party search engine mandatory either.

Exactly! I imagine these work search engines sets tons of cookies. I can't really see how a work search engine can function without the use of cookies, at least when it comes to applying for jobs.

Jara wrote:Exactly! I imagine these work search engines sets tons of cookies. I can't really see how a work search engine can function without the use of cookies, at least when it comes to applying for jobs.

It's worse than that though because some (who knows, maybe all) of these in-house search engines also monitor the claimant's activities. It also means they will have access to your full CV which normally you would not be obligated to give them to keep. The selection process for WHP is supposed to be random but I bet I get "randomly" selected for it and this issue of using in-house job search engines is going to be a real point of contention for me.

Absolut wrote:But it is not "necessary for the exercise of any functions of the Crown, a Minister of the Crown, or a government department" for a claimant to use a third party private company's software. If the DWP can't make the use of UJ mandatory then I don't see how they can make the use of a third party search engine mandatory either.

I tend to agree with you but it's the sort of thing that will only be decided by some brave soul refusing to use the in house search engines and going through the inevitable sanction process to ultimately battle it out at tribunal.

ABC wrote:

Absolut wrote:But it is not "necessary for the exercise of any functions of the Crown, a Minister of the Crown, or a government department" for a claimant to use a third party private company's software. If the DWP can't make the use of UJ mandatory then I don't see how they can make the use of a third party search engine mandatory either.

I tend to agree with you but it's the sort of thing that will only be decided by some brave soul refusing to use the in house search engines and going through the inevitable sanction process to ultimately battle it out at tribunal.

Interesting post/FOI!

DWP maybe relying upon any FtT decision being inconclusive and the legal battle protracted:

https://www.rightsnet.org.uk/forums/viewthread/10597/

@ ABC I would only ever provide a very heavily redacted CV if push came to shove.

I would never load my CV on their computers in the first place. To load a CV you most likely going to need to log into an account (UJM, email or cloud) to access your CV. And that uses cookies, so a big no.

If they mandate you to apply for a job on their computer I would suggest use your own device to go to that job application. Then find contact details for that employer and then apply for the job through email (or letter).

@ Jara
I agree with your advice

Jara wrote:If they mandate you to apply for a job on their computer I would suggest use your own device to go to that job application. Then find contact details for that employer and then apply for the job through email (or letter).

That's fine in principal but in practice what will happen is that they'll raise a doubt against you for refusal to participate in what they consider is a "reasonable" requirement to find work...that's just the reality of it. They want you specifically on their own job search website so that they can get access to your job applications, CVs etc. and that will happen no matter where you log in to the system be it at home or at their premises. For example the Avanta job search has in its T&C's (from 2013) and which you have no choice but to sign up to to use it
https://www.whatdotheyknow.com/request/avanta_access_to_claimants_accou

1.3 You agree that your Job Coach/Advisor has the ability to view the applications submitted through Avanta Jobs for the purpose of supporting you through the application process and assisting you in your job search.

and also from that FoI https://www.whatdotheyknow.com/request/178157/response/443369/attach/html/3/FOI%20IR777.pdf.html

Firstly it may be helpful if I explain that Work Programme participants are not mandated to use
AvantaJobs and can therefore choose not to use this site to help them get a job

but again that was in 2013. I wonder what's changed since then for them to now say that the use of provider job search websites can be made mandatory?

frank zola has a reference to these

S. Gwilliam left an annotation ( 8 November 2017)

Odd that the DWP say the W&HP provider guidance is exempt from disclosure, especially since they have previously made draft versions available in reply to previous FoI's.
(I have PDF copies on my laptop that were downloaded from the Bravo portal).

Not to worry, you can find draft copies of the H&WP guidance to download yourself here:

https://mrfrankzola.wordpress.com/2017/05/28/work-and-health-programme-all-provider-guidance-specifications-and-launch-info/

on other reference its the same dwp refuse to answer the reference can a supplier to the dwp mandate a claimant to use there in house computers

In addition, inFOI 711,
you have asked questions about refusal to use a provider’s in-house computers due to concerns over privacy and security. Under the terms of DWP contracts, providers are required to comply with the legal requirements of the Data Protection Act and Information Disclosure, ensuring the security of all personal and sensitive information remains properly protected, including that held on IT systems. The provider is also
contractually obliged to use the latest versions of anti-virus definitions and software available from an industry accepted anti-virus software vendor.

Chapter 8 ‘Information Security’,of the Generic Provider Guidance, available
on the Government website at the link below provides information on this subject.
https://www.gov.uk/government/publications/framework-generic-guidance-provider-guidance

https://www.whatdotheyknow.com/request/254704/response/625821/attach/2/Reply%20709%20710%20711%20712%20Baker.pdf

6 Mar 2015

ABC wrote:I tend to agree with you but it's the sort of thing that will only be decided by some brave soul refusing to use the in house search engines and going through the inevitable sanction process to ultimately battle it out at tribunal.

Indeed, as has been the case in the past. I would be one of them if I am forced to go through the WP for a second time because it has been my experience of the WP providers in the past that they routinely breach the DPA. I have openly seen other people's CVs (and their home addresses) on WP workers' screens and listened in on what should have been private conversations. The DWP claiming that their third party providers comply with the DPA is a joke. Further claiming that third party in-house software complies with the DPA can't possibly be proven without a coder being given access to the base code to see if it has any back doors in it or not. In an age of identity theft the DWP and their private contractors are very blase about our private data while vigorously protecting their own.

Having read the FOI again, the response does not specifically state claimants can be mandated to submit their data to third party search engines.

All DWP providers are provided with the necessary data when a claimant is referred to a mandatory scheme.

The Department in the case of the WHP is not relying on consent as a condition for
processing, and instead relies on the provisions found in Schedule 2 and 3 of the DPA
which state that the processing is necessary for the exercise of any functions conferred
on any person by or under any enactment and necessary for the exercise of any
functions of the Crown, a Minister of the Crown or a government department.

https://www.whatdotheyknow.com/request/445213/response/1082594/attach/html/2/4792%20Reply.pdf.html

SCHEDULE 2
Conditions relevant for purposes of the first principle: processing of any personal data
1The data subject has given his consent to the processing.
2The processing is necessary—
(a)for the performance of a contract to which the data subject is a party, or

(b)for the taking of steps at the request of the data subject with a view to entering into a contract.

3The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
4The processing is necessary in order to protect the vital interests of the data subject.
5The processing is necessary—
(a)for the administration of justice,

[F1(aa)for the exercise of any functions of either House of Parliament,]

(b)for the exercise of any functions conferred on any person by or under any enactment,

(c)for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d)for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
(2)The [F2 Secretary of State] may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

https://www.legislation.gov.uk/ukpga/1998/29/schedule/2

The Department for Work and Pensions (DWP) needs to collect and handle personal information about you so that we can provide services for you. Our personal information charter tells you the standards you can expect when we ask for your personal information. It also includes what we ask you to do to help us keep your information up to date.

If we ask you for personal information, we will:

make sure you know why we need it
only ask for what we need
make sure nobody has access to it who shouldn’t
keep it securely
let you know if we share it with other organisations to give you better public services
ask you to agree to us sharing your information where you have a choice
only keep it for as long as we need to
not make it available for commercial use (such as marketing) without your permission

https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter

The function of the WHP is to assist people into work.  However, participants still have a degree of choice regarding how they carry out their job search/work preparation activities and the manner in which they present their evidence.

DWP does not routinely track claimants activity on-line via UJ unless implicit consent has been provided.  Therefore, it must be unreasonable to expect claimants to use other search engines/third party sites under a threat of a sanction without providing implicit consent.  Further, DWP staff cannot see a claimants CV details on line without consent.

dwp will state that the providers are required to comply with the legal requirements of the Data Protection Act and Information Disclosure

but as it goes for in house computer usage claimants have the right to refuse them excepting the cookies on their computers also you are able to refuse first usage of the pc  

its a private company comes into business vs user laws

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/

Do we need consent from the subscriber or from the user?

Regulation 6 states that consent should be obtained from the subscriber or user.

In practice you may not be able to tell who is the subscriber and who is a user – which means you may not be able to distinguish between consent provided by the subscriber and by the user. The key will be that valid consent has been provided by one of them.

PECR does not say whose wishes should take precedence if they are different. If there appears to be a conflict – for example, if a subscriber or user previously consented but now the current user of the same device objects – it would seem sensible to rely on the most recent indication. This would mean you always respect the current user’s preferences, even if you cannot be sure of the subscriber’s preferences.

guidance for businesses

https://ico.org.uk/media/for-organisations/documents/1545/cookies_guidance.pdf

further to this gdpr comes into effect

The GDPR, Cookie Consent and Customer Centric Privacy

https://www.cookielaw.org/blog/2016/5/13/the-gdpr,-cookie-consent-and-customer-centric-privacy/

there's much more

https://www.theregister.co.uk/2017/09/26/small_businesses_gdpr_affects_you_too/

So have I got this right gadily?

As we know with UJM the DWP claims to be the subscriber and therefore accepts the cookies on our behalf on their IADs ignoring the fact that we (the user) may not consent. That allows them to mandate us to use UJM on their IADs (in certain circumstances).

But with the providers we are both the subscriber and the user (is that right, is this the difference?) and can therefore refuse to accept cookies on their devices at the providers' premises and of course can automatically refuse them on our own devices, so can't be forced to use their job search engines or anything else on their computers that relies on cookies.

I'm trying to figure out exactly what the difference is between the Jobcentre being able to mandate us to use UJM (albeit only on their IADs) and the providers not being able to mandate us on any device, theirs or ours (which the FoI anyway says that they can).

And we know, as I said above, that in any case if we refuse to use their in house job search engines they'll raise a doubt for not complying with what they consider a reasonable request.

Non Deficere wrote:Having read the FOI again, the response does not specifically state claimants can be mandated to submit their data to third party search engines.

It's implicit in their response. They say "this would include the option to
make the use of in-house provider job search engines a mandatory activity for LTU
participants"

Therefore if the use of in house search engines, which implicitly requires supplying a full, unredacted CV, can be mandated then our personal info can too.

I think my approach as was mentioned earlier would be to say I'd use their sytems to find the jobs but would apply by my own methods, not through their job search engines. At least that way you are using their job search facilities but aren't divulging any of your info. I think that would succeed if a doubt were raised because you are actually using their systems. But I bet any mandate would require logging in to their systems and providing a full CV online, giving them access etc. etc!

ABC wrote:

Non Deficere wrote:Having read the FOI again, the response does not specifically state claimants can be mandated to submit their data to third party search engines.

It's implicit in their response. They say "this would include the option to
make the use of in-house provider job search engines a mandatory activity for LTU
participants"

Therefore if the use of in house search engines, which implicitly requires supplying a full, unredacted CV, can be mandated then our personal info can too.

I think my approach as was mentioned earlier would be to say I'd use their sytems to find the jobs but would apply by my own methods, not through their job search engines. At least that way you are using their job search facilities but aren't divulging any of your info. I think that would succeed if a doubt were raised because you are actually using their systems. But I bet any mandate would require logging in to their systems and providing a full CV online, giving them access etc. etc!

The response is an abiguous one.

DWP and its Work and Health Programme (WHP) Providers have a legal power to
mandate long term unemployed customers to the WHP under Section 2(2)(b) [8C] of
the Jobseeker’s Allowance (Schemes for Assisting Persons to Obtain
Employment) (Amendment) Regulations 2017 No. 1020.

Correct! Some claimants can be mandated to the scheme.

These Regulations give DWP and its Providers the authority to “assist a claimant who
is long term unemployed in which, for a period of up to 456 calendar days , the claimant
is given such support , and required to participate in such activity, as the provider of
the WHP considers appropriate and reasonable in the claimant’s circumstances to
assist the claimant to obtain and sustain employment”. The legislation therefore allows
DWP and its Providers to mandate the long term unemployed to the WHP.

It is not reasonable for claimants to be mandated to use websites/search engines where they are tracked on line without consent.
Jobs can be offered to claimants and applied for without being tracked.

DWP and its Providers ensure that processing of personal data is carried out lawfully
and fairly and is in accordance with the principles set out in the Data Protection Act
1998 (DPA). The DPA 1998 requires particular conditions for processing personal data
to be met under Schedule 2 and 3 of the Act and consent can be one such condition.
The Department in the case of the WHP is not relying on consent as a condition for
processing, and instead relies on the provisions found in Schedule 2 and 3 of the DPA
which state that the processing is necessary for the exercise of any functions conferred
on any person by or under any enactment and necessary for the exercise of any
functions of the Crown, a Minister of the Crown or a government department.

Correct as far as the information shared by DWP and processing action plans etc.. However, it is not necessary for claimants to be tracked on line for reasonable and appropriate support to be provided.

DWP could argue that they need to track claimants via UJ to ensure they are meeting the legal requirement to actively seek work or, to enable JCP to provide support in seeking work/preparing a CV etc. DWP staff tell claimants that the main purpose of giving access to their UJ account is to provide additional support!

Finally, we refer you to the DWP Personal Information Charter that sets out the
Department’s fair processing policy. Please visit
https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter
for further information.

A new FoI which may (but probably won't) clear things up https://www.whatdotheyknow.com/request/work_and_health_programme_job_se

And hopefully the WHP Provider Guidance will appear here by 19th January if it isn't available on gov.uk before that https://www.whatdotheyknow.com/request/dwp_whp_guidance?unfold=1

In legislative terms the overriding requirement is, participation in the scheme/programme.

I have seen so many illegal notices that I have become familiar with what is reasonable and what is not in light of the legislation that is applicable today.

Current provider guidance (e.g. WPP) has not been updated to reflect any changes.

DWP and its contractors rely on most people consenting/complying with policy/guidance/DWP or provider demands!  

ABC wrote:So have I got this right gadily?

As we know with UJM the DWP claims to be the subscriber and therefore accepts the cookies on our behalf on their IADs ignoring the fact that we (the user) may not consent. That allows them to mandate us to use UJM on their IADs (in certain circumstances).

But with the providers we are both the subscriber and the user (is that right, is this the difference?) and can therefore refuse to accept cookies on their devices at the providers' premises and of course can automatically refuse them on our own devices, so can't be forced to use their job search engines or anything else on their computers that relies on cookies.

I'm trying to figure out exactly what the difference is between the Jobcentre being able to mandate us to use UJM (albeit only on their IADs) and the providers not being able to mandate us on any device, theirs or ours (which the FoI anyway says that they can).

And we know, as I said above, that in any case if we refuse to use their in house job search engines they'll raise a doubt for not complying with what they consider a reasonable request.

its mainly to do with cookies abc

the government cannot force us to except cookies on our machines as this is consent based we can refuse the cookies on our own pcs

as we sign on we authorise dwp to collect and pass some info to providers or in the case of ujm

jcp computers have explicit cookies already accepted on their pc,s and are turned off and turned on so a new session is created everytime its turned back on

on the scope of a private system the scope is different

they save info they can also place keyloggers they also save page visits they also report back to their providers with all this info

this is simply tracking of a jobseeker and is ripa law

interception of information
privacy issues whilst using their systems
cookies being accepted on their machines

now this is the interesting part its a private corporation that must conform to ripa and data protection acts

business can specifically accept cookies but must inform its user of this and then it becomes consent based  
business must gain consent from the user but that can mean first use is given consent the new gdpr laws change this to being fully informed of everything that the machine collects and passes to the providers

hence the reason why dwp give you the cookie fact sheet to say youve been informed by receiving this letter

this is where consent can be refused doesn't matter what dwp say it is the fact is its not owned by dwp or the government but a private enterprise part of reason why the original owner got wound up when his site was being smeared across the web and try as they might couldnt get users to agree to it

also refused to directly answer any questions on the subject of a users rights against the provided website to use knowing that users can fully refuse to use that system

refutted has made it clear enough by 2 times that a providers in house website can be refused

ico will not directly answer the main question is the dwp allowed to accept cookies on a users behalf to do their jobsearch on dwp computers a member tried to get it but went down a different route

dwp got round this i believe by creating a new session every time a user uses the computers at jcp however dwp cannot intercet this transmission but i wouldnt put it past them that they already are doing

private business is different these pc,s can collect all information from their cmputers even i can get this info off these machines as theres a copy everywhere on the machines even when you think you've deleted this info its still there somewhere and thats on basic machines

busnesses use xp machines or windows 7, i havent seen many on windows 7/8 just windows xp systems and thats many providers out there

117.If you do not have any available internet enabled devices on which cookies have been
accepted for the participant to use, you cannot mandate the participant to apply for a
job in UJ where the method of application is to select a CV in UJ and send it on line
through the service. However, you will be able to take the action described.

118.If a participant is not given this choice, they may choose not to comply with the
requirement to use UJ on grounds that cookies would be unlawfully placed on their
device and may also complain to the Information Commissioner that the UJ website has
placed cookies on their device without their freely given consent.

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/505310/wp-pg-chapter-3a.pdf

Non Deficere wrote:make sure nobody has access to it who shouldn’t

A vague statement in itself. It cannot be known what they mean by 'who shouldn't'.