× Search rightsnet
Search options

Where

Benefit

Jurisdiction

Jurisdiction

From

to

Forum Home  →  Discussion  →  Access to justice and advice sector issues  →  Thread

GDPR - What are you keeping in case files?

CHAC Adviser
forum member

Caseworker - CHAC, Middlesbrough

Send message

Total Posts: 259

Joined: 14 September 2017

I’m sure we’re all having exciting conversations about GDPR coming into force tomorrow. At my organisation we’ve had someone in to talk about things we need to be doing/considering and one of the things that came out of that was around what information/documentation we hold in either in paper case files or on our electronic case management system.

The suggestion was that we shouldn’t be holding onto things like copies of PIP forms, copies of DWP decision notices, medical reports, etc as they are the clients personal data and we have no reason to hold onto them once the client has left the building. This is true even for situations where we’re doing on going casework. The argument being that if we do need them (for example preparing for a Tribunal hearing) then they would be provided in the bundle or (for example with medical records) we should send a copy to HMCTS and then shred the original/return it to the client once the copy comes back from HMCTS to confirm they’ve received it as there is no need to hold onto the original.

This has caused, as you might imagine, some grumbling from our caseworkers (including me!) as we’re used to keeping copies of documents that are relevant and useful to the case and not relying on DWP/HMCTS admin to prepare good quality bundles.

So I’m wondering what everyone else’s approach to this is? What’s your organisation doing in terms of keeping client documents? It feels a bit extreme to basically not keep any copies of documents unless we’ve got it in an appeal bundle for a client we’re representing. But that’s the advice we’ve been given…

Paul_Treloar_AgeUK
forum member

Information and advice resources - Age UK

Send message

Total Posts: 3196

Joined: 7 January 2016

Personally, I’d be very cautious about destroying copies of claim forms and correspondence because relying on DWP and HMCTS is relying on being let down repeatedly.

Surely, if a client has positively consented to you, for example, assisting them with a PIP claim, it’s still good practice to hold all relevant documentation for at least 6 years? Can’t you just amend your client authority form to that effect i.e. we will hold onto all relevant paperwork for 6 years from first contact, in case it’s needed again?

Jon (CANY)
forum member

Welfare benefits - Craven CAB, North Yorkshire

Send message

Total Posts: 1362

Joined: 16 June 2010

We have been advised that a PIP form would almost inevitably fall under special category data as it contains health information. Therefore we need specific consent, not only to keep a copy, but also to make any case notes about the client’s health issues. This can’t be done with a blanket “we want to store your info” form, the consent needs to be positively affirmed in each case. Without that consent, we’re not really able to advise at all on sickness/disability benefits.

For non special data, Cit A takes the view that we would normally have a legitmate interest in retaining copies of what the client chooses to show us, with no particular consent needed.

I’m still thinking through the implications of how all this works in practice ...

Paul_Treloar_AgeUK
forum member

Information and advice resources - Age UK

Send message

Total Posts: 3196

Joined: 7 January 2016

Yes it does represent special category data but as per the ICO “Your choice of lawful basis under Article 6 does not dictate which special category condition you must apply, and vice versa. For example, if you use consent as your lawful basis, you are not restricted to using explicit consent for special category processing under Article 9. “

It’s more about making sure that you as Citizens Advice have a lawful basis on which to hold that data - in this case, I’d say this could, for example, be under either:

(f)  processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; or maybe

(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

Special category data

To me, it’s about making sure that you have a legitimate reason for holding special category data, that your client has consented to you holding that data, and that you have appropriate controls in place to keep that data secure and safe (something that will be a responsibility of the data controller that I’m sure everyone has put in place now as they’re directly responsible for making sure this happens…...)

stevenmcavoy
forum member

Welfare rights officer - Enable Scotland

Send message

Total Posts: 868

Joined: 22 August 2013

vast majority of my stuff is on advice pro.

we don’t keep records of pip claim forms (ive never seen the point as for all they can go missing in the post the time taken to scan them v the times they go missing means its a pointless exercise really).  other than that ive never found any compelling reason for keeping them.

we scan supporting evidence, attach submissions and then the resulting appeal decision notice.

our system is set to auto cleanse after 3 years of not being updated.

paper wise I only hold appeal bundles.  soon as the client gets their cash/we have exhausted any potential ut appeals etc then they get shredded.

Elliot Kent
forum member

Shelter

Send message

Total Posts: 3117

Joined: 14 July 2014

Most everyone keeps records for a period of six years for the very sensible reason that an ex-client has six years in which to bring an action for negligence against you (personally) or your agency.

If you are confronted with a claim and can’t come up with the actual papers, you are going to find it incredibly difficult to mount any sort of defence. Whilst you may know you did nothing wrong, good luck convincing your insurer or a Court of that.

Frankly if GDPR does stop advisers from holding copies of PIP2s etc (I doubt that it does as per Paul), agencies will need to give serious thought to whether they can continue to complete them.

Jon (CANY)
forum member

Welfare benefits - Craven CAB, North Yorkshire

Send message

Total Posts: 1362

Joined: 16 June 2010

Just to be clear, above I was paraphrasing the advice we (local Citizens Advice) have received from our national body. The example of needing explicit consent to note health isues when doing a PIP form is specifically mentioned in their notes to us, I guess it would be difficult for individual local offices to formulate a policy to go against it and find our own justifications to store data. Anyway, I think it’s fairly reasonable and should be workable for us.

If I’d been given an opinion along the lines of that given to CHAC Adviser above, I’d certainly be looking more deeply into whether it’s justified. E.g., it appears to lead to situations like having to advise on, and draft, MRs and appeals without sight of the original claim form, even if the client would have consented to the agency keeping a copy when they assisted with the claim.

Mike Hughes
forum member

Senior welfare rights officer - Salford City Council Welfare Rights Service

Send message

Total Posts: 3138

Joined: 17 June 2010

I would never not scan and upload a PIP 2 in full. Have had too many instances over the years with DLA etc. where DWP have lost originals; disposed after a fixed period; client hasn’t retained. Also tremendously and explicitly useful for clients who repeatedly get ESA 50s and nothing ever changes. I have been known to email clients a copy and just get them to copy it verbatim.

Main thing with GDPR is that most organisations have not got to grips with it and have taken an overly cautious and often ill-informed approach. As was observed recently in national media most organisations emailing to ask for your consent probably don’t have consent to email. The ones that do, didn’t need to write in the first place.

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

what we’ve done is prepare a one sided A4 sheet setting out

1. the info we need to collect
2. who we’ll give it to and why

and why we need to collect/retain it (plus retention policy) ( to run the case, basically)

client signs that.  if they don’t sign it, we can’t do the work

clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.

clients see the sense of the form and are signing it.

client gets a copy and we keep a copy on file.

and yes, it is possible to get it all on one side of A4.

as for retention - 3 years is wholly insufficient, as pointed out.  6 minimum.  the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day .  and that wouldn’t necessarily only be because of advice on bnefits.  e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.

CHAC Adviser
forum member

Caseworker - CHAC, Middlesbrough

Send message

Total Posts: 259

Joined: 14 September 2017

Thanks for all the replies so far. It’s encouraging to see so many people have had similar thoughts to myself regarding this suggestion!

Mike Hughes
forum member

Senior welfare rights officer - Salford City Council Welfare Rights Service

Send message

Total Posts: 3138

Joined: 17 June 2010

ClairemHodgson - 25 May 2018 11:13 AM

what we’ve done is prepare a one sided A4 sheet setting out

1. the info we need to collect
2. who we’ll give it to and why

and why we need to collect/retain it (plus retention policy) (to run the case, basically)

Client signs that. If they don’t sign it, we can’t do the work

Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.

Clients see the sense of the form and are signing it.

Client gets a copy and we keep a copy on file.

and yes, it is possible to get it all on one side of A4.

as for retention - 3 years is wholly insufficient, as pointed out.  6 minimum.  the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day .  and that wouldn’t necessarily only be because of advice on bnefits.  e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.

Claire,

Do you (or indeed anyone else) have a blank copy you’d be willing to share?

It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.

So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)

 

Mike Hughes
forum member

Senior welfare rights officer - Salford City Council Welfare Rights Service

Send message

Total Posts: 3138

Joined: 17 June 2010

Just bumping this as I’m not sure Claire has seen it.

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

Mike Hughes - 20 June 2018 03:14 PM
ClairemHodgson - 25 May 2018 11:13 AM

what we’ve done is prepare a one sided A4 sheet setting out

1. the info we need to collect
2. who we’ll give it to and why

and why we need to collect/retain it (plus retention policy) (to run the case, basically)

Client signs that. If they don’t sign it, we can’t do the work

Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.

Clients see the sense of the form and are signing it.

Client gets a copy and we keep a copy on file.

and yes, it is possible to get it all on one side of A4.

as for retention - 3 years is wholly insufficient, as pointed out.  6 minimum.  the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day .  and that wouldn’t necessarily only be because of advice on bnefits.  e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.

Claire,

Do you (or indeed anyone else) have a blank copy you’d be willing to share?

It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.

So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)

 

as Mike suggested, I hadn’t seen this.

i attach the document i drafted for PI cases.  it is very specifically aimed at that but easily adapted, i should have thought, for benefits purposes.

File Attachments

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

of course file retention raises issues of space/cost, which is a separate point.

and for benefits we’ve all seen cases where very old medical evidence is as persuasive now as it was then (for instance, my case mentioned elsewhere where we have documents dating back to mobility before it became part of DLA, disclosed by DWP - and very helpful too!)

i think how long you keep stuff for is a matter for the individual case, but a minimum 6 years (negligence claims) and where people have no capacity for whatever reason, probably longer (long stop 100th birthday).  we also keep stuff where a case settles on provisional damages - common in asbestos cases, claimant can go back for more if he later developes mesothelioma or lung cancer, but not confined to those

Mike Hughes
forum member

Senior welfare rights officer - Salford City Council Welfare Rights Service

Send message

Total Posts: 3138

Joined: 17 June 2010

ClairemHodgson - 27 July 2018 01:36 PM
Mike Hughes - 20 June 2018 03:14 PM
ClairemHodgson - 25 May 2018 11:13 AM

what we’ve done is prepare a one sided A4 sheet setting out

1. the info we need to collect
2. who we’ll give it to and why

and why we need to collect/retain it (plus retention policy) (to run the case, basically)

Client signs that. If they don’t sign it, we can’t do the work

Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.

Clients see the sense of the form and are signing it.

Client gets a copy and we keep a copy on file.

and yes, it is possible to get it all on one side of A4.

as for retention - 3 years is wholly insufficient, as pointed out.  6 minimum.  the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day .  and that wouldn’t necessarily only be because of advice on bnefits.  e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.

Claire,

Do you (or indeed anyone else) have a blank copy you’d be willing to share?

It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.

So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)

 

as Mike suggested, I hadn’t seen this.

i attach the document i drafted for PI cases.  it is very specifically aimed at that but easily adapted, i should have thought, for benefits purposes.

That’s excellent. Thanks Claire. Can work on adapting that early next week.

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

what amazes me is the number of firms of all sorts who insist on using inaccessible language that client’s won’t understand.

IMHO the ICO is interested in the client getting the information, in a form the client can understand.

the language in the regs/guidance is, imho, obscure (hell if I didn’t understand it until i went on a course, i don’t see how the lay client can be expected to!)

Mike Hughes
forum member

Senior welfare rights officer - Salford City Council Welfare Rights Service

Send message

Total Posts: 3138

Joined: 17 June 2010

Just resurrecting this as have been getting my head around the GDPR stuff for a couple of months now.

So, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?

Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

Mike Hughes - 07 September 2018 09:20 AM

So, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?

Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?

hah.  given you’re dealing with teh DWP i should have thought you’d need an explicit consent for every single contact on every single separate thing (given the problems with explicit/implicit consent, etc…....) and even then they won’t care no mater what your client says.

more seriously, i’d go per benefit but if you are looking at client’s entire benefit position, the lot.

Peter Turville
forum member

Welfare rights worker - Oxford Community Work Agency

Send message

Total Posts: 1659

Joined: 18 June 2010

we have found so far that PIP can sometimes be difficult if the consent form does not say PIP (rather than DWP) but it has not been an isue yet with other parts of DWP (except PS who don’t seem to understand consent full stop) or with HMCTS, HB etc. Perhaps we’ve just been lucky?

ClairemHodgson
forum member

Solicitor, SC Law, Harrow

Send message

Total Posts: 1221

Joined: 13 April 2016

ClairemHodgson - 07 September 2018 01:32 PM
Mike Hughes - 07 September 2018 09:20 AM

So, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?

Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?

hah.  given you’re dealing with teh DWP i should have thought you’d need an explicit consent for every single contact on every single separate thing (given the problems with explicit/implicit consent, etc…....) and even then they won’t care no mater what your client says.

more seriously, i’d go per benefit but if you are looking at client’s entire benefit position, the lot.


on the other hand, of course, mine covers everything and everyone that i might need to collect info from and give it to….

Ruth_T
forum member

Volunteer adviser - Corby Borough Welfare Rights & CAB

Send message

Total Posts: 313

Joined: 21 June 2010

Whereas it’s obviously easier to have only one FoA which names all the organisations we may be contacting, maybe we should be asking our clients whether they have any objection to Organisation A knowing that we are also contacting Organisation B.