Forum Home → Discussion → Access to justice and advice sector issues → Thread
GDPR - What are you keeping in case files?
forum member
Caseworker - CHAC, Middlesbrough
Total Posts: 259
Joined: 14 September 2017
I’m sure we’re all having exciting conversations about GDPR coming into force tomorrow. At my organisation we’ve had someone in to talk about things we need to be doing/considering and one of the things that came out of that was around what information/documentation we hold in either in paper case files or on our electronic case management system.
The suggestion was that we shouldn’t be holding onto things like copies of PIP forms, copies of DWP decision notices, medical reports, etc as they are the clients personal data and we have no reason to hold onto them once the client has left the building. This is true even for situations where we’re doing on going casework. The argument being that if we do need them (for example preparing for a Tribunal hearing) then they would be provided in the bundle or (for example with medical records) we should send a copy to HMCTS and then shred the original/return it to the client once the copy comes back from HMCTS to confirm they’ve received it as there is no need to hold onto the original.
This has caused, as you might imagine, some grumbling from our caseworkers (including me!) as we’re used to keeping copies of documents that are relevant and useful to the case and not relying on DWP/HMCTS admin to prepare good quality bundles.
So I’m wondering what everyone else’s approach to this is? What’s your organisation doing in terms of keeping client documents? It feels a bit extreme to basically not keep any copies of documents unless we’ve got it in an appeal bundle for a client we’re representing. But that’s the advice we’ve been given…
forum member
Information and advice resources - Age UK
Total Posts: 3196
Joined: 7 January 2016
Personally, I’d be very cautious about destroying copies of claim forms and correspondence because relying on DWP and HMCTS is relying on being let down repeatedly.
Surely, if a client has positively consented to you, for example, assisting them with a PIP claim, it’s still good practice to hold all relevant documentation for at least 6 years? Can’t you just amend your client authority form to that effect i.e. we will hold onto all relevant paperwork for 6 years from first contact, in case it’s needed again?
forum member
Welfare benefits - Craven CAB, North Yorkshire
Total Posts: 1362
Joined: 16 June 2010
We have been advised that a PIP form would almost inevitably fall under special category data as it contains health information. Therefore we need specific consent, not only to keep a copy, but also to make any case notes about the client’s health issues. This can’t be done with a blanket “we want to store your info” form, the consent needs to be positively affirmed in each case. Without that consent, we’re not really able to advise at all on sickness/disability benefits.
For non special data, Cit A takes the view that we would normally have a legitmate interest in retaining copies of what the client chooses to show us, with no particular consent needed.
I’m still thinking through the implications of how all this works in practice ...
forum member
Information and advice resources - Age UK
Total Posts: 3196
Joined: 7 January 2016
Yes it does represent special category data but as per the ICO “Your choice of lawful basis under Article 6 does not dictate which special category condition you must apply, and vice versa. For example, if you use consent as your lawful basis, you are not restricted to using explicit consent for special category processing under Article 9. “
It’s more about making sure that you as Citizens Advice have a lawful basis on which to hold that data - in this case, I’d say this could, for example, be under either:
(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; or maybe
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
To me, it’s about making sure that you have a legitimate reason for holding special category data, that your client has consented to you holding that data, and that you have appropriate controls in place to keep that data secure and safe (something that will be a responsibility of the data controller that I’m sure everyone has put in place now as they’re directly responsible for making sure this happens…...)
forum member
Welfare rights officer - Enable Scotland
Total Posts: 868
Joined: 22 August 2013
vast majority of my stuff is on advice pro.
we don’t keep records of pip claim forms (ive never seen the point as for all they can go missing in the post the time taken to scan them v the times they go missing means its a pointless exercise really). other than that ive never found any compelling reason for keeping them.
we scan supporting evidence, attach submissions and then the resulting appeal decision notice.
our system is set to auto cleanse after 3 years of not being updated.
paper wise I only hold appeal bundles. soon as the client gets their cash/we have exhausted any potential ut appeals etc then they get shredded.
Most everyone keeps records for a period of six years for the very sensible reason that an ex-client has six years in which to bring an action for negligence against you (personally) or your agency.
If you are confronted with a claim and can’t come up with the actual papers, you are going to find it incredibly difficult to mount any sort of defence. Whilst you may know you did nothing wrong, good luck convincing your insurer or a Court of that.
Frankly if GDPR does stop advisers from holding copies of PIP2s etc (I doubt that it does as per Paul), agencies will need to give serious thought to whether they can continue to complete them.
forum member
Welfare benefits - Craven CAB, North Yorkshire
Total Posts: 1362
Joined: 16 June 2010
Just to be clear, above I was paraphrasing the advice we (local Citizens Advice) have received from our national body. The example of needing explicit consent to note health isues when doing a PIP form is specifically mentioned in their notes to us, I guess it would be difficult for individual local offices to formulate a policy to go against it and find our own justifications to store data. Anyway, I think it’s fairly reasonable and should be workable for us.
If I’d been given an opinion along the lines of that given to CHAC Adviser above, I’d certainly be looking more deeply into whether it’s justified. E.g., it appears to lead to situations like having to advise on, and draft, MRs and appeals without sight of the original claim form, even if the client would have consented to the agency keeping a copy when they assisted with the claim.
forum member
Senior welfare rights officer - Salford City Council Welfare Rights Service
Total Posts: 3138
Joined: 17 June 2010
I would never not scan and upload a PIP 2 in full. Have had too many instances over the years with DLA etc. where DWP have lost originals; disposed after a fixed period; client hasn’t retained. Also tremendously and explicitly useful for clients who repeatedly get ESA 50s and nothing ever changes. I have been known to email clients a copy and just get them to copy it verbatim.
Main thing with GDPR is that most organisations have not got to grips with it and have taken an overly cautious and often ill-informed approach. As was observed recently in national media most organisations emailing to ask for your consent probably don’t have consent to email. The ones that do, didn’t need to write in the first place.
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
what we’ve done is prepare a one sided A4 sheet setting out
1. the info we need to collect
2. who we’ll give it to and why
and why we need to collect/retain it (plus retention policy) ( to run the case, basically)
client signs that. if they don’t sign it, we can’t do the work
clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.
clients see the sense of the form and are signing it.
client gets a copy and we keep a copy on file.
and yes, it is possible to get it all on one side of A4.
as for retention - 3 years is wholly insufficient, as pointed out. 6 minimum. the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day . and that wouldn’t necessarily only be because of advice on bnefits. e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.
forum member
Caseworker - CHAC, Middlesbrough
Total Posts: 259
Joined: 14 September 2017
Thanks for all the replies so far. It’s encouraging to see so many people have had similar thoughts to myself regarding this suggestion!
forum member
Senior welfare rights officer - Salford City Council Welfare Rights Service
Total Posts: 3138
Joined: 17 June 2010
ClairemHodgson - 25 May 2018 11:13 AMwhat we’ve done is prepare a one sided A4 sheet setting out
1. the info we need to collect
2. who we’ll give it to and whyand why we need to collect/retain it (plus retention policy) (to run the case, basically)
Client signs that. If they don’t sign it, we can’t do the work
Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.
Clients see the sense of the form and are signing it.
Client gets a copy and we keep a copy on file.
and yes, it is possible to get it all on one side of A4.
as for retention - 3 years is wholly insufficient, as pointed out. 6 minimum. the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day . and that wouldn’t necessarily only be because of advice on bnefits. e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.
Claire,
Do you (or indeed anyone else) have a blank copy you’d be willing to share?
It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.
So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)
forum member
Senior welfare rights officer - Salford City Council Welfare Rights Service
Total Posts: 3138
Joined: 17 June 2010
Just bumping this as I’m not sure Claire has seen it.
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
Mike Hughes - 20 June 2018 03:14 PMClairemHodgson - 25 May 2018 11:13 AMwhat we’ve done is prepare a one sided A4 sheet setting out
1. the info we need to collect
2. who we’ll give it to and whyand why we need to collect/retain it (plus retention policy) (to run the case, basically)
Client signs that. If they don’t sign it, we can’t do the work
Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.
Clients see the sense of the form and are signing it.
Client gets a copy and we keep a copy on file.
and yes, it is possible to get it all on one side of A4.
as for retention - 3 years is wholly insufficient, as pointed out. 6 minimum. the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day . and that wouldn’t necessarily only be because of advice on bnefits. e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.
Claire,
Do you (or indeed anyone else) have a blank copy you’d be willing to share?
It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.
So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)
as Mike suggested, I hadn’t seen this.
i attach the document i drafted for PI cases. it is very specifically aimed at that but easily adapted, i should have thought, for benefits purposes.
File Attachments
- DATA_PROTECTION_AND_RETENTION.docx (File Size: 15KB - Downloads: 2221)
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
of course file retention raises issues of space/cost, which is a separate point.
and for benefits we’ve all seen cases where very old medical evidence is as persuasive now as it was then (for instance, my case mentioned elsewhere where we have documents dating back to mobility before it became part of DLA, disclosed by DWP - and very helpful too!)
i think how long you keep stuff for is a matter for the individual case, but a minimum 6 years (negligence claims) and where people have no capacity for whatever reason, probably longer (long stop 100th birthday). we also keep stuff where a case settles on provisional damages - common in asbestos cases, claimant can go back for more if he later developes mesothelioma or lung cancer, but not confined to those
forum member
Senior welfare rights officer - Salford City Council Welfare Rights Service
Total Posts: 3138
Joined: 17 June 2010
ClairemHodgson - 27 July 2018 01:36 PMMike Hughes - 20 June 2018 03:14 PMClairemHodgson - 25 May 2018 11:13 AMwhat we’ve done is prepare a one sided A4 sheet setting out
1. the info we need to collect
2. who we’ll give it to and whyand why we need to collect/retain it (plus retention policy) (to run the case, basically)
Client signs that. If they don’t sign it, we can’t do the work
Clearly in my normal work i collect huge amounts of info more than you will just doing welf work but even on a benefits only case there’s a fair bit.
Clients see the sense of the form and are signing it.
Client gets a copy and we keep a copy on file.
and yes, it is possible to get it all on one side of A4.
as for retention - 3 years is wholly insufficient, as pointed out. 6 minimum. the fact that a benefits advisor may never yet have been sued for negligence (that i’m aware of) doesn’t mean that it won’t happen one day . and that wouldn’t necessarily only be because of advice on bnefits. e.g. it’s clear that person should be referred to solicitor to get compen for injuries - not referred - time expires - oops, negligence claim.
Claire,
Do you (or indeed anyone else) have a blank copy you’d be willing to share?
It occurred to me that if the justification for keeping a document relates to the length of time it could be of use then DLA, PIP and AA could be the exceptions in as much as it’s entirely foreseeable that such a form could be relevant a decade down the line. However, the moment you go down that line it gets very messy? How long is reasonable for medical evidence etc. would vary depending on the document.
So, anything purporting to do the job on 1 side of A4 has to be worth sharing? :)
as Mike suggested, I hadn’t seen this.
i attach the document i drafted for PI cases. it is very specifically aimed at that but easily adapted, i should have thought, for benefits purposes.
That’s excellent. Thanks Claire. Can work on adapting that early next week.
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
what amazes me is the number of firms of all sorts who insist on using inaccessible language that client’s won’t understand.
IMHO the ICO is interested in the client getting the information, in a form the client can understand.
the language in the regs/guidance is, imho, obscure (hell if I didn’t understand it until i went on a course, i don’t see how the lay client can be expected to!)
forum member
Senior welfare rights officer - Salford City Council Welfare Rights Service
Total Posts: 3138
Joined: 17 June 2010
Just resurrecting this as have been getting my head around the GDPR stuff for a couple of months now.
So, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?
Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
Mike Hughes - 07 September 2018 09:20 AMSo, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?
Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?
hah. given you’re dealing with teh DWP i should have thought you’d need an explicit consent for every single contact on every single separate thing (given the problems with explicit/implicit consent, etc…....) and even then they won’t care no mater what your client says.
more seriously, i’d go per benefit but if you are looking at client’s entire benefit position, the lot.
forum member
Welfare rights worker - Oxford Community Work Agency
Total Posts: 1659
Joined: 18 June 2010
we have found so far that PIP can sometimes be difficult if the consent form does not say PIP (rather than DWP) but it has not been an isue yet with other parts of DWP (except PS who don’t seem to understand consent full stop) or with HMCTS, HB etc. Perhaps we’ve just been lucky?
forum member
Solicitor, SC Law, Harrow
Total Posts: 1221
Joined: 13 April 2016
ClairemHodgson - 07 September 2018 01:32 PMMike Hughes - 07 September 2018 09:20 AMSo, a quick question. Explicit consent form/form of authority which covers all contacts with different agencies or one per subject i.e. one for PIP, one for ESA etc?
Reviewing others service specific statements its noticeable there’s huge variation (entertainingly so at the extremes) so I’m guessing there are different approaches to this as well?
hah. given you’re dealing with teh DWP i should have thought you’d need an explicit consent for every single contact on every single separate thing (given the problems with explicit/implicit consent, etc…....) and even then they won’t care no mater what your client says.
more seriously, i’d go per benefit but if you are looking at client’s entire benefit position, the lot.
on the other hand, of course, mine covers everything and everyone that i might need to collect info from and give it to….
forum member
Volunteer adviser - Corby Borough Welfare Rights & CAB
Total Posts: 313
Joined: 21 June 2010
Whereas it’s obviously easier to have only one FoA which names all the organisations we may be contacting, maybe we should be asking our clients whether they have any objection to Organisation A knowing that we are also contacting Organisation B.