Personal Independence Payment: agency agreement

16. Data Subjects Rights

16.1 For the purposes of this Agreement, the term ‘Data Subject’ will have the same meaning as in section 3(5) Data Protection Act 2018 (DPA) and as referred to in the definition of Personal Data under Article 4(1) General Data Protection Regulation (UK GDPR).

16.2 The terms ‘Personal Data’, ‘Controller’, ‘Processing’ and ‘Process’ will have the same meaning as in Article 4 of the UK GDPR.

16.3 All current Data Protection Legislation and guidance will apply, including but not limited to:

(a) the UK GDPR,

(b) DPA 2018,

(c) regulations made under the DPA 2018

(d) regulations made under section 2(2) of the European Communities Act

1972 which relate to the EU GDPR or the Law Enforcement Directive,

(e) the Privacy and Electronic Communications (EC Directive) Regulations 2003, and

(f) the guidance and codes of practice issued by the Information

Commissioner.

16.4 Requests regarding rights of a Data Subject under Chapter 3 of the UK GDPR will be dealt with by DWP as a Controller in accordance with DWP policies.

16.5 When the Scottish Ministers receive a request pertaining to rights of a Data Subject under the UK GDPR, concerning Personal Independence Payment, the Scottish Ministers will acknowledge the request and will forward the said request to DWP within three (3) working days of initial receipt. The acknowledgement will inform the Data Subject that their request has been forwarded to DWP. DWP will then respond on behalf of both DWP and the Scottish Government, in accordance with its business as usual arrangements.

16.6 All other functions exercisable to comply with the current Data Protection Legislation, in relation to Personal Data being processed by DWP for Personal Independence Payment, will be exercised by DWP in accordance with its existing practices.