Data Sharing
Requests for information relating to Citizens Advice consumer service data
Who owns the data?
Referrals
Where data is held by the Trading Standards Service, it is their data to choose to disclose if they wish. By ‘held’ we mean data stored in their own systems. This would include referrals from the consumer service. Where the data comes from the consumer service via referrals, the Trading Standards Service together with Citizens Advice are joint data controllers.
Consumer Data Warehouse (Partner Portal)
Data held in the Citizens Advice Consumer Data Warehouse (CDW) and accessed via the Partner Portal and is owned by Citizens Advice. This data should not be disclosed to a third party without our prior permission, unless provided for under section 2 of the Data Sharing Agreement (DSA) between the Trading Standards Service and Citizens Advice. More information is provided about this is the Joint Investigations section below.
To disclose or not to disclose?
Freedom of information requests for data sourced from CDW
Sections 4.1 and 4.2 of the DSA sets out how Freedom of Information requests should be handled. For ease of reference the sections from the Citizens Advice DSA are replicated below. The DSA with Citizens Advice Scotland has the same clauses.
4.1Where the Authority, in response to a request for Citizens Advice Consumer Information made? under the Freedom of Information Act 2000 or the Freedom of Information (Scotland) Act 2002, or the Environmental Information Regulations 2004 or the Environmental Information (Scotland) Regulations 2004, as applicable is considering disclosing Specified Consumer Information obtained from the CDW, it will promptly consult with Citizens Advice before doing so.
4.2The Authority will, in fulfilling obligations under the Freedom of Information Act 2000 or the Freedom of Information (Scotland) Act 2002, as applicable, or the Environmental Information Regulations 2004 or the Environmental Information (Scotland) Regulations 2004, as applicable, comply with the restrictions on disclosure under Part 9 of the Enterprise Act 2002 where the Citizens Advice Consumer Information involved includes specified Information under section 238 (1) of that Act, and will comply with UK General Data Protection Regulations (UKGDPR) where the Citizens Advice Consumer Information includes personal data under that Act.
Requests for clients’ data
If client information referred to you from the consumer service is to be disclosed this must only be done with the expressed permission of the client. Requests for information might come from the Police or the Insolvency Service. Clients do not give the consumer service permission to refer their case to Trading Standards, it does so under the legal base of Public Task. In so doing the referral information becomes their data as well as ours. The processing of personal data should be consistent with the purpose for which it was provided. In the context of the consumer service the purpose is advice.
Joint investigations
Section 2 of the DSAs between the Trading Standards Service and Citizens Advice sets out the circumstances under which TSS can share Consumer Service Information including compliance with part 9 of the Enterprise Act 2002 and the UK GDPR.
Information not held
Where the information requested is not held by Trading Standards but might be held by the consumer service, please refer the requester to the Citizens Advice consumer service.
Clients, organisations or the Police who wish to request data can email foirequests@citizensadvice.org.uk
Data Definitions
“Specified Consumer Information” means consumer-related information which relates to the affairs of an individual during the lifetime of that individual or which relates to any business of an undertaking, corporate entity, partnership or sole trader during the existence of that undertaking, corporate entity, partnership or sole trader.
“Citizens Advice Consumer Information” means any consumer-related information (including, but not limited to, personal data (as defined in the Data Protection Act 1998 as amended) and Specified Consumer Information – extracted by, or disclosed to, the Authority from the CDW
Addendum to DSA following GDPR [ 54 kb]
Communication sent on July 18 2017
As a result of Brexit, GDPR is retained in domestic law as the UK GDPR, but the UK has the independence to keep the framework under review. The UK GDPR sits alongside an amended version of the Data Protection Act 2018. The attached amendment [ 54 kb] outlining the changes to legislation around data protection - sent on July 18 2017, remains valid.
If you have any questions please contact us using our duty email address: operations@citizensad