Just as a follow up a question was asked in the HoL about this subject and I have therefore copied it here for information purposes.
http://www.theyworkforyou.com/wrans/?id ... %22#g467.6" onclick="window.open(this.href);return false;
Government Departments: Mail Opening
House of Lords
Next answer »« Previous answer
The Countess of Mar (Crossbench)
To ask Her Majesty's Government in what circumstances Royal Mail staff are required to open correspondence to the Department for Work and Pensions from claimants containing confidential medical information, as reported in the Independent on 8 September 2012; what special qualifications Royal Mail staff have to perform this function; whether claimants are aware of this practice; and how frequently the Royal Mail service is used.
Hansard source (Citation: HL Deb, 17 October 2012, c467W)
Lord Freud (Parliamentary Under Secretary of State (Welfare Reform), Work and Pensions; Conservative)
Department for Work and Pensions post opening is performed as part of a contract for office services that was awarded to Balfour Beatty Workplace (BBW), which went live on 1 March 2007. The contract was let in line with European Union procurement legislation and offers significant cost savings and efficiencies over the previous arrangements.
Under the contract, Balfour Beatty Workplace's service delivery model uses Royal Mail as a subcontractor to open DWP and ATOS post at Royal Mail opening units and to deliver opened and pre-sorted post to offices.
Both Royal Mail and Balfour Beatty Workplace are bound by confidentiality agreements, including the Official Secrets Act, which include the specification that all mail will be processed in adherence to security requirements specified by DWP security specialists. These security requirements are incorporated within the agreed contract documents that all Royal Mail and Balfour Beatty Workplace employees have signed. Processes are also in place to pursue disciplinary proceedings against any employees from breaching these obligations. Balfour Beatty Workplace, as the lead contractor, audit the Royal Mail to ensure compliance and DWP Security have the right to further audit both Balfour Beatty Workplace and the Royal Mail.
As you will be aware, the Data Protection Act 1998-the Act-states that individual's have a right to know the extent to which organisations process their personal data. We publish a guidance note on DWP's internet site
http://www.dwp.gov.uk" onclick="window.open(this.href);return false; called "DWP-your-personal-information", which describes how we will use personal data. Section 7(2) of the Act sets out that organisation such as DWP must provide information to the claimant on how we process and handle their personal information. We are obliged to supply this information only when asked for it in writing and we are allowed to charge a fee for this information, although our usual policy is not to charge for this. As such we have not breached this provision of the Act through not specifically informing the claimant that our post-opening operations are contracted out to a private company when the claimant originally provided us with information.
The Act also sets out eight data protection principles that DWP must comply with in order to process information lawfully. DWP complies at all times with the data protection principles.
In order to operate effectively and efficiently, the Act allows organisations such as the DWP to make arrangements with third parties such as the Royal Mail to process personal information on its behalf. To do this, the Act requires an organisation to comply with the seventh principle of data protection, which stipulates:
"Appropriate technical and organisational measures shall be taken against the unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data".
To comply with the seventh principle, the DWP has put in place robust contractual arrangements so that any processing of personal data is performed in accordance with the Act and on the DWP's instructions. In addition the security measures in place are more than adequate to ensure that we have in place "appropriate technical measures" to prevent unlawful processing of personal data.
The DWP is lawfully entitled to process personal information without prior consent and uses trusted contractors to ensure that it has complied with the relevant provisions of the Act.
I trust this is a helpful clarification of the issues you raised.
