Independent report

Consent in Universal Credit

Published 8 September 2020

1. Introduction

During our 2018 consultation on the proposals for Universal Credit (UC) managed migration, we received a number of responses expressing concern about how the explicit consent model works under UC.

Respondents were also concerned that the Department’s implicit consent procedure, used for other benefits, does not apply to UC. What does this mean and why does it matter?

Having someone to represent them in their dealings with the Department – whether a friend, family member or voluntary sector worker – is essential for many claimants. Some would simply not be able to navigate their way around an often complex benefit landscape without that support.

At the same time, the Department has a clear responsibility to safeguard the integrity of an individual’s personal information. This requires a claimant’s consent for any third party to act on their behalf.

The Universal Credit Full Service is the Department’s first fully digital system, and it has an important responsibility to safeguard the data held to ensure it is not accessed inappropriately, for example by unscrupulous people for criminal intent.

So why are there concerns about the consent procedures for UC – surely that is precisely what is needed if the Department is to safeguard personal data?

Well, one issue is that the Department now requires ‘explicit’ consent to be given repeatedly. It is no longer enough to say once that you would like a son or daughter to deal with these matters on your behalf, you have to provide information on what specific support needed. The guidance available on the GOV.UK website explains that:

Explicit consent does not last forever, it usually lasts until either the specific request is completed or the end of the assessment period, after the one in which the consent was given.

Explicit consent can be provided in writing, on the telephone or face-to-face at any time during a Universal Credit claim.

The requirements set out on GOV.UK make clear that claimants must:

• give consent for your personal information to be shared with the representative
• outline what information you want to be disclosed
• explain why the information is needed
• explain the representative’s relationship to you where the representative is your family member or friend
• give the name of the representative and the organisation, including the branch where applicable. If you cannot provide the name of the representative, you need to be as specific as possible, for example you should provide the representative’s job role or team name within the organisation

Many of the organisations that responded to our consultation raised concerns that the explicit consent model used in UC was not working well for organisations and the claimants they are trying to support.

They explained that it hinders their ability to help, causes distress for some claimants with mental health problems who rely on the support of an advocate and creates delays. We were told that the consent process causes particular challenges for corporate appointees who were tasked with making and supporting online claims for multiple claimants.

These challenges would be exacerbated during periods when volumes were higher which could, for example, occur during the managed migration process.

There was, therefore, strong support for the ‘implicit’ consent arrangements that exist within legacy benefits to be replicated within Universal Credit in order to deal with urgent issues and those involving particularly vulnerable claimants.

The evidence presented to the committee during its public consultation was compelling and persuasive, and led to our recommendation that:

… the concept of ‘implicit consent’ which applies in legacy benefits should be extended to Universal Credit, but with appropriate safeguards in place to ensure that personal data held by the Department are not compromised. This committee would be willing to work with the Department and other interested parties to identify what those safeguards should be.

2. How did DWP respond?

The Department’s response understandably emphasised the importance of safeguarding data but, in acknowledgement of the concerns that had been raised, also agreed to explore whether the ‘explicit’ consent process could be enhanced in an attempt to overcome the lack of flexibility that had been highlighted by stakeholders.

The Department said that it intended to take this work forward in collaboration with this Committee:

Because Universal Credit is delivered on a different platform to legacy benefits, and it replaces six major benefits, the approach taken to consent needs to be different. The amount of personal data available on Universal Credit is far greater than the individual legacy systems, meaning that any data breach has far reaching consequences for claimants. We therefore need to balance consent against this risk.

Where consent is needed it can be quickly given in different ways. For example, claimants only need to put a note in their journal to give consent, this is a far simpler and more straightforward process than in legacy systems. Once consent is given, advisers will work with the claimant’s representatives.

A number of organisations have raised concerns as to whether the implicit consent rules are sufficiently flexible. We therefore, agree to explore options for improving the process of explicit consent in relation to Universal Credit in collaboration with the Social Security Advisory Committee to consider how current practices could be enhanced and to publish a report on our joint conclusions.

3. Developing a prototype

In taking forward its commitment to examine options for improving the process, the Department has been developing a prototype for arranging consent for UC claimants who have an online journal.

Once signed in, claimants would be presented with a “give consent” tab, which would lead to an information page. The claimant would be prompted to provide information about:

• the person or organisation helping the claimant
• why help was needed
• the areas where help was sought eg, earnings, health conditions, housing payments, sanctions or reduced payments etc

They would then be asked to clarify when this help would be no longer be needed. The end point could be a specified date or, if more practical, an event (for example when the next payment is received or when an appeal has been resolved etc).

It would also be possible to subsequently extend that date. The Department considered it unlikely that many people would need to be given consent for an indefinite period, and in cases where ongoing long-term support was necessary there may be other more appropriate options, for example becoming an appointee.

So, for example, a claimant could choose to allow a designated person who is acting on their behalf to see details of their earnings, rent and childcare payments until their next payment was received, but did not want them to be able to access any information about their health conditions.

Once the information had been provided, the claimant would be given a summary of what they had entered and an opportunity to correct anything. Once the claimant had confirmed that the information was correct, the system would generate a unique code which would be shared with the person or organisation providing support so that they could access relevant parts of the claimants account within the relevant period.

Access would automatically cease at the point the end date or event had been reached unless the claimant actively decided to extend it.

4. Stakeholder engagement

To ensure our contribution to this work is well-informed by experiences of those who provide support to claimants and who are directly impacted by this issue, we convened a workshop with stakeholders and DWP officials to explore issues around consent for UC claimants.

Putting aside the concepts of implicit and explicit consent – committee members were keen to understand more about:

• the claimants who rely on this type of support
• the different ways in which that support is delivered
• the reasons advisers need to contact DWP
• what aspects of the current consent arrangements are working well or falling short
• what the ideal consent model would look like from an adviser perspective

We heard how organisations who support claimants do so in different ways – some support people via face to face appointments whereas others offer telephone advice.

Some of these approaches led to a greater degree of challenge in obtaining consent – especially if the claimant does not have digital skills needed.

Stakeholders told us that in order to provide effective support to claimants, they need a consent model that allows them to:

• obtain specific information about a claim and/or clarify details (for example, why a claim has been suspended, why a payment has not been made etc) so that they can understand the extent of the problem and help the claimant resolve it. This is especially important when there is a crisis or urgent need for help.

• help claimants with specific actions – for example asking for a mandatory reconsideration or making representations on an appeal.

• disclose information to DWP – for example safeguarding issues.

We invited DWP officials to attend the workshop as they were also keen to hear first-hand about the way in which support is provided to claimants, as well as having an opportunity to present their early prototype to stakeholders in order that they could receive constructive feedback directly from those who would be using it.

The feedback from stakeholders on the prototype was generally positive; they considered the emerging model to be intuitive and easy to use, and there was a consensus that this represented an improvement to the current offering.

Nonetheless they offered a number of constructive suggestions on how it might be further enhanced, for example allocating a single unique access code to advice organisations (rather than named caseworkers) as more than one adviser within that set up may be dealing with individual cases and permitting indefinite consent with occasional prompts from the system requiring claimants to confirm that they were still happy with that arrangement.

They also highlighted the need for any process to be replicated for those who cannot transact digitally.

We subsequently put the Department in touch with a range of appropriate stakeholders so that the Department could continue to engage directly with people who would be using the model to provide essential support to people in vulnerable situations.

However, stakeholders felt strongly that even an enhanced explicit consent process would not address all of the problems faced by those supporting UC claimants in crisis situations and that it should be supplemented with some form of implicit consent.

5. Next steps

We are pleased that the Department continues to develop and refine its prototype in a positive collaboration with end users. We also recognise and commend the Department for the remarkable work that it has been undertaking to respond at pace to a changing landscape, including a significant set of policy and operational challenges, as a result of the outbreak of the Coronavirus.

However, the circumstances that many claimants currently find themselves in as a consequence of COVID-19 simply serves to underline the importance of having effective consent arrangements in place.

It is therefore essential to ensure that the final model works effectively – both for those who need support and those who provide it - and enables the right support to be provided to claimants in the right way at the right time.

However, given the clear support among stakeholders for the implicit consent model that exists within legacy benefits, we recommend that the Department goes further still by:

(i) undertaking further work to ensure there is a comprehensive understanding of how the implicit consent model is currently used, what sort of information advisers ask for under it and the degree to which whether it is used differently by the advice sector and individuals (e.g. family and friends) and what the risks are for each; and subsequently

(ii) running a small number of pilots - in a controlled and careful way – to test its assumptions around data concerns associated with retaining this model which evidently works well for many who use it

Following discussions with stakeholders and the Department, the committee remains open-minded about the outcome, but feels that the above issues need to be explored before reaching a final view.

If the model that exists for legacy benefits can be safely imported into Universal Credit, stakeholders have provided a persuasive case to do so. However, if that would compromise the ability of the Department to safeguard personal data, it would important to consider how the Department’s proposals can be adjusted to retain some of aspects of the current arrangements that work well for many users.

We will keep in close contact with DWP as this work progresses and stand ready to provide further support as appropriate.