A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP).
DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data protection impact assessment (DPIA) was completed before implementing the application into CM Appeals. This is because DWP did not consider it necessary due to the application already being used in other service areas of DWP (such as Personal Independent Payment (PIP) Appeals). However, the redaction requirements for CM appeals are different from the other service areas the application was already implemented in. As such, the redaction functionality of the application was not tested to confirm it was compatible with CM Appeals. This resulted in CM Appeals bundles being sent to individuals unredacted, resulting in the personal data of 16 data subjects being inappropriately disclosed to third parties.