Request

‘1) Who is responsible for making sure the information provided to NHS Pensions by an NHS Employer about a Pensioner is accurate? 2) Who is responsible for maintaining the integrity of Pensioner information throughout the collection process? Is it the NHS employer or NHS Pensions as the administrator? Basically, who is responsible for the end-to-end process? 3) When Pensioner information is collected by an employer and passed to NHS Pensions, which of these entities are classed as Data Controllers and which are classed as Data Processors in this process? 4) When Pensioner information is collected by NHS employers to be passed to NHS Pensions who is responsible for undertaking a DPIA in relation to making sure the information is collected and recorded accurately? 5) Do NHS Pensions keep records of who accesses a Pensioners information, for what reason and any changes that are made?’

On 20 June 2022 you clarified your request as follows:

My question is regarding the information an NHS employee has to provide to their NHS employer when applying for retirement and that information then being passed to NHS Pensions.

In particular I am asking about the employees intention to return to work after taking retirement. I believe that this would be classed as Personal Information when linked with name, address, NI number, DOB etc

Please let me know if you need further clarification.

I have provided my original questions again below:

1) Who is responsible for making sure the information provided to NHS Pensions by an NHS Employer about a Pensioner is accurate?

2) Who is responsible for maintaining the integrity of Pensioner information throughout the collection process? Is it the NHS employer or NHS Pensions as the administrator? Basically, who is responsible for the end-to-end process?

3) When Pensioner information is collected by an employer and passed to NHS Pensions, which of these entities are classed as Data Controllers and which are classed as Data Processors in this process?

4) When Pensioner information is collected by NHS employers to be passed to NHS Pensions who is responsible for undertaking a DPIA in relation to making sure the information is collected and recorded accurately?

5) Do NHS Pensions keep records of who accesses a Pensioners information, for what reason and any changes that are made?’

Response

Please see the below responses to each question in turn.

Question 1 – Who is responsible for making sure the information provided to NHS Pensions by an NHS Employer about a Pensioner is accurate?

This is the responsibility of the employer submitting the information. They should ensure data is submitted both timely and accurately.

Question 2 – Who is responsible for maintaining the integrity of Pensioner information throughout the collection process? Is it the NHS employer or NHS Pensions as the administrator? Basically, who is responsible for the end-to-end process?

As above but expanding that to Pensioners submitting changes. So that submitting data and once received and successfully updated NHS Pensions will be responsible for maintaining the member record throughout the time the pension is in payment.

Question 3 – When Pensioner information is collected by an employer and passed to NHS Pensions, which of these entities are classed as Data Controllers and which are classed as Data Processors in this process?

The NHSBSA (which includes NHS Pensions) and Employing Authorities (EAs) are joint controllers in relation to processing pension member (including pensioners) data. EAs are responsible for the accuracy of data they share with NHS Pensions. As there are thousands of EAs, it is not practical to check or ensure the accuracy of the data it receives, relating to millions of NHS Pensions members. Any further processing of pension member data carried out by NHS Pensions must ensure that the accuracy of that data is ensured, so far as it is in the NHSBSA’s ability to do so.

Question 4 – When Pensioner information is collected by NHS employers to be passed to NHS Pensions who is responsible for undertaking a DPIA in relation to making sure the information is collected and recorded accurately?

Both EAs and NHSBSA are responsible for conducting a DPIA, as required by the law, in relation to information which they process. Information which NHS Pensions receives can only be as accurate as it was at the time it was received from EAs. EAs must ensure any inaccuracies in the data they share is rectified in the event they discover an error, by notifying the NHSBSA of any inaccuracies. The NHSBSA must ensure that any further processing of member data is done in a way which maintains that level of accuracy. Pensioners and deferred members (ones which have opted out of the scheme) are responsible for contacting NHS Pensions to update their information as necessary, such as in the event of a change of address, once employers no longer routinely provide updates to their information.

NHS Pensions does provide guidance to employers to help prevent and correct errors. Please see the below web link:

https://www.nhsbsa.nhs.uk/sites/default/files/2020-07/POL%20Guide-34.%20Error%20Handling-20200715-%28V11%29.pdf

Lastly, although it does not discuss accuracy, the below web link sets out the GDPR roles and responsibilities of the NHSBSA and EAs

https://www.nhsbsa.nhs.uk/sites/default/files/2019-01/NHS%20Pensions%2C%20NHS%20Injury%20Benefits%20and%20EA%20GDPR%20Roles%20and%20Responsibilities-20190125-%28V1%29.pdf

Question 5 – Do NHS Pensions keep records of who accesses a Pensioners information, for what reason and any changes that are made?

NHS Pensions has a full audit trail when changes to a member’s record is made. It does not hold records of when a record may have been accessed and no changes are made. However, for security reasons internal staff are only given access to the pensions processing system Compendia if it is needed as part of their role.

If you have any queries regarding the data provided, or if you plan on publishing the data please contact nhsbsa.foirequests@nhs.net ensuring you quote the above reference. This is important to ensure that the figures are not misunderstood or misrepresented.

If you plan on producing a press or broadcast story based upon the data please contact nhsbsa.communicationsteam@nhs.net. This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at: http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2022” This information is licenced under the terms of the Open Government Licence:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.