Universal Credit and automated risk scores – are you affected?

As part of our investigation into automated decision making in the welfare system, we are interested in hearing from anyone who may have been subject to an unfair automated decision in their Universal Credit application.

If you would like find out how your information is being used in Universal Credit decisions, you can make a “subject access request”.

Under Section 14 of the Data Protection Act 2018, you have a legal right to be informed if your personal information is subject to automated processing that has legal or similar significant effects for you.

Risk Based Verification

Many local authorities across the UK are now using “Risk Based Verification” (RBV) – an algorithm assigning a risk score to each new Universal Credit application to determine the level of verification needed for processing that claim.

RBV is designed to assign claims into one of the three categories of low, medium or high risk, so that the low risk claims are processed more efficiently, with greater attention being given to the medium and high-risk cases.

The primary indicator of having been identified as a medium or high risk case is if you’re asked to provide more than your essential identification information.

As a general rule, the medium risk category will require further evidence such as income, rent, or capital.

The high-risk category will require these (in original form, as opposed to copies) as well as other checks ranging from credit checks to telephone interviews or house visits.

Risk based verification models are offered to local authorities by various private companies using their own list of variables and local authorities also develop their own policies for implementing RBV. However, sometimes, local authorities don’t know how this commercial software arrives at its decisions. As such, it’s difficult to form a full picture of the consistency and accuracy of these algorithmic processes.

Make a Subject Access Request in these 5 steps:

To find out how a RBV assessment about you has been made, you can contact your local authority.

In order to make a Subject Access Request, follow these steps:

1. Identify your local authority to send the request to and search online for their subject access request process. Many councils now have online forms for subject access requests. A list of all councils is available here.
2. Contact your council stating clearly that specific information that you want. We’ve included a template below that you can personalise. It is important to include:

1. Your contact details;
2. Any additional information (account numbers, etc.) that the council may use to distinguish you from others;

3. Specify the information you are requesting. You may wish to ask, for example:
   1. What risk category was assigned to me through the Risk Based Verification process?
   2. What categories of personal information about me was processed for this Risk Based Verification analysis?
   3. How did the Risk Based Verification result affect the processing of the claim and the additional personal information I was asked to provide?
4. Make sure to reference your right to a free subject access request, under the Data Protection Act 2018. Also reference the one-month deadline that the local authority has to reply to you with your personal information.
5. Retain a copy of your request, along with proof of sending/postage.

   TEMPLATE SUBJECT ACCESS REQUEST

   [YOUR FULL ADDRESS]

   [PHONE NUMBER]

   [DATE]

   [NAME OF COUNCIL]

   [ADDRESS OF COUNCIL]

   Dear Sir/Madam,

   I am writing to make a Subject Access Request for a copy of the data you hold about me, to which I am entitled under the Data Protection Act 2018.

   [YOUR FULL NAME, ADDRESS, PLUS ANY OTHER INFORMATION TO HELP IDENTIFY YOU]

   I am writing with reference to processing of my personal data for the purposes of my application for Universal Credit on (DATE OF APPLICATION).

   Please supply the data relating to: [PROVIDE SPECIFIC DETAILS OF DATA YOU REQUIRE, E.G.
   

   1. What risk category was assigned to me through the Risk Based Verification process?
   2. What categories of personal information about me were processed for this Risk Based Verification analysis?
   3. How was my personal information was sourced, other than the data obtained from me directly?
   4. How did the Risk Based Verification result affect the processing of the claim and the additional personal information I was asked to provide?
   5. Who are the recipients or categories of recipient you have or will disclose my risk category and or other personal data to?
   6. For how long will you retain my personal data or, what are your criteria for determining how long you will store it?

   If you require any further information regarding the request, please notify me as soon as possible. I look forward to receiving your response to my request within one calendar month, as per my right under the Data Protection Act 2018.

   If you are not familiar with dealing with these requests, please forward this letter to your Data Protection Officer, or a relevant staff member.

   Yours faithfully,

   [SIGNATURE]