Memorandum of understanding between the Independent Monitoring Authority and the Welsh Government

The purpose of this Memorandum of Understanding (MoU) is to set out a framework to support the working relationship between the Independent Monitoring Authority for the Citizens’ Rights Agreements (The IMA) and The Welsh Government (WG).

The working relationship between the IMA and WG will aim to facilitate the successful monitoring and promotion by the IMA of the adequate and effective implementation and application in the UK of Part 2 of the Withdrawal Agreement (the role for monitoring the implementation and application in the EU of these agreements is the responsibility of the EU Commission).

The IMA was established by the European Union (Withdrawal Agreement) Act 2020 (EUWAA) and is under a legal duty to monitor and promote the adequate and effective implementation and application in the UK of those citizens’ rights provided for under Part 2 (see paragraphs 22(1) and 23(1) of Schedule 2 to the European Union (Withdrawal Agreement) Act 2020). In exercising its functions, the IMA must have regard to the importance of addressing general or systemic failings in the implementation or application in the UK of Part 2.

The IMA has the power to receive complaints directly from qualifying citizens and to carry out inquiries. An inquiry may make recommendations to a public authority to promote the adequate and effective implementation or application of Part 2. The IMA may also initiate or join legal proceedings for the purpose of promoting the adequate and effective implementation or application of Part 2.

Any legal proceedings initiated by the IMA would be in the form of judicial review in England, Wales and Northern Ireland, and would be in the form of an application to the supervisory jurisdiction of the Court of Session in Scotland. Legal proceedings could include where a public authority has failed to implement or apply correctly Part 2.

WG is required to comply with Part 2 and also has powers and duties contained in the EUWAA. These include:

• WG may make a request to the IMA that it carries out an inquiry in relation to a relation to relevant public authority.
• Where an inquiry relates to a complaint made by a qualifying citizen in relation to WG, WG will be invited to make representations as part of the inquiry. Any representations must be considered by the IMA.
• Where an inquiry report contains a recommendation for WG, WG must have regard to the recommendation and publish a response to the recommendation expeditiously (and in any event within 3 months),
• WG must, so far as reasonably practicable, comply with a request by the IMA to cooperate with it in the exercise of the IMA’s functions (including a request to provide information or documents).

The responsibilities and functions of the IMA are set out in Schedule 2 to EUWAA.

This MoU does not override the statutory responsibilities and functions of the IMA and WG, nor can it override the law. It is a statement of intent and is not enforceable in law. However, the IMA and WG agree to adhere to the contents and principles of this MoU as far as they are reasonably able.

The following definitions will apply throughout this document:

EEA

The European Economic Area.

EUWAA

The European Union (Withdrawal Agreement) Act 2020.

EFTA

The European Free Trade Association which consists of the EFTA States – Iceland, Liechtenstein and Norway.

EU

The European Union (not including the UK).

Part 2

Part 2 of the Withdrawal Agreement and Part 2 of the EEA EFTA Separation Agreement, so far as they apply to and in the UK (see paragraph 22(3) of Schedule 2 to the EUWAA.

Qualifying citizen

A qualifying citizen means – those citizens with rights created or arising by or under Part 2, and those citizens with rights which correspond to rights created or arising by or under Part 2, which are created or arise by or under a provision of domestic law in so far as that provision has effect in connection with Part 2. NB the remit of the IMA does not extend to the Swiss Citizens’ Rights Agreement.

The IMA and the WG are committed to ensuring the rights of qualifying citizens are respected and to working together to this end in a manner which is transparent, accountable, proportionate, balanced, consistent, and targeted.

The IMA and WG intend that their working relationship will be characterised by the following principles:

• The need to act in a way which promotes the adequate and effective implementation of citizens’ rights
• The need to maintain public and professional confidence in the 2 organisations
• Openness and transparency between the 2 organisations, as to when cooperation is and is not considered necessary or appropriate
• The need to use resources effectively and efficiently

The working relationship between the IMA and WG involves cooperation in the following areas:

• Routine information sharing
• Early consultation on relevant legislation
• Cross-referral of emerging issues
• IMA access to records and staff in order to conduct their pre-inquiry investigations and their formal inquiries
• Sharing of Pre-inquiry and inquiry reports before publication by IMA
• IMA may conduct an inquiry following on from a request form WG.

Data sharing

The Data Sharing Protocol (DSP) and individual data sharing agreements will provide specific details of any data that may be shared between IMA and WG. The DSP will provide a high-level overview of data IMA propose to share and receive from WG, however individual data sharing agreements will be drafted with WG which outlines the specific data sharing requirements.

Routine information sharing

The IMA and WG will each make available routine information arising from their activities that may assist the other in its remit. This will entail responding positively to requests for information in a timely manner.

The power for the IMA to share information is set out in Schedule 2 to the European Union (Withdrawal Agreement) Act 2020. In particular paragraph 34 of Schedule 2 enables the IMA to do anything which it thinks necessary or expedient for the purposes of, or in connection with, the exercise of its functions. For information to be shared lawfully, it must also comply with the UK General Data Protection Regulation (GDPR) and EU General Data Protection Regulation (so far as is relevant) and the Data Protection Act 2018 (DPA18). When processing ordinary personal data, it is anticipated that the IMA will usually rely on Article 6(1)(c) UK GDPR – legal obligation and Article 6(1)(e) UK GDPR – task in the public interest. For special category personal data, it is anticipated that the IMA would rely on Article 9(2)(g) – substantial public interest (Sched 1, Part 2, para 6 DPA18), although this will need to be considered on a case by case basis.

WG has an express statutory power to share information under paragraph 35 of EUWAA, which states: 

“A relevant public authority must, so far as reasonably practicable, comply with a request by the IMA to cooperate with it in the exercise of the IMA’s functions (including a request to provide information or documents).”

Where this information constitutes personal data (as defined by data protection legislation) it should be done so in line with WG’s obligations to data subjects under that legislation.

The routine sharing of information may include the following where possible or held by WG:

• WG providing the IMA with regular data returns as requested: for example, on the volume and nature of complaints received from EU and EEA EFTA citizens; the outcome of these complaints; actions taken by WG in response to such complaints
• IMA providing WG with regular data on the volume and nature of complaints received from EU and EEA EFTA citizens in regard to WG
• WG sharing with the IMA research which provides an insight into the experience of EU and EEA EFTA citizens in exercising their rights.
• The IMA sharing with WG reports on its activities and any lessons for public bodies arising from its work.

Early consultation on relevant legislation

As part of its monitoring function set out in Schedule 2 to the EUWAA, the IMA is required to keep under review the adequacy and effectiveness of the legislative framework which implements or otherwise deals with matters arising out of or related to Part 2.

In general, this monitoring will focus on legislation already passed or made. However, the IMA is open to considering and providing comment on policy, proposed consultation documents or early drafts of legislation. The aim of this function would be to encourage the early identification and resolution of any potential questions of incompatibility with Part 2.

WG may share with the IMA early drafts of legislation or details of policy for any legislative propositions. The IMA can offer to consider any new policies, however information sharing in general will be related to finalised policies.

Where WG decide to share such information, the IMA will treat the information confidentially and will not share within the IMA more than is necessary and will not share outside the IMA. Any additional confidentiality requirements may be agreed on a case by case basis.

Where WG shares information in relation to draft legislation, timescales for IMA comments will be reasonable, and the IMA will aim to provide any comments in a timely manner. Advance warning of any upcoming sharing of draft legislation would also assist in ensuring the IMA are able to provide comments within any relevant timescales.

Where WG have not shared with the IMA information regarding proposed legislation, WG will endeavour to notify the IMA of any relevant publications. Publications include consultation documents relating to legislative proposals and the legislation itself when made or introduced into Parliament.

Any comments provided by the IMA on any draft legislation is without prejudice to any future action the IMA may take in relation to the legislation once passed or made.

Any information relating to legislation being shared with the IMA should be sent to legal@ima-citizensrights.org.uk.

Cross-referral of emerging issues

Where WG becomes aware of potential systemic failings in its operation which may have compromised, or may be likely to compromise, the rights of qualifying citizens being met, then WG will notify the IMA of these failings and the actions that it is taking to address them. Where the IMA becomes aware of data or intelligence that is indicative of a potential systemic issue in the operation of WG it will notify WG of the issue and seek a response setting out what action they will take to fully investigate and address the issue.

Notwithstanding the above the IMA reserves the right to undertake their own inquiry in relation to potential and actual systemic issues if they consider it appropriate, in particular in circumstances where there may be learning for other bodies.

The IMA will look to conduct an inquiry on request from WG. The decision on whether to conduct an inquiry is for the IMA alone. The IMA may not carry out an Inquiry unless it has reasonable grounds to conclude that a failure has or is going to occur. However, it is not compelled to carry out an inquiry even when this is the case.

IMA access to records and staff

The EUWAA states that:

“A relevant public authority must, so far as reasonably practicable, comply with a request by the IMA to cooperate with it in the exercise of the IMA’s functions (including a request to provide information or documents)”

The IMA will seek to ensure that any such requests are focussed upon the information and access necessary to exercise its functions and to avoid, as far as possible, placing undue burdens upon WG.

Sharing of pre-inquiry and inquiry report before publication

The IMA will share any pre-inquiry or inquiry reports with WG before publication for the purpose of factual and accuracy checking. Where possible, the WG will be asked to provide any comments or corrections to the IMA within 14 calendar days of receipt. In addition, the IMA will share any pre-inquiry reports with the Secretary of State (Home Secretary) if it contains material relating to border security or terrorism.

The IMA will finalise the content of any pre-inquiry or inquiry report taking into consideration the comments and/or corrections proposed by the WG or SoS where received and as appropriate, prior to the publication of any final report.

IMA may conduct an inquiry following on from a request from WG

The IMA may look to conduct an inquiry following a request from WG. The decision on whether to conduct an inquiry is for the IMA alone. The IMA may not carry out an inquiry in relation to a complaint or in its own initiative unless it has reasonable grounds to believe that an inquiry may conclude that a failure has or is going to occur. However, it is not compelled to carry out an inquiry, even where this is the case.

The IMA may carry out a pre-liminary review and pre-inquiry investigations before instigating an inquiry. The IMA will provide WG with any written reports in advance of publication.

Both organisations will work to the principles of ‘no surprises’ and transparency.

The IMA and WG will make every effort to ensure that relevant content of any media engagement and/or publications that refer to the other body are shared, prior to issue, for the purposes of confirming factual accuracy.

The IMA and WG will seek to give each other adequate warning and sufficient information about any planned press releases and announcements to the public that the other may need to know of, or that refers to the other body where this is feasible.

The IMA and WG will not be obliged to give warning or share information about media publications where the other part is not mentioned.

The IMA and WG will respect the confidentiality of any documents shared in advance of publication and will not act in any way that would cause the content of those documents to be made public ahead of the planned publication date.

The IMA and WG will work to ensure that the recommendations arising from investigations and inquiries are communicated widely and are understood.

Implementing this MoU will require the IMA and WG to exchange information. All arrangements for collaboration and exchange of information set out in this MoU and any supplementary agreements will take account of, and comply with, all relevant legislation and any IMA and WG codes of practice, frameworks or other policies relating to confidential personal information.

The IMA and WG will have UK GDPR and DPIA obligations. It is acknowledged that the IMA will require information sharing from WG and as such the IMA will need to sign up to the data sharing agreements that WG will have in operation for such information to be released; and assist fully with DPIA considerations.

The IMA and WG are committed to the fair, lawful and transparent handling of data. Only those personnel that need access to and use of the personal data in order to carry out their assigned duties correctly, will be permitted access the data held. All personnel handling data should be made fully aware of their individual responsibilities and should be appropriately trained to handle such data.

The IMA and WG must comply with the following when processing personal data:

• Personal data must always be handled with care and must not be shared with any IMA or WG colleague or any third party without authorisation.
• Physical records must not be left unattended or in the view of unauthorised IMA or WG employees, agents, contractors, or other parties at any time and must not be removed from the business premises without authorisation.
• If personal data is being viewed on a computer screen and the computer in question is to be left unattended for any period, the IMA or WG user must lock the computer and screen before leaving it.
• Any and all physical copies of personal data, along with any electronic copies stored on physical, removable media, should be stored securely in a locked filing cabinet, drawer, box or similar.
• All electronic copies of personal data are to be stored securely using passwords which are changed regularly, and which do not use words or phrases that can be easily guessed or otherwise compromised.
• Personal data must not be transferred to any device personally belonging to an IMA or WG employee or transferred or uploaded to any personal file sharing, storage, communication, or equivalent service (such as a personal cloud service).
• Personal data may only be transferred to devices belonging to agents, contractors, or other parties working on behalf of the IMA or WG where the party in question has agreed to comply fully with the letter and spirit of the law (which may include demonstrating that all suitable technical and organisational measures have been taken, or by entering into a data processor contract).
• All personal data stored electronically shall be backed-up regularly and securely; and
• Under no circumstances must any passwords be written down or shared between any IMA or WG employees, agents, contractors, or other parties working on behalf of the IMA or WG, irrespective of seniority or department. If a password is forgotten, it must be reset using the applicable method.

In addition to the obligations set out above, all IMA and WG personnel involved in processing personal data are required to read and adhere to the relevant IMA and WG information security policies. IMA and WG will ensure personnel will complete the required mandatory training necessary to protect personal data.

The IMA and WG shall implement appropriate technical and organisational measures to ensure the confidentiality, integrity, availability, and resilience of personal data. Such measures shall be proportionate to the risks associated with the processing activities in question, and shall include (without limitation):

• Encryption and pseudonymisation of personal data where appropriate.
• Policies relating to information security, including the secure processing of data.
• Information security awareness training, including the secure handling of personal data.
• Business continuity and disaster recovery capabilities to ensure the ongoing availability of and access to IMA and WG personal data; and
• Upon reasonable requests demonstrate evidence of processes for regularly testing the technical and organisational measures implemented to ensure the security of the processing.

If a data incident, data breach or near miss occurs involving personal data, both the IMA and the WG designated contacts must be notified without delay, and in any event, within 24 hours of either party becoming aware of it.

Once assessment of any data incident, data breach or near miss has been completed by both parties, the next course of escalation shall be mutually agreed prior to informing the regulatory authority.

If an identified data breach is likely to result in a risk to the rights and freedoms of IMA or WG data subjects, the appropriate data protection authority must be notified of the breach without delay, and in any event, within 72 hours of the IMA or WG becoming aware of it.

Further, in the event that a personal data breach is likely to result in a high risk to the rights and freedoms of IMA or WG data subjects, all affected data subjects are to be informed of the breach directly and without undue delay.

The IMA or WG will not retain any personal data for longer than is necessary. Once IMA and WG personal data records have reached the end of their life, they will be securely destroyed in a manner that ensures that they can no longer be used or accessed.

Both the IMA and WG are subject to the Freedom of Information Act 2000 and Data Protection Act 2018. If one organisation receives a request for information that originated from the other, the receiving organisation will discuss the request with the other before responding. The ultimate decision on the release of information will remain with the organisation that has been requested to release it. The Freedom of Information Policy is available upon request.

Any disagreement between the IMA and WG regarding the application of this MOU will normally be resolved at working level. If this is not possible, it may be referred through those responsible for the management of this MoU, up to and including the Chief Executive of the IMA and the Executive Director of WG who will then jointly be responsible for ensuring a mutually satisfactory resolution.

This MoU will be reviewed periodically but at a minimum every 2 years.

Both organisations have identified a person responsible for the management of this MoU.

They will liaise as required to ensure this MoU is kept up to date, identify any emerging issues and resolve any questions that arise as to the interpretation of this MoU.

The completed MoU will be owned for the IMA by the Director of Governance and Corporate Services who will coordinate the IMA response with the Director for Operational Delivery. The first point of contact would be the Head of Corporate Services.

The completed MoU will be owned for the WG by the Director of European Transition, Constitution and Justice. The first point of contact would be Kayleigh Sweet, Head of Migration, European Transition.

Signatories

Dr Kathryn Chamberlain
Chief Executive
Independent Monitoring Authority for Citizens’ Rights

Image

Shan Morgan
Permanent Secretary
The Welsh Government

Image