This accessibility statement applies to the Submit social housing lettings and sales data (CORE) online service.
This website is run by the Department for Levelling Up, Housing and Communities (DLUHC). We want as many people as possible to be able to use this website. For example, that means you should be able to:
This website is run by the Ministry of Housing, Communities and Local Government (MHCLG). We want as many people as possible to be able to use this website. For example, that means you should be able to:
- change colours, contrast levels and fonts
- zoom in up to 300% without the text spilling off the screen
@ -27,16 +27,16 @@ We know some parts of this website are not fully accessible:
If you need information on this website in a different format like accessible PDF, large print, easy read, audio recording or braille, you can contact us by:
We’ll consider your request and get back to you in 2 working days.
You can also [contact us through the helpdesk](https://digital.dclg.gov.uk/jira/servicedesk/customer/portal/4/).
You can also [contact us through the helpdesk](https://dluhcdigital.atlassian.net/servicedesk/customer/portal/6/group/11).
### Reporting accessibility problems with this website
We’re always looking to improve the accessibility of this website. If you find any problems not listed on this page or think we’re not meeting accessibility requirements, [contact the helpdesk](https://digital.dclg.gov.uk/jira/servicedesk/customer/portal/4/).
We’re always looking to improve the accessibility of this website. If you find any problems not listed on this page or think we’re not meeting accessibility requirements, [contact the helpdesk](https://dluhcdigital.atlassian.net/servicedesk/customer/portal/6/group/11).
### Enforcement procedure
@ -44,7 +44,7 @@ The Equality and Human Rights Commission (EHRC) is responsible for enforcing the
## Technical information about this website’s accessibility
DLUHC is committed to making its website accessible, in accordance with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018.
MHCLG is committed to making its website accessible, in accordance with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018.
## [Data provider organisation] and Department for Levelling Up, Housing and Communities
## [Data provider organisation] and Ministry of Housing, Communities and Local Government
This agreement is made the [XX] day of [XX] 20[XX]
@ -8,18 +8,18 @@ This agreement is made the [XX] day of [XX] 20[XX]
and
2) The Department for Levelling Up, Housing and Communities of 2 Marsham Street, London, SW1P 4DF (“DLUHC”)
2) The Ministry of Housing, Communities and Local Government of 2 Marsham Street, London, SW1P 4DF (“MHCLG”)
### 1. Background
1.1. The Department for Levelling Up, Housing and Communities (DLUHC) collect data on social housing lettings and sales via CORE (COntinuous REcording of social housing lettings and sales) for statistical purposes. They are the data controller for all data within the CORE system.
1.1. The Ministry of Housing, Communities and Local Government (MHCLG) collect data on social housing lettings and sales via CORE (COntinuous REcording of social housing lettings and sales) for statistical purposes. They are the data controller for all data within the CORE system.
1.2. The purpose of this Agreement is to describe the duties of CORE data providers to DLUHC and to formalise the arrangement established to share the data between DLUHC and data providers. This agreement covers all data in the CORE system. This agreement does not cover data providers’ own versions of these data.
1.2. The purpose of this Agreement is to describe the duties of CORE data providers to MHCLG and to formalise the arrangement established to share the data between MHCLG and data providers. This agreement covers all data in the CORE system. This agreement does not cover data providers’ own versions of these data.
1.3. Data providers and DLUHC will each be responsible for compliance with the Data Protection legislation including the Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR).
1.3. Data providers and MHCLG will each be responsible for compliance with the Data Protection legislation including the Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR).
1.4. DLUHC shall only collect data from and share data with CORE data providers that have signed this data sharing agreement.
1.4. MHCLG shall only collect data from and share data with CORE data providers that have signed this data sharing agreement.
1.5. There are occasions when DLUHC may instruct a third party to carry out analysis on the CORE dataset on their behalf. This third party will be a data processor for DLUHC and work under a contract ensuring data protection compliance.
1.5. There are occasions when MHCLG may instruct a third party to carry out analysis on the CORE dataset on their behalf. This third party will be a data processor for MHCLG and work under a contract ensuring data protection compliance.
**It is now agreed** as follows:
@ -35,7 +35,7 @@ parties with delegated authority to handle the day-to-day matters arising from t
* “Data Protection Legislation” means the Data Protection Act 2018 and all applicable laws and regulations relating to the processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner; it includes the General Data Protection Regulation (GDPR).
* “Data” means the data supplied by the CORE data providers via the CORE system and the data that is calculated or derived via the CORE system based on that initial data;
* “GDPR” means the General Data Protection Regulation.
* “Parties” means the parties to this Agreement, namely DLUHC and the CORE data providers. CORE data providers include social housing providers and managing organisations that provide data on behalf of the social housing providers.
* “Parties” means the parties to this Agreement, namely MHCLG and the CORE data providers. CORE data providers include social housing providers and managing organisations that provide data on behalf of the social housing providers.
* “Personal Data” has the meaning in Article 4(1) of the GDPR. “Processing” has the meaning in Article 4(2) of the GDPR.
* “Request for Information” means a request for information or a request under the Freedom of Information Act 2000.
* “Special category personal data” has the meaning in Article 9(1) of the GDPR. In this Agreement:
@ -57,7 +57,7 @@ shall be construed as a reference to the statute, enactment, order, regulation o
3.2. The Parties may, by mutual consent in writing, agree to amend this agreement.
### 4. Purpose and scope of data collection via CORE
4.1. CORE (COntinuous Recording of social housing lettings and sales) is a national information source funded by the Department for Levelling Up, Housing and Communities that records information on the characteristics of Private Registered Providers’ and Local Authorities’ new social housing tenants and the homes they rent and buy.
4.1. CORE (COntinuous Recording of social housing lettings and sales) is a national information source funded by the Ministry of Housing, Communities and Local Government that records information on the characteristics of Private Registered Providers’ and Local Authorities’ new social housing tenants and the homes they rent and buy.
4.2. The CORE dataset includes information on the letting or sale, type of tenancy or sale, rents and charges, demographic information about the tenant/buyer and other information related to the tenants/buyers themselves (e.g. source of referral, route into housing, whether they are on benefits, income).
@ -66,7 +66,7 @@ shall be construed as a reference to the statute, enactment, order, regulation o
4.4. The dataset also contains information which is very sensitive, and which in some cases is “special category” personal data for the purposes of the GDPR, and if disclosed could cause considerable distress to the data subject, for example it indicates whether the social housing tenant has been in prison or probation or referred by a mental health institution; or whether anyone in the household has suffered from domestic abuse or hate crime.
### 5. Roles and responsibilities
5.1. DLUHC shall be the ‘Data controller’ for all personal data held within the CORE database.
5.1. MHCLG shall be the ‘Data controller’ for all personal data held within the CORE database.
5.2. CORE data providers are data controllers for personal data that they hold within their own systems. It is recognised that while much of the CORE data will be replicated in data collections held by CORE data providers, each organisation accepts full data controller responsibility for the data it holds.
@ -74,10 +74,10 @@ shall be construed as a reference to the statute, enactment, order, regulation o
5.4. In order to be compliant with the data protection legislation all data subjects (social housing tenants and buyers) from the CORE dataset need to be informed of how their data will be processed and used.
5.5. DLUHC has set the information that needs to be provided to new CORE data subjects in the privacy notice in Annex 1 of this agreement. CORE data providers must either share the DLUHC privacy notice with tenants or if using their own privacy notice, state within that they share the data with DLUHC and provide a link to the DLUHC privacy notice.
5.5. MHCLG has set the information that needs to be provided to new CORE data subjects in the privacy notice in Annex 1 of this agreement. CORE data providers must either share the MHCLG privacy notice with tenants or if using their own privacy notice, state within that they share the data with MHCLG and provide a link to the MHCLG privacy notice.
### 6. Legal basis for data sharing
6.1. CORE provides DLUHC with an essential evidence base for monitoring and developing government policy, in particular to assess who is accessing social housing and their associated tenancy and property details. It is necessary therefore that the personal data that forms the CORE data is processed for that purpose. The legal basis for processing this personal data is s(8)(d) of the Data Protection Act 2018 which states:
6.1. CORE provides MHCLG with an essential evidence base for monitoring and developing government policy, in particular to assess who is accessing social housing and their associated tenancy and property details. It is necessary therefore that the personal data that forms the CORE data is processed for that purpose. The legal basis for processing this personal data is s(8)(d) of the Data Protection Act 2018 which states:
> In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for— (d) the exercise of a function of the Crown, a Minister of the Crown or a government department.
@ -97,45 +97,45 @@ shall be construed as a reference to the statute, enactment, order, regulation o
8.3. Data providers will be able to access the CORE personal data they submitted right after it is validated by the system; but can only access processed data from MHCLG after MHCLG has published the data. MHCLG will make the processed data available to data providers as soon as possible via the system.
8.4.CORE team members in DLUHC and third-party data processors as developers/maintenance contractors have access to all parts of the website, including data. The handling of CORE data by contractors is covered in the contracts with these organisations. All CORE staff that have access to the data have had training on how to handle personal data.
8.4.CORE team members in MHCLG and third-party data processors as developers/maintenance contractors have access to all parts of the website, including data. The handling of CORE data by contractors is covered in the contracts with these organisations. All CORE staff that have access to the data have had training on how to handle personal data.
8.5. All work carried out by DLUHC will follow appropriate security measures and procedures to ensure the protection of the data.
8.5. All work carried out by MHCLG will follow appropriate security measures and procedures to ensure the protection of the data.
### 9. Protection of personal data
9.1. CORE data providers and DLUHC agree that they shall:
9.1. CORE data providers and MHCLG agree that they shall:
* A. Implement appropriate technical and organisational measures to protect the Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure. These measures shall ensure a level of security appropriate to the harm which might result from any unauthorised or unlawful Processing, accidental loss, destruction or damage to the Personal Data and having regard to the nature of the Personal Data which is to be protected;
* B. Take reasonable steps to ensure the reliability of any personnel who have access to the Personal Data. DLUHC and Data providers will ensure such personnel will be a limited number of analysts assigned to the data collection.
* B. Take reasonable steps to ensure the reliability of any personnel who have access to the Personal Data. MHCLG and Data providers will ensure such personnel will be a limited number of analysts assigned to the data collection.
9.2. The data providers and DLUHC shall comply at all times with the Data Protection Legislation and shall ensure that they each perform their obligations under this agreement in full compliance with the Data Protection Legislation and any other applicable law, in particular the Human Rights Act 1998 and the common law duty of confidentiality.
9.2. The data providers and MHCLG shall comply at all times with the Data Protection Legislation and shall ensure that they each perform their obligations under this agreement in full compliance with the Data Protection Legislation and any other applicable law, in particular the Human Rights Act 1998 and the common law duty of confidentiality.
9.3. CORE data providers should limit access to CORE to a small number of individuals who can be named on request. CORE access is limited to registered users only via password, but it is the responsibility of the CORE data providers to ensure that all individuals granted access to the datasets should be briefed on the legal requirements around handling and storing the Data from CORE.
### 10. Freedom of information
10.1. DLUHC acknowledges that CORE data providers that are or act on behalf of local authorities may be subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and cooperate with them to enable them to comply with their Information disclosure requirements.
10.1. MHCLG acknowledges that CORE data providers that are or act on behalf of local authorities may be subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and cooperate with them to enable them to comply with their Information disclosure requirements.
### 11. Loss or unauthorised release
11.1. CORE data providers will report to DLUHC any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified. DLUHC will report to CORE data providers any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified.
11.1. CORE data providers will report to MHCLG any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified. MHCLG will report to CORE data providers any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified.
11.2. CORE data providers and DLUHC acknowledge that any loss or unauthorised release of the Data can be treated as valid grounds for immediately terminating this agreement by DLUHC.
11.2. CORE data providers and MHCLG acknowledge that any loss or unauthorised release of the Data can be treated as valid grounds for immediately terminating this agreement by MHCLG.
### 12. Authorised representatives
12.1. CORE data providers and DLUHC will each appoint an Authorised Representative to be the primary point of contact in all day-to-day matters relating to this Agreement:
12.1. CORE data providers and MHCLG will each appoint an Authorised Representative to be the primary point of contact in all day-to-day matters relating to this Agreement:
13.1. The Data potentially allows for persons to be identified, although the risk of this happening should be minimised by the steps taken in clause 9. CORE data providers should agree to carry out a thorough check of the Data and ensure that all steps are taken within its powers to minimise the risk that any outputs lead to identification of a person by a third party.
### 14. Dispute resolution
14.1. Any disputes arising concerning this Agreement will be resolved initially by discussions between the Authorised Representatives of the CORE data providers and DLUHC.
14.1. Any disputes arising concerning this Agreement will be resolved initially by discussions between the Authorised Representatives of the CORE data providers and MHCLG.
14.2. If the dispute cannot be resolved amicably between the Authorised Representatives then the matter will be escalated to: for the CORE data providers: the Chief Executive; and for DLUHC: the Deputy Director of the Data, Analytics and Statistics Division.
14.2. If the dispute cannot be resolved amicably between the Authorised Representatives then the matter will be escalated to: for the CORE data providers: the Chief Executive; and for MHCLG: the Deputy Director of the Data, Analytics and Statistics Division.
### 15. Termination
15.1. Any Party may terminate this Agreement upon one month’s written notice to the other.
@ -152,7 +152,7 @@ signed for and on behalf of [job title of an officer with appropriate delegated
* Name:
* Title:
SIGNED for and on behalf of the deputy director of the data, analytics & statistics in the Department for Levelling Up, Housing and Communities, by:
SIGNED for and on behalf of the deputy director of the data, analytics & statistics in the Ministry of Housing, Communities and Local Government, by:
If your household enters a new social housing tenancy or purchases a social housing property, social housing providers will share your personal information with the Department for Levelling Up, Housing & Communities (DLUHC) for research and statistical purposes only.
If your household enters a new social housing tenancy or purchases a social housing property, social housing providers will share your personal information with the Ministry of Housing, Communities and Local Government (MHCLG) for research and statistical purposes only.
## How do we get this information?
The information is provided via ‘<%= t('service_name') %>’, a service funded and managed by DLUHC. It collects information on the tenants or residents, tenancy or sale, and the dwelling itself. Some of this data is personal and sensitive, so DLUHC is responsible for ensuring it’s processed in line with data protection legislation.
The information is provided via ‘<%= t('service_name') %>’, a service funded and managed by MHCLG. It collects information on the tenants or residents, tenancy or sale, and the dwelling itself. Some of this data is personal and sensitive, so MHCLG is responsible for ensuring it’s processed in line with data protection legislation.
## Why do we share this information?
@ -17,7 +17,7 @@ Information sharing will not affect your benefits, services or any treatments yo
## To find out more…
Social housing lettings and sales data is collected on DLUHC’s behalf. Data providers do not require the tenant or buyer’s consent to provide this information, but tenants and buyers have the right to know how and for what purpose data is being collected, held and used.
Social housing lettings and sales data is collected on MHCLG’s behalf. Data providers do not require the tenant or buyer’s consent to provide this information, but tenants and buyers have the right to know how and for what purpose data is being collected, held and used.
Data processing must have a lawful basis. In this case it’s necessary for a task carried out in the public interest meeting a function of the Crown, a Minister of the Crown, or government department.
@ -32,7 +32,7 @@ Collected data will be held for as long as necessary for research and statistica
* if household left last settled home because discharged from prison, a long stay hospital or other institution
* if referral source is probation or prison, youth offending or community mental health team, or health service
DLUHC publishes data annually, in aggregate form, as part of a report and complementary tables.
MHCLG publishes data annually, in aggregate form, as part of a report and complementary tables.
* For annual lettings data, visit: [https://www.gov.uk/government/collections/rents-lettings-and-tenancies](https://www.gov.uk/government/collections/rents-lettings-and-tenancies)
<p class="govuk-body">Make sure the buyer has seen <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the buyer has seen <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the buyer has seen or been given access to <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body">Make sure the buyer has seen or been given access to <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body">Make sure the buyers have seen or been given access to <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body">Make sure the buyers have seen or been given access to <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body">Make sure the buyers have seen <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the buyers have seen <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the tenant has seen <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the tenant has seen <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log.</p>
<p class="govuk-body">Make sure the lead tenant has seen or been given access to <%= govuk_link_to "the Department for Levelling Up, Housing & Communities (DLUHC) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body">Make sure the lead tenant has seen or been given access to <%= govuk_link_to "the Ministry of Housing, Communities and Local Government (MHCLG) privacy notice", privacy_notice_path, target: :_blank %> before completing this log. This is a legal requirement under data protection legislation.</p>
<p class="govuk-body-m">1.1. The Department for Levelling Up, Housing and Communities (DLUHC) collect data on social housing lettings and sales via CORE (COntinuous REcording of social housing lettings and sales) for statistical purposes. They are the data controller for all data within the CORE system.</p>
<p class="govuk-body-m">1.2. The purpose of this Agreement is to describe the duties of CORE data providers to DLUHC and to formalise the arrangement established to share the data between DLUHC and data providers. This agreement covers all data in the CORE system. This agreement does not cover data providers’ own versions of these data.</p>
<p class="govuk-body-m">1.3. Data providers and DLUHC will each be responsible for compliance with the Data Protection legislation including the Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR).</p>
<p class="govuk-body-m">1.4. DLUHC shall only collect data from and share data with CORE data providers that have signed this data sharing agreement.</p>
<p class="govuk-body-m">1.5. There are occasions when DLUHC may instruct a third party to carry out analysis on the CORE dataset on their behalf. This third party will be a data processor for DLUHC and work under a contract ensuring data protection compliance.</p>
<p class="govuk-body-m">1.1. The Ministry of Housing, Communities and Local Government (MHCLG) collect data on social housing lettings and sales via CORE (COntinuous REcording of social housing lettings and sales) for statistical purposes. They are the data controller for all data within the CORE system.</p>
<p class="govuk-body-m">1.2. The purpose of this Agreement is to describe the duties of CORE data providers to MHCLG and to formalise the arrangement established to share the data between MHCLG and data providers. This agreement covers all data in the CORE system. This agreement does not cover data providers’ own versions of these data.</p>
<p class="govuk-body-m">1.3. Data providers and MHCLG will each be responsible for compliance with the Data Protection legislation including the Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR).</p>
<p class="govuk-body-m">1.4. MHCLG shall only collect data from and share data with CORE data providers that have signed this data sharing agreement.</p>
<p class="govuk-body-m">1.5. There are occasions when MHCLG may instruct a third party to carry out analysis on the CORE dataset on their behalf. This third party will be a data processor for MHCLG and work under a contract ensuring data protection compliance.</p>
<p class="govuk-body-m"><strong>It is now agreed</strong> as follows:</p>
<h3 id="2-definitions-and-interpretation" class="govuk-heading-m">2. Definitions and interpretation</h3>
<p class="govuk-body-m">2.1. In this Agreement the following words and phrases shall have the following meanings, unless expressly stated to the contrary:</p>
@ -45,7 +45,7 @@
<li>“Data Protection Legislation” means the Data Protection Act 2018 and all applicable laws and regulations relating to the processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner; it includes the General Data Protection Regulation (GDPR).</li>
<li>“Data” means the data supplied by the CORE data providers via the CORE system and the data that is calculated or derived via the CORE system based on that initial data;</li>
<li>“GDPR” means the General Data Protection Regulation.</li>
<li>“Parties” means the parties to this Agreement, namely DLUHC and the CORE data providers. CORE data providers include social housing providers and managing organisations that provide data on behalf of the social housing providers.</li>
<li>“Parties” means the parties to this Agreement, namely MHCLG and the CORE data providers. CORE data providers include social housing providers and managing organisations that provide data on behalf of the social housing providers.</li>
<li>“Personal Data” has the meaning in Article 4(1) of the GDPR. “Processing” has the meaning in Article 4(2) of the GDPR.</li>
<li>“Request for Information” means a request for information or a request under the Freedom of Information Act 2000.</li>
<li>“Special category personal data” has the meaning in Article 9(1) of the GDPR. In this Agreement:
@ -66,18 +66,18 @@
<p class="govuk-body-m">3.1. This Agreement shall commence upon signature by the Parties and shall continue in effect whilst the CORE data collection remains live, in accordance with the requirements of this Agreement unless otherwise subject to earlier termination in accordance with Clause 15.</p>
<p class="govuk-body-m">3.2. The Parties may, by mutual consent in writing, agree to amend this agreement.</p>
<h3 id="4-purpose-and-scope-of-data-collection-via-core" class="govuk-heading-m">4. Purpose and scope of data collection via CORE</h3>
<p class="govuk-body-m">4.1. CORE (COntinuous Recording of social housing lettings and sales) is a national information source funded by the Department for Levelling Up, Housing and Communities that records information on the characteristics of Private Registered Providers’ and Local Authorities’ new social housing tenants and the homes they rent and buy.</p>
<p class="govuk-body-m">4.1. CORE (COntinuous Recording of social housing lettings and sales) is a national information source funded by the Ministry of Housing, Communities and Local Government that records information on the characteristics of Private Registered Providers’ and Local Authorities’ new social housing tenants and the homes they rent and buy.</p>
<p class="govuk-body-m">4.2. The CORE dataset includes information on the letting or sale, type of tenancy or sale, rents and charges, demographic information about the tenant/buyer and other information related to the tenants/buyers themselves (e.g. source of referral, route into housing, whether they are on benefits, income).</p>
<p class="govuk-body-m">4.3. The data in the CORE dataset is considered personal data because individuals could be easily identified. The dataset does not contain direct personal identifiers but when taken as a whole the data allows social housing tenants to be identified. This is because the dataset contains information such as UPRN (Unique Property Reference Number), which allows properties to be uniquely identified or full postcode data.</p>
<p class="govuk-body-m">4.4. The dataset also contains information which is very sensitive, and which in some cases is “special category” personal data for the purposes of the GDPR, and if disclosed could cause considerable distress to the data subject, for example it indicates whether the social housing tenant has been in prison or probation or referred by a mental health institution; or whether anyone in the household has suffered from domestic abuse or hate crime.</p>
<h3 id="5-roles-and-responsibilities" class="govuk-heading-m">5. Roles and responsibilities</h3>
<p class="govuk-body-m">5.1. DLUHC shall be the ‘Data controller’ for all personal data held within the CORE database.</p>
<p class="govuk-body-m">5.1. MHCLG shall be the ‘Data controller’ for all personal data held within the CORE database.</p>
<p class="govuk-body-m">5.2. CORE data providers are data controllers for personal data that they hold within their own systems. It is recognised that while much of the CORE data will be replicated in data collections held by CORE data providers, each organisation accepts full data controller responsibility for the data it holds.</p>
<p class="govuk-body-m">5.3. CORE data providers need to submit information for the tenancy, the tenants and the property each time there is a new social housing letting or sale. The data collection covers general needs and supported housing lettings. Since April 2012, local authorities and private registered providers report their affordable rent lettings as well as their social rent lettings and, from April 2017, rent-to-buy lettings are also included.</p>
<p class="govuk-body-m">5.4. In order to be compliant with the data protection legislation all data subjects (social housing tenants and buyers) from the CORE dataset need to be informed of how their data will be processed and used.</p>
<p class="govuk-body-m">5.5. DLUHC has set the information that needs to be provided to new CORE data subjects in the privacy notice in Annex 1 of this agreement. CORE data providers must either share the DLUHC privacy notice with tenants or if using their own privacy notice, state within that they share the data with DLUHC and provide a link to the DLUHC privacy notice.</p>
<p class="govuk-body-m">5.5. MHCLG has set the information that needs to be provided to new CORE data subjects in the privacy notice in Annex 1 of this agreement. CORE data providers must either share the MHCLG privacy notice with tenants or if using their own privacy notice, state within that they share the data with MHCLG and provide a link to the MHCLG privacy notice.</p>
<h3 id="6-legal-basis-for-data-sharing" class="govuk-heading-m">6. Legal basis for data sharing</h3>
<p class="govuk-body-m">6.1. CORE provides DLUHC with an essential evidence base for monitoring and developing government policy, in particular to assess who is accessing social housing and their associated tenancy and property details. It is necessary therefore that the personal data that forms the CORE data is processed for that purpose. The legal basis for processing this personal data is s(8)(d) of the Data Protection Act 2018 which states:</p>
<p class="govuk-body-m">6.1. CORE provides MHCLG with an essential evidence base for monitoring and developing government policy, in particular to assess who is accessing social housing and their associated tenancy and property details. It is necessary therefore that the personal data that forms the CORE data is processed for that purpose. The legal basis for processing this personal data is s(8)(d) of the Data Protection Act 2018 which states:</p>
<blockquote>
<p class="govuk-body-m">In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for— (d) the exercise of a function of the Crown, a Minister of the Crown or a government department.</p>
@ -91,35 +91,35 @@
<p class="govuk-body-m">8.1. The security of the CORE data collection system is compliant with Government security standards (https://core.communities.gov.uk/public/index.html).</p>
<p class="govuk-body-m">8.2. All parts of the CORE website where an individual’s letting/sale data is submitted or downloaded are only accessible via login and passwords. The CORE system has hierarchies in place to ensure that data providers and users can only submit, view or download data for the organisations they are associated with.</p>
<p class="govuk-body-m">8.3. Data providers will be able to access the CORE personal data they submitted right after it is validated by the system; but can only access processed data from MHCLG after MHCLG has published the data. MHCLG will make the processed data available to data providers as soon as possible via the system.</p>
<p class="govuk-body-m">8.4.CORE team members in DLUHC and third-party data processors as developers/maintenance contractors have access to all parts of the website, including data. The handling of CORE data by contractors is covered in the contracts with these organisations. All CORE staff that have access to the data have had training on how to handle personal data.</p>
<p class="govuk-body-m">8.5. All work carried out by DLUHC will follow appropriate security measures and procedures to ensure the protection of the data.</p>
<p class="govuk-body-m">8.4.CORE team members in MHCLG and third-party data processors as developers/maintenance contractors have access to all parts of the website, including data. The handling of CORE data by contractors is covered in the contracts with these organisations. All CORE staff that have access to the data have had training on how to handle personal data.</p>
<p class="govuk-body-m">8.5. All work carried out by MHCLG will follow appropriate security measures and procedures to ensure the protection of the data.</p>
<h3 id="9-protection-of-personal-data" class="govuk-heading-m">9. Protection of personal data</h3>
<p class="govuk-body-m">9.1. CORE data providers and DLUHC agree that they shall:</p>
<p class="govuk-body-m">9.1. CORE data providers and MHCLG agree that they shall:</p>
<ul class="govuk-list govuk-list--bullet">
<li>A. Implement appropriate technical and organisational measures to protect the Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure. These measures shall ensure a level of security appropriate to the harm which might result from any unauthorised or unlawful Processing, accidental loss, destruction or damage to the Personal Data and having regard to the nature of the Personal Data which is to be protected;</li>
<li>B. Take reasonable steps to ensure the reliability of any personnel who have access to the Personal Data. DLUHC and Data providers will ensure such personnel will be a limited number of analysts assigned to the data collection.</li>
<li>B. Take reasonable steps to ensure the reliability of any personnel who have access to the Personal Data. MHCLG and Data providers will ensure such personnel will be a limited number of analysts assigned to the data collection.</li>
</ul>
<p class="govuk-body-m">9.2. The data providers and DLUHC shall comply at all times with the Data Protection Legislation and shall ensure that they each perform their obligations under this agreement in full compliance with the Data Protection Legislation and any other applicable law, in particular the Human Rights Act 1998 and the common law duty of confidentiality.</p>
<p class="govuk-body-m">9.2. The data providers and MHCLG shall comply at all times with the Data Protection Legislation and shall ensure that they each perform their obligations under this agreement in full compliance with the Data Protection Legislation and any other applicable law, in particular the Human Rights Act 1998 and the common law duty of confidentiality.</p>
<p class="govuk-body-m">9.3. CORE data providers should limit access to CORE to a small number of individuals who can be named on request. CORE access is limited to registered users only via password, but it is the responsibility of the CORE data providers to ensure that all individuals granted access to the datasets should be briefed on the legal requirements around handling and storing the Data from CORE.</p>
<h3 id="10-freedom-of-information" class="govuk-heading-m">10. Freedom of information</h3>
<p class="govuk-body-m">10.1. DLUHC acknowledges that CORE data providers that are or act on behalf of local authorities may be subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and cooperate with them to enable them to comply with their Information disclosure requirements.</p>
<p class="govuk-body-m">10.1. MHCLG acknowledges that CORE data providers that are or act on behalf of local authorities may be subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and cooperate with them to enable them to comply with their Information disclosure requirements.</p>
<h3 id="11-loss-or-unauthorised-release" class="govuk-heading-m">11. Loss or unauthorised release</h3>
<p class="govuk-body-m">11.1. CORE data providers will report to DLUHC any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified. DLUHC will report to CORE data providers any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified.</p>
<p class="govuk-body-m">11.2. CORE data providers and DLUHC acknowledge that any loss or unauthorised release of the Data can be treated as valid grounds for immediately terminating this agreement by DLUHC.</p>
<p class="govuk-body-m">11.1. CORE data providers will report to MHCLG any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified. MHCLG will report to CORE data providers any loss or unauthorised release of the Data as soon as possible and no later than 24 hours after the loss or unauthorised release is identified.</p>
<p class="govuk-body-m">11.2. CORE data providers and MHCLG acknowledge that any loss or unauthorised release of the Data can be treated as valid grounds for immediately terminating this agreement by MHCLG.</p>
<p class="govuk-body-m">12.1. CORE data providers and DLUHC will each appoint an Authorised Representative to be the primary point of contact in all day-to-day matters relating to this Agreement:</p>
<p class="govuk-body-m">12.1. CORE data providers and MHCLG will each appoint an Authorised Representative to be the primary point of contact in all day-to-day matters relating to this Agreement:</p>
<h3 id="13-products-and-publications" class="govuk-heading-m">13. Products and publications</h3>
<p class="govuk-body-m">13.1. The Data potentially allows for persons to be identified, although the risk of this happening should be minimised by the steps taken in clause 9. CORE data providers should agree to carry out a thorough check of the Data and ensure that all steps are taken within its powers to minimise the risk that any outputs lead to identification of a person by a third party.</p>
<p class="govuk-body-m">14.1. Any disputes arising concerning this Agreement will be resolved initially by discussions between the Authorised Representatives of the CORE data providers and DLUHC.</p>
<p class="govuk-body-m">14.2. If the dispute cannot be resolved amicably between the Authorised Representatives then the matter will be escalated to: for the CORE data providers: the Chief Executive; and for DLUHC: the Deputy Director of the Data, Analytics and Statistics Division.</p>
<p class="govuk-body-m">14.1. Any disputes arising concerning this Agreement will be resolved initially by discussions between the Authorised Representatives of the CORE data providers and MHCLG.</p>
<p class="govuk-body-m">14.2. If the dispute cannot be resolved amicably between the Authorised Representatives then the matter will be escalated to: for the CORE data providers: the Chief Executive; and for MHCLG: the Deputy Director of the Data, Analytics and Statistics Division.</p>
<p class="govuk-body-m">SIGNED for and on behalf of the deputy director of the data, analytics & statistics in the Department for Levelling Up, Housing and Communities, by:</p>
<p class="govuk-body-m">SIGNED for and on behalf of the deputy director of the data, analytics & statistics in the Ministry of Housing, Communities and Local Government, by:</p>
<p class="govuk-body">Use this service to submit social housing lettings and sales data to the Department for Levelling Up, Housing and Communities (DLUHC).</p>
<p class="govuk-body">Use this service to submit social housing lettings and sales data to the Ministry of Housing, Communities and Local Government (MHCLG).</p>
<p class="govuk-body">We’ll ask you questions about a letting or sale, like details about the household or property. Your answers will create a log that you can submit directly to us.</p>
<p class="govuk-body">Your organisation can also set up and manage user accounts.</p>
<p class="govuk-body">The data will be used to update the national record for social housing. It will also help to inform policy about the cost of social housing and what type of housing needs to be built.</p>
@ -21,7 +21,7 @@
<h2 class="govuk-heading-m">Before you start</h2>
<p class="govuk-body">Use your account details to sign in.</p>
<p class="govuk-body">If you need to set up a new account, speak to your organisation’s CORE data coordinator. If you don’t know who that is, <%= govuk_link_to("contact the helpdesk", GlobalConstants::HELPDESK_URL) %>.</p>
<p class="govuk-body">You can <%= govuk_mail_to("dluhc.digital-services@levellingup.gov.uk", "request an account", subject: "CORE: Request a new account") %> if your organisation doesn’t have one.</p>
<p class="govuk-body">You can <%= govuk_mail_to("mhclg.digital-services@communities.gov.uk", "request an account", subject: "CORE: Request a new account") %> if your organisation doesn’t have one.</p>
<p class="govuk-body"><strong><%= govuk_link_to guidance_path do %>Guidance for submitting social housing lettings and sales data (CORE)<% end %></strong></p>
@ -13,7 +13,7 @@ Production infrastructure sizing will be decided at a later time and once our ac
The reasoning for this is:
- Department policy is to use GOV.UK PaaS whenever possible
- DLUHC does not have a lot of internal dev ops skills/capacity so by leveraging GOV.UK PaaS we can leverage having most of the monitoring, running, scaling and security already provided.
- MHCLG does not have a lot of internal dev ops skills/capacity so by leveraging GOV.UK PaaS we can leverage having most of the monitoring, running, scaling and security already provided.
- We get a simpler infrastructure setup than the AWS setup we currently have
- All of the infrastructure we currently require is well supported on GOV.UK PaaS
## Why do we have 2 user classes, `AdminUser` and `User`?
This is modelling a real life split. `AdminUsers` are internal DLUHC users or help desk employees. While `Users` are external users working at data providing organisations. So local authority/housing association’s "admin" users, i.e. Data Co-ordinators are a type of the User class. They have the ability to add or remove other users to or from their organisation, and to update their organisation details etc, but only through the designed UI. They do not get direct access to ActiveAdmin.
This is modelling a real life split. `AdminUsers` are internal MHCLG users or help desk employees. While `Users` are external users working at data providing organisations. So local authority/housing association’s "admin" users, i.e. Data Co-ordinators are a type of the User class. They have the ability to add or remove other users to or from their organisation, and to update their organisation details etc, but only through the designed UI. They do not get direct access to ActiveAdmin.
AdminUsers on the other hand get direct access to ActiveAdmin. From there they can download entire datasets (via CSV, XML, JSON), view any log from any organisation, and add or remove users of any type including other Admin users. This means TDA will likely also require more stringent authentication for them using MFA (which users will likely not require). So the class split also helps there.
GOV.UK PaaS is being decomissioned at the end of this year and by 23 December 2023 all services hosted on GOV.UK PaaS will need to have migrated to an alternate hosting platform.
Like other DLUHC services, we are moving our service directly to DLUHC-owned AWS infrastructure.
Like other MHCLG services, we are moving our service directly to MHCLG-owned AWS infrastructure.
All lettings and and sales of social housing in England need to be logged with the Department for levelling up, housing and communities (DLUHC). This is done by data providing organisations: Local Authorities and Private Registered Providers (PRPs, i.e. housing associations).
All lettings and and sales of social housing in England need to be logged with the Ministry of Housing, Communities and Local Government (MHCLG). This is done by data providing organisations: Local Authorities and Private Registered Providers (PRPs, i.e. housing associations).
Data is collected via a form that runs on an annual data collection window basis. Form changes are made annually to add new questions, remove any that are no longer needed, or adjust wording or answer options etc.
Each data collection window runs from 1 April to 1 April the following year (plus an extra 3 months to allow for any late submissions). This means that between April and June, 2 collection windows are open simultaneously and logs can be submitted for either.
ADD (Analytics & Data Directorate) statisticians are the other primary users of the service. The data collected is transferred to DLUHCs consolidated data store (CDS) via nightly XML exports to an S3 bucket. CDS ingests and transforms this data, ultimately storing it in a MS SQL database and exposing it to analysts and statisticians via Amazon Workspaces.
ADD (Analytics & Data Directorate) statisticians are the other primary users of the service. The data collected is transferred to MHCLGs consolidated data store (CDS) via nightly XML exports to an S3 bucket. CDS ingests and transforms this data, ultimately storing it in a MS SQL database and exposing it to analysts and statisticians via Amazon Workspaces.
@ -14,7 +14,7 @@ From CloudWatch, navigate to the desired log group (e.g. for the app task runnin
Alternatively, you can also navigate to a specific AWS service / resource in question (e.g. ECS tasks), selecting the instance of interest (e.g. a specific ECS task), and finding the “logs” tab (or similar) to view the log “events”.
### Sentry
To access Sentry, ensure you have been added to the DLUHC account.
To access Sentry, ensure you have been added to the MHCLG account.
Generally error logs in Sentry will also be present somewhere in the CloudWatch logs, but they will be easier to assess here (e.g. number of occurrences over a time period). The logs in Sentry are created by the application when it makes Rails.logger.error calls.
@ -50,7 +50,7 @@ RSpec.describe Form::Lettings::Questions::Declaration, type: :model do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"declaration"=>{"value"=>"The tenant has seen the DLUHC privacy notice"},
"declaration"=>{"value"=>"The tenant has seen the MHCLG privacy notice"},
})
end
@ -63,7 +63,7 @@ RSpec.describe Form::Lettings::Questions::Declaration, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show the DLUHC privacy notice to the tenant before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show the MHCLG privacy notice to the tenant before you can submit this log.")
end
end
@ -74,7 +74,7 @@ RSpec.describe Form::Lettings::Questions::Declaration, type: :model do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"declaration"=>{"value"=>"The tenant has seen or been given access to the DLUHC privacy notice"},
"declaration"=>{"value"=>"The tenant has seen or been given access to the MHCLG privacy notice"},
})
end
@ -87,7 +87,7 @@ RSpec.describe Form::Lettings::Questions::Declaration, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show or give access to the DLUHC privacy notice to the tenant before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show or give access to the MHCLG privacy notice to the tenant before you can submit this log.")
@ -51,7 +51,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
context"and there is a single buyer"do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"privacynotice"=>{"value"=>"The buyer has seen the DLUHC privacy notice"},
"privacynotice"=>{"value"=>"The buyer has seen the MHCLG privacy notice"},
})
end
@ -60,7 +60,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show the DLUHC privacy notice to the buyer before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show the MHCLG privacy notice to the buyer before you can submit this log.")
end
end
@ -69,7 +69,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"privacynotice"=>{"value"=>"The buyers have seen the DLUHC privacy notice"},
"privacynotice"=>{"value"=>"The buyers have seen the MHCLG privacy notice"},
})
end
@ -78,7 +78,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show the DLUHC privacy notice to the buyers before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show the MHCLG privacy notice to the buyers before you can submit this log.")
end
end
end
@ -91,7 +91,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
context"and there is a single buyer"do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"privacynotice"=>{"value"=>"The buyer has seen or been given access to the DLUHC privacy notice"},
"privacynotice"=>{"value"=>"The buyer has seen or been given access to the MHCLG privacy notice"},
})
end
@ -100,7 +100,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show or give access to the DLUHC privacy notice to the buyer before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show or give access to the MHCLG privacy notice to the buyer before you can submit this log.")
end
end
@ -109,7 +109,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
it"has the correct answer_options"do
expect(question.answer_options).toeq({
"privacynotice"=>{"value"=>"The buyers have seen or been given access to the DLUHC privacy notice"},
"privacynotice"=>{"value"=>"The buyers have seen or been given access to the MHCLG privacy notice"},
})
end
@ -118,7 +118,7 @@ RSpec.describe Form::Sales::Questions::PrivacyNotice, type: :model do
end
it"returns correct unanswered_error_message"do
expect(question.unanswered_error_message).toeq("You must show or give access to the DLUHC privacy notice to the buyers before you can submit this log.")
expect(question.unanswered_error_message).toeq("You must show or give access to the MHCLG privacy notice to the buyers before you can submit this log.")
@ -1513,7 +1513,7 @@ RSpec.describe OrganisationsController, type: :request do
end
context"when search results require pagination"do
let(:search_param){"DLUHC"}
let(:search_param){"MHCLG"}
it"has search and pagination in the title"do
expect(page).tohave_title("Organisations (27 organisations matching ‘#{search_param}’) (page 1 of 2) - Submit social housing lettings and sales data (CORE) - GOV.UK")
Manny Dinssa
2 years ago