Receiving the personal data of refugees

Once approved as a sponsor, you will be given the personal data of refugees you will potentially support. It’s essential this information is managed properly.

As a Community Sponsor, you will receive personal data of the refugees that are allocated to your group. This will help you decide whether you can meet the needs of the family that is allocated to you. The information you will receive is extremely confidential and will contain the ages, genders, biographic information and medical details of the refugees you will be supporting. 

When you are considering the allocation of the refugee family, you and your Local Authority will be given access to:

• Resettlement Registration Form – this contains all of the biographical data of each family member. Adults are interviewed separately and they may disclose information they have not shared with their spouse or others in the family. The family members will never see this form.
• Migrant Health Assessment – an IOM doctor in the host country will carry out a full medical assessment for each family member. The form will be completed in English. Some groups have shown this to the GP surgery or had to share this with their Health Board or Clinical Commissioning Group when deciding whether to accept a family, and others have found that GPs will not accept medical information from anyone except the patient. From January 2021, each family member will have a sealed copy of their MHA on arrival, and they will have been briefed to give these to the GP directly. 
• You may receive additional documentation related to the case you are considering.

Given the sensitivity of this data, access to this information should be restricted within your group. It will almost certainly be inappropriate and unnecessary for every member of your group to see this information. The conditions for the use, transfer and holding of this data are clearly set out in Schedule 4 of the Community Sponsorship Agreement.  You can see a draft of this schedule from page 23 of the Sponsor Agreement on the gov.uk website.  

You will receive the family’s personal information via MOVEit – the government’s online portal for secure information.  There are, understandably, restrictions placed on who can access the portal and how the portal can be accessed. It can take some time to set up user accounts and, in order to avoid any delays in the allocation process, you will be asked to complete a MOVEit application form for your group relatively soon after you have submitted your application.  Guidance for accessing MOVEit will be given to your group at the appropriate stage of the sponsorship approval process.

Who should access MOVEit?

Your Lead Sponsor (this could be the organisation with whom you are working or the lead member of your group) will need to complete the MOVEit application form. They will be asked to detail the Local Authority area in which your group will operate and to give the details of a maximum of two representatives from your group who will be authorised to access the MOVEit portal. The Lead Sponsor will not be able to name more than two representatives. If the Lead Sponsor wishes to have access to the portal, then they will need to name themselves as one of the two representatives. Your Local Authority (who will already have access to MOVEit) will also receive this data.

How do I access MOVEit?

Given the sensitive information contained in the documents you will receive, there are restrictions as to how you can access the MOVEit portal. The portal is online, but you cannot access it using a personal device if this device is being used for any other purposes. Any documents printed from MOVEit must be shredded as soon as they have been used for the intended purpose. Hard copies must not be kept for longer than they are needed and these should be kept securely.

How often should I access MOVEit?

You will need to log in to MOVEit regularly to ensure that your account stays live. Many groups have told us that they have a monthly diary reminder to log in to keep their account live. Either you or your Lead Sponsor will need to access MOVEit to participate in the evaluation with the Home Office during the initial 12 months of arrival after the family arrive.

The Draft Sponsor Agreement as of April 2019 states that sponsors must not download data from MOVEit onto unsecure or personal systems, networks, computers etc.

The following data security measures must be in place as a minimum:

• Personal devices must not be used for handling, storing or processing the Authority’s information.
• All devices are protected by a user login that is only used by one authorised individual.
• An Anti-Virus product is installed and is kept up to date.
• The operating system and all software is updated with all relevant security patches at least once a month.
• Internet use is limited to sites considered acceptable to the business use of the device.
• USB devices are only used if from a trusted source and are scanned with Anti-Virus when inserted.
• Wherever possible, documents are password protected or stored within a password protected Zip or RAR archive13.
• When downloading files, the Sponsor must be connected to secure Wi-Fi (if using a Wi-Fi connection).
• If the device is used in a public area, then the user must be aware of their surroundings and vigilant about people observing the screen or reading papers over the shoulder.

We know that fulfilling these requirements can prove a challenge for group members, and we have asked other sponsor groups what measures they have taken to successfully meet these obligations.

• Where groups are working with a charity as a Lead Sponsor, they have visited the office of that organisation to access a device that fulfils these requirements.
• Some groups have arranged with their contacts at their Local Authority to access the information on a computer there.
• If, as part of your application and empowerment approach, your group has made the decision to purchase a computer/laptop for a resettled family in order to allow them to access digital services once they arrive in the UK, then this device could be used solely to access MOVEit and then wiped prior to the arrival of a family. It is essential that the device is only used for the purposes of accessing the portal. 
• We have heard of a group member donating an old laptop, which was wiped, used to access MOVEit, and then cleared again after doing so.

If your group is unable to find a way to access MOVEit, please contact the Reset Team and we will be happy to help.

Further resources

• Arrival planning guidance