"Under the Data Protection Act 1998, the information you provide and we hold on record about you is known as personal data (e.g. name, address, etc). There are other information such as racial or ethnic origins, political opinions, religious or other beliefs, trade union membership, health, sex life or sexual orientation, criminal proceedings or convictions that you provide which are classed as ‘sensitive personal data’.
Dixons Retail will process (e.g. record and use) your personal and sensitive personal data for it’s internal records and/or to assist in the selection for employment process, where necessary. We will not share your data with third parties except where we have legal obligations to do so."
This is from the Dixons careers page. If you pursue an application there it is processed online; currently I'm padding out my jobsearch (the UJ site is so crap I fear the worst when I next sign on as my record will be extremely lean) with an application for a job I can't do. Bit silly really - and trying to answer the questions it asks honestly is next to impossible: I don't really want a career with Dixons, yet if I say this you can be sure it will get nowhere, which seems a little too easy to me. No, that doesn't make sense at all.
It seems clear from the above wording that what is contained on a CV and what would be contained in the information one submits to the Universal Jobmatch/DWP Gateway account widget is regarded as personal data, under the terms of the act. As the above warning makes clear such information cannot be shared unless there are legal obligations. Does the Work Programme, do its providers, have that obligation?
The Dixons site processes your permission when you click to continue from this point, so it seems quite clear to me that the same rules must apply to the DWP and the Work Programme. Though we cannot put anything past these people under IDS, Grayling and now Hoban.