The Thirlwall Inquiry (“the Inquiry”) is an independent public inquiry exercising statutory functions in the public interest established under the Inquiries Act 2005 (“the Act”). The Inquiry is the data controller for your personal information.
This privacy notice explains how the Inquiry will use your personal information (also referred to as personal data), who it might be shared with and your rights. The Inquiry is committed to handling personal information in compliance with data protection legislation.
What personal information does the Inquiry need to collect and why?
Purposes of data collection
The Inquiry is investigating the events at the Countess of Chester Hospital and their implications. On 21st August 2023 at Manchester Crown Court, Lucy Letby was sentenced to life imprisonment and a whole life order following convictions on 7 counts of murder and 7 counts of attempted murder. The matters the Inquiry is investigating are set out in its Terms of Reference available.
In order to carry out its investigation, conduct its hearings and discharge its duties under the Inquiries Act 2005, the Inquiry will need to collect and process personal information.
The hearings, except in exceptional circumstances and as required by law, will be held in public and evidence referred to at hearings will become publicly available. Personal information may also be contained in the Report to the Inquiry, which will be published after the conclusion of the hearing.
Data collected
The Inquiry may receive information about you in a number of ways. Information may be requested from organisations involved in the Inquiry or submitted voluntarily. For example, the Inquiry may have requested and been granted access to material held by third parties who are connected to the subject matter of the Inquiry, such as Cheshire Police, HM Courts & Tribunals Service and the Department for Health and Social Care. The Inquiry also has powers to compel an individual or organisation to hand over the requested information.
The Inquiry will continue to gather evidence containing personal information in advance of, and during, the hearings.
The Inquiry will process the personal information of a range of individuals, including:
- Core Participants, within the meaning of the Inquiries Act 2005
- Witnesses who provide evidence to the Inquiry
- Contracted parties to the Inquiry
- Members of the public who contact the Inquiry
The Inquiry will process a number of different categories of personal data. This will include:
- Personal data, including biographical data such as name, date of birth, personal description, contact details, images and voice recordings.
- Special category data, including data relating to health, race/ethnicity, religious beliefs and Trade Union membership.
- Personal data relating to criminal convictions and offences – this personal data is subject to strict controls.
The Inquiry keeps your information secure and only shares it with those who need to see it as part of the Inquiry. All personal data we receive is handled fairly and lawfully in accordance with data protection legislation.
Legal basis for processing
The Inquiry’s lawful basis for processing personal and special categories data:
- The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (provided for under Article 6(1)(e) of the UK GDPR). The Chair has official authority to perform the core function of the Inquiry to investigate the matters falling within the Inquiry’s terms of reference.
- The processing of evidentiary material is necessary for compliance with legal obligations, which is provided for under Article 6(1)(c) of the UK GDPR. This includes section 18(1) Act that provides, subject to restriction notices, public are to have access to inquiry proceedings and information.
- For providers of services to the Inquiry, the legal basis for processing your personal information will normally be that it is necessary for the performance of a contract to which you are a party. This is provided for under Article 6(1)(b) of the UK GDPR.
- The legal basis for processing special categories data is that it is necessary for reasons of substantial public interest, including the exercise of a function conferred by an enactment or rule of law (i.e. the Inquiries Act 2005), to the extent that it is necessary. This is provided for by Article 9(1)(g) of the UK GDPR and section 10 of the Data Protection Act 2018 (“the DPA 2018”). In some limited cases, we may also ask for the consent of the data subject.
Where the Inquiry is required to process personal information relating to criminal convictions or offences, the processing must be considered necessary for the exercise of a function conferred on the Chair by the Act and the Inquiry Rules 2006. This is provided for by Article 10 of the UK GDPR and section 10(5) of the DPA 2018.
Who do we share your data with and why?
An inquiry is publicly accessible, so your personal data may be shared publicly. There are clear processes, including robust redactions processes, in place which govern the protection of your personal information. Information may also be subject to a restriction notice, which is further explained in the Inquiry’s Protocol on applications for restriction orders. This is to ensure only information necessary for the Inquiry’s performance of its functions will be disclosed outside the Inquiry or to those instructed by the Inquiry.
During the course of undertaking the statutory duties of the Inquiry, your information may be shared by the Inquiry with the following main groups:
- Counsel to the Inquiry
- Solicitor to the Inquiry
- Legal representatives of the Core Participants
- Core Participants
- Expert Witnesses appointed by the Inquiry
- Assessors appointed by the Inquiry
- Third party data processors (such as providers of IT infrastructure or electronic disclosure platforms)
- The public via the Inquiry website, having regard to the obligation at section 18 of the Act ton provide public access to inquiry proceedings and information, or via published reports under section 25 of the Act
Personal information submitted to the Inquiry may be transferred to IT systems operated by third party data processors for the purposes of storing, reviewing and analysing documents and information. The Inquiry has appropriate technical and organisational measures in place with its data processors, which means they cannot do anything with your personal information unless the Inquiry has instructed them to do it. They will not share your personal information with any organisation apart from the Inquiry, or as directed by the Inquiry. They will hold your personal information securely and retain it for the period the Inquiry requires.
At the conclusion of the Inquiry, information that is to be retained as part of the historic record will be transferred to the National Archives.
We may also share personal information where we are under a legal obligation to do so, or where it is necessary to assist with a criminal investigation to allow other organisations to comply with their statutory functions.
How long will the Inquiry keep your personal information?
Personal information will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal information held by the Inquiry will be transferred for the purposes of indefinite retention of inquiry records by the National Archives in accordance with the Public Records Act 1958.
What are your rights?
All individuals have a number of rights under the UK GDPR.
This includes the right to request:
- Information about how your personal data is processed and a copy of that personal data. This also known as a subject access request.
- Any inaccuracies in your personal data are rectified without delay.
- Any incomplete personal data is completed, including by means of a supplementary statement.
- Your personal data is erased if there is no longer a justification for them to be processed.
- Processing of your personal data is restricted.
- Where we are relying on your consent, or a contract with you, a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.
- The processing of your personal data cease (sometimes referred to as the right to object).
If we are relying on your consent, you may withdraw consent to the processing of your personal data at any time.
Any objections will be considered in the context of the Inquiry’s statutory duties and the necessity of processing personal information for that purpose. There are some exemptions, which means we may not always be able to comply with your request in its entirety.
You can exercise your rights by contacting the Inquiry at the details provided below and making a request. You may be asked to provide the Inquiry with proof of your identify before any request can be processed.
International transfers
Your personal information is stored on the Inquiries’ IT infrastructure and also shared with our data processors. Information may be transferred and stored securely outside the UK and European Economic Area. Where that is the case, all appropriate technical and legal safeguards will be put in place to ensure you are afforded with same level of protection.
Who can I contact for more information?
The Inquiry’s Data Protection Officer can be contacted at DPO@thirlwallinquiry.co.uk.
Complaints
If you consider that your personal information has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
The Information Commissioner can be contacted at:
Telephone: 0303 123 1113
Address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Email: casework@ico.org.uk
Review of this notice
This notice will be regularly reviewed and may be subject to revision.