Who we are
The Dawn Sturgess Inquiry was established in order to identify where responsibilities lie for the death of Dawn Sturgess and to make appropriate recommendations. The Inquiry will process personal data in order to fulfil its terms of reference, and is the data controller for the personal information that it collects. This privacy notice sets out how we will process your data and explains your rights.
What is personal data
Personal data is anything that identifies an individual. It may include names, addresses, contact details or description of a person that could lead to their identification. As a data controller, the Inquiry has a duty to consider the impact of releasing such data on individuals, in line with the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (GDPR).
The DPA and GDPR require that organisations pay particular attention to sensitive personal data (also known as special category data) which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
What we use your personal data for
The Inquiry will collect and use personal data for the following reasons:
- to develop an evidence base for the Inquiry’s work
- to communicate with external stakeholders, including officials, journalists, providers of evidence, core participants and witnesses
- to deal with public correspondence
- to respond to data protection requests from individuals (also known as subject access requests or SARs)
- to provide the public with information about the Inquiry through social media channels
- to operate and maintain the Inquiry’s website
What personal data is collected
- Evidence to the Inquiry may include: name, address, email address, job title, employer, opinions, health information, criminal convictions and any other sensitive information you volunteer about yourself or others. Evidence may also include personal data about identifiable individuals that are provided by government bodies or other institutions. In such cases, the Inquiry will adhere to its Data Protection Policy when considering disclosure of personal data, including special category data
- External communications with stakeholders may include: name, address, email address, job title (where these are provided by you), and employer (where provided by you)
- Contact information and details collected to facilitate the collection of evidence to, or involvement with, the Inquiry. This will include information if you are someone who contacts the Inquiry, whether through the email address given on the Inquiry’s website, by telephone or in any other way
- When you contact us, we may collect: name, address, email address, details of any concerns raised in your correspondence, and any other information you volunteer about yourself or others. This may include special category data or data about criminal convictions, if you volunteer such information
- If you make a data protection request (also known as a subject access request), we will collect: name, address and/or email address, your request, documents needed to verify your identity.
- The Inquiry’s social media channels may include: names, email addresses, photographs, videos, social media handles, opinions, and any other data volunteered by you, including sensitive personal data.
How we handle your personal information
We keep your information secure on our IT infrastructure and only share it with those who have a need to see it. It is possible that your data may be stored outside the UK; if this is the case, it will be subject to equivalent regulatory provisions, such as the EU GDPR.
All personal information we receive is handled fairly and lawfully in line with data protection legislation. The Inquiry has published a data protection policy and a document protocol which set out how we handle the data you give us.
Who we share data with
We share data received as part of the Inquiry’s investigation with core participants and redactions are applied in accordance with the Inquiry’s Protocol on the Redaction of Documents. Material that is adduced during the Inquiry’s public hearings and relied upon by the Chair in his report is also made available on the Inquiry’s website. At times, it may not be possible to hold hearings in public. In these cases, data will be shared or restricted as set out in any notice issued under section 19 of the Inquiries Act 2005.
How long we keep your personal data
Personal data will be held for as long as it is required for the purpose for which it was collected.
Personal data collected as part of evidence will be held by the Inquiry until it concludes its work. At the end of the Inquiry, some of the personal data it holds will – where it is considered to form part of the historical record – be selected for permanent preservation at The National Archives in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes may be retained by the Inquiry’s sponsoring department for a limited period for audit or accountability purposes and will then be destroyed. As far as possible, personal data collected by the Inquiry will be destroyed when the Inquiry closes.
Personal data held in stakeholder communications will be deleted at the close of the Inquiry. However, correspondence may be kept if it is considered sufficiently significant that it should be retained for the historical record.
Personal information in correspondence will be deleted at the close of the inquiry. However, public correspondence may be kept if it is considered sufficiently significant that it should be retained for the historical record.
Personal data held in relation to data protection requests will be deleted at the close of the Inquiry. Documents used to verify identity will be deleted once identity has been verified.
Inquiry website and cookies
The operation of the Inquiry website www.dawnsturgess.independent-inquiry.uk/ is to provide information about the Inquiry to the public. The Inquiry may post updates and other non-personal data on its website to ensure that the Inquiry is run in an accountable and transparent manner. The Inquiry will also post evidence presented in open hearings to its website.
To ensure the effective operation of the Inquiry, the website deploys cookies technology which can analyse individual visits to the website and how it is used, but only during their current actual visit to the website. For further information, please see the Inquiry Website’s cookie policy, available at www.dawnsturgess.independent-inquiry.uk/cookie-policy/
This privacy statement applies only to the Dawn Sturgess Inquiry website; it does not cover links within the site to other websites.
The legal bases for processing personal data
For the majority of personal data we process, our legal basis for processing your personal data is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the Inquiry’s work to fulfil its Terms of Reference.
Where we post personal data on social media relating to inquiry activity, our legal basis is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). Where we process personal data generated by social media users, the legal basis for processing that personal data is because the user consents to us doing so (Article 6(1)(a) UK GDPR).
The legal basis for processing your personal data in order to respond to data protection requests is that it is necessary to comply with a legal obligation placed on the Inquiry as the data controller (Article 6(1)(c) UK GDPR).
Your rights in relation to your personal data
- You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed.
- You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data where you believe that processing is unlawful, unfair or unnecessary. The Inquiry will balance objections against its obligation to perform its public task.
Requests are dealt with on a case-by-case basis. Your rights may be subject to exemptions or limitations.
How to contact us
The data controller for your personal data is the Dawn Sturgess Inquiry. The contact details for the data controller are info@dawnsturgess.independent-inquiry.uk. You can use this address to contact the data protection officer to make a data protection request (also known as a subject access request) or to raise any concerns regarding the Inquiry’s processing of your personal data.
Complaints and appeals
If you have already made a complaint to us and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory authority responsible for data protection in the UK.
The Information Commissioner can be contacted at:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.
Tel: 0303 123 1113 or email icocasework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.