Privacy Notice

This notice explains how the Independent Inquiry into the issues raised by the Fuller case (the Inquiry) collects and uses personal information.

This notice covers personal information collected or created by the Inquiry. In considering how it handles and uses personal information, the Inquiry has reviewed the best practice guidelines on data management issued by the National Archives Office.

Personal information may be used by the Inquiry in a number of ways. These include gathering information and evidence, communicating with those affected by the Inquiry and complying with any legal obligations.

The Inquiry expects to handle a wide range of documents within its investigations which may contain personal data. These documents may include letters, emails, records, notes, audio files, reports, witness statements, personnel records, minutes from meetings, policies, training records, information from websites and recordings and transcripts of evidence sessions.

This notice may be amended to reflect any changes in the Inquiry’s practices or to mention new types of information handled by the Inquiry. When that happens, an updated version of this policy will be made available on the Inquiry website.

“Personal data” means any information relating to an identified living person, or which could be used to identify a living person. The Inquiry will collect personal data, such as names, contact details, financial and lifestyle information, either directly from the person, or from individuals or organisations who may supply data about other people.

The Inquiry may also collect and process some more sensitive information, such as data relating to health, religious beliefs, racial or ethnic origin, trade union membership and matters relating to sex and sexual orientation. This is referred to as “special category data”.

The Inquiry will also collect and process data in relation to those who are deceased. Whilst the provisions of data protection legislation only apply to those who are living, the Inquiry will treat the data of deceased individuals respectfully and protect the anonymity of the deceased. The Inquiry will take into consideration any concerns raised by the families about how their data are collected and processed by the Inquiry.

Data Controller

The Inquiry will be the Data Controller for the information once disclosed to it, for the purposes of fulfilling its Terms of Reference.

Lawful Basis for Processing Data

The Inquiry processes personal information fairly and lawfully in accordance with data protection legislation, including the Data Protection Act 2018 and Article 6(1)(e) of the General Data Protection Regulation 2016.

The Inquiry collects, stores, shares and uses personal information in order to carry out its work. The work of the Inquiry is a task carried out in the public interest, which is a lawful basis for processing data under the data protection legislation.

The work of the Inquiry is also carried out under instruction from the Secretary of State for Health and Social Care following their decision to establish a non-statutory independent inquiry into the issues raised by the actions of David Fuller.

Where special category data is processed by the Inquiry, this is considered necessary for reasons of substantial public interest. The Inquiry has been tasked with making recommendations to prevent repetition of the type of actions undertaken by David Fuller and to safeguard the security and dignity of the deceased.  The Inquiry does not believe it would be possible to achieve this goal without processing this kind of data or by processing it in some lesser way.

Sharing Information

The Inquiry will need to share personal data with others. This may involve sharing information with third party data processors who provide information management, administrative services or support to the Inquiry.  None of the data will be processed outside the EEA.  The Inquiry will require any third-party data processors to ensure that personal data is securely stored and correctly handled to maintain anonymity.

The Inquiry will also need to share personal information with individuals or organisations which could assist the Inquiry with its investigations. This may include experts who are asked to provide advice to the Inquiry.

The Inquiry may also be required to share information with third parties in order to comply with any legal obligations.

Handling, Storage and Destruction of Information

The Inquiry will store personal information securely. All members of the Inquiry will receive training on their obligations in handling personal data.

The Inquiry will only retain personal information for as long as it requires to fulfil its public task and to meet the Terms of Reference.

The Inquiry will publish a report of its findings and recommendations.

Subject to the exceptions set out below, the Inquiry will destroy any documents which it has gathered or created once it comes to an end. Documents will not be destroyed if they are preserved for the public record, where an individual requests the return of an original document or where the Inquiry is required to share or keep a document to comply with any regulation or law.

What are your rights?

The rights associated with the Inquiry are as follows:

1. The right to get copies of information – individuals have the right to ask for a copy of any information about them that is used.
2. The right to get information corrected – individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected
3. The right to limit how the information is used – individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.
4. The right to object to the information being used – individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
5. The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Further Information

If you have comments or queries about this privacy notice, please contact the Inquiry at contact@fuller.independent-inquiry.uk.  If you have any queries about this policy or the way that the Inquiry uses personal data, please contact the Inquiry’s Data Protection Officer, contact@fuller.independent-inquiry.uk.

The Inquiry is registered with the Information Commissioner’s Office as a data controller. Details of the Inquiry’s registration, number ZB290277, can be viewed at www.ico.gov.uk.

If you wish to make a complaint about the way the Inquiry handles your personal data, you can contact the Information Commissioner’s Office at www.ico.org.uk.