Privacy Notice

Introduction
General
Part 1 of the Inquiry
What Personal Data will be collected, and why
Personal Data
Special Category Personal Data
Criminal Records Data
Part 2 of the Inquiry
The Purposes for Processing Personal Data
Legal Bases for Processing Special Category Personal Data
Legal Bases for Processing Criminal Records Data
Who else will Personal Data be shared with?
Third party service provider Processors
Other data sharing
Accurate identification and authorisation to obtain Inquiry evidence
Publication
Internal operation of the Inquiry
Fair process sharing
Risk prevention
Legal advice
Legal obligation or court order
Other data sharing
Post Inquiry Report: Processing after the Inquiry
International transfers
Security of Personal Data
Confidential
Security measures
Individual rights, complaints and contact
Individuals rights
Complaints
Contact details
Freedom of Information
Review of and changes to this notice
Terms explained


Introduction

  1. The Angiolini Inquiry chaired by Lady Elish Angiolini LT DBE PC KC (Chair) is an independent, non-statutory inquiry which is tasked with a specific role in accordance with its Terms of Reference from time to time (the Inquiry).
  2. The Inquiry’s role is determined by Terms of Reference conferred on the Chair by the Secretary of State for the Home Department, with the Terms of Reference for Part 1 of the Inquiry having been published on 10 January 2022 (https://www.gov.uk/government/publications/angiolini-inquiry-part-1-terms-of-reference).
  3. The Inquiry’s work comprises the following:
    1. Part 1: establishing a comprehensive account of the career of the killer of Sarah Everard, to identify any missed opportunities and to make recommendations based on the findings; and
    2. Part 2: investigating what further, broader, issues arise for policing and the protection of women, informed by the findings from Part 1.
  4. The Terms of Reference for Part 2 of the Inquiry are still to be determined.
  5. This privacy notice will be updated and/or supplemented following the publication of the Terms of Reference for Part 2 of the Inquiry.
  6. The Inquiry is a non-statutory inquiry. If however the Chair reaches a stage where she cannot meet her Terms of Reference due to the inability to compel evidence, she may make a request to the Home Secretary requesting that the Inquiry be converted to a Statutory Inquiry established under the Inquiries Act 2005. This privacy notice will be updated in the event that the Inquiry becomes a Statutory Inquiry.

Back to Top

General

  1. In relation to the Inquiry, the Chair is the Controller for your Personal Data. For ease, references to the Inquiry throughout this privacy notice include the Chair.
  2. This privacy notice explains what Personal Datais Processed by the Inquiry and why and how it is Processed. This privacy notice uses some terms and definitions which you may not be familiar with. To help you, these terms are shown in bold the first time they appear and are explained at the end of this privacy notice.
  3. This privacy notice covers the following:
    1. What Personal Data will be collected, and why: Information about what Personal Data is collected and Processed by the Inquiry, and why, during each stage of the Inquiry’s work.
    2. The Purposes and Legal Bases for Processing Personal Data: Why and how the Inquiry will Process Personal Data in the course of the Inquiry.
    3. Who else will Personal Data be shared with: Who, other than the Chair, will Personal Data be shared with.
    4. Publication of the Inquiry report/s: What Personal Data will be included within the report/s.
    5. Post Inquiry report – After the Inquiry has concluded and the Inquiry report/s have been published: Information about what Personal Data is retained by the Inquiry for how long after the conclusion of the Inquiry, and the reasons why this information is retained.
    6. International transfers: Where, why and when Personal Data may be transferred outside the United Kingdom, where the information is transferred to and, if so, what measures are implemented to ensure that the rights of the individuals whose Personal Data has been transferred are protected.
    7. Security of Personal Data: How the Inquiry will deal with the security of any Personal Data Processed.
    8. Individual rights, complaints and contact: Details of the privacy rights of individuals in respect of the Personal Data Processed by the Inquiry, and how individuals can exercise those rights or make complaints in respect of the Processing of Personal Data by the Inquiry.
    9. Freedom of Information: Confirmation that the Inquiry is not a public authority subject to the Freedom of Information Act 2000 or the Environmental Information Regulations 2004.
    10. Review of and changes to this notice: How and when individuals will be notified of any changes to this document.

Back to Top

Part 1 of the Inquiry

  1. The Chair takes control of and leads the Inquiry in accordance with the published Terms of Reference for Part 1 of the Inquiry. The Chair acts as Controller for Personal Data collected and Processed in this Part 1.
  2. The Chair is responsible for:
    1. the overall management and operation of the Inquiry;
    2. leading and directing the Inquiry’s investigations;
    3. determining legal advice and support required by the Inquiry, obtaining such advice and support from advisers and making decisions and taking actions following such advice and support;
    4. leading and directing staff engaged in supporting the Inquiry; and
    5. preparing and finalising the final Inquiry report/s.
  3. The Inquiry is not a criminal or statutory investigation, and accordingly, the Chair does not have the power to compel individuals or organisations to provide information. Accordingly, where the Chair requires information from a third party relating to a witness, she may, in certain situations, need the written permission of the witness to permit the release of that information by that third party to the Chair.

Back to Top

What Personal Data will be collected, and why

Personal data

  1. The Inquiry will Process Personal Data provided by:
    1. individual witnesses providing evidence to the Inquiry, including police officers and expert witnesses;
    2. family members and/or contacts of Sarah Everard’s family, or family members and/or contacts of Sarah Everard’s killer;
    3. police forces in England, including but not limited to: Metropolitan Police Service, Kent Police and Thames Valley Police;
    4. government departments and public bodies, including but not limited to: Civil Nuclear Constabulary, Ministry of Defence, Home Office, Independent Office for Police Conduct, Crown Prosecution Service, National Crime Agency and Her Majesty’s Inspectorate of Constabulary and Fire & Rescue Services;
    5. elected officials;
    6. any other individuals or organisations that the Inquiry considers may have relevant information that may assist the Chair in fulfilling the Terms of Reference, or who contact the Inquiry;
    7. Persons referred to in information received by the Inquiry from any of the above; and
    8. Persons who work as a member of the Inquiry Team, as an advisor to the Inquiry or in another support role, or provide the Inquiry with goods or other services.
  1. To meet Part 1 of the Inquiry’s Terms of Reference, this Personal Data may include:
    1. information relating to the life and career of Sarah Everard’s killer, including his education and career history, employment background, vetting and screening information, employment records, conduct and performance records, as well as any actual or alleged criminal behaviour and/or misconduct;
    2. details of how any alleged offences were investigated;
    3. details of any prosecutions, convictions and/or sentencing;
    4. information related to the conduct and performance of other police officers, including HR records, and information relating to allegations and/or findings of misconduct and complaints, and how these were investigated and addressed;
    5. information related to the recruitment, career development and inter-force transfers, vetting and re-vetting of police officers;
    6. contact and other Personal Data about those that are providing evidence to the Inquiry, or otherwise providing assistance to the Inquiry;
    7. contact and other Personal Data about members of the public that come forward to share information within the Inquiry; and
    8. information within the public domain, including information published in the press, and scholarly articles.

Back to Top

Special Category Personal Data

  1. Due to the nature of the Inquiry, evidence collected is sometimes expected to include Personal Data about individuals relating to more private or sensitive details comprising:
    1. information about their physical or mental health, injuries and/or medical treatment;
    2. their genetic data, or biometric data used for their unique identification;
    3. their racial or ethnic origin;
    4. their political opinions, religious or philosophical beliefs, or trade union membership; and/or
    5. their sex life or sexual orientation.
  2. These types of Personal Data comprise Special Category Personal Data.

Back to Top

Criminal Records Data

  1. In addition, the evidence collected will sometimes include Personal Data about an individual relating to their:
    1. criminal prosecution(s), conviction(s) and sentence(s);
    2. charges that did not lead to a prosecution;
    3. actual or alleged criminal offences; and/or
    4. incident reports that did not lead to charge.
  2. These types of Personal Data comprise Criminal Records Data.

Back to Top

Part 2 of the Inquiry

Once Part 2 of the Terms of Reference are settled, this privacy notice will be updated and/or a supplemental notice will be provided as necessary. Data collected and used in Part 1 of the Inquiry will also be used, where relevant, in Part 2 of the Inquiry. Subject to the precise details of the Terms of Reference, Personal Data will be used in Part 2 (and is expected to be supplemented where necessary), in the same ways and for the same purposes as in Part 1, namely in summary, investigation and evidence gathering, assessment and reporting.

Back to Top

The Purposes for Processing Personal Data

  1. During the course of the Inquiry’s work the Inquiry will Process Personal Data for the Purposes set out below:

Contact information

Contact information and details collected to facilitate the collection of evidence to, or involvement with, the Inquiry. This will include information if you:

  • are someone who contacts the Inquiry, whether through the email address given on the Inquiry’s website, by telephone or in any other way;
  • are someone who the Inquiry contacts in connection with matters under investigation by the Inquiry (for instance someone the Inquiry wants to interview or someone who holds information the Inquiry wishes to request);
  • are someone providing advice to, or otherwise assisting, a person (including a body) who the Inquiry is in contact with in connection with matters under investigation (for instance a person acting as a liaison point for the Inquiry within a body or a legal adviser providing assistance to someone invited to an interview with the Inquiry);
  • are referred to in information provided to the Inquiry as part of its investigations (for instance because you are recorded in minutes of a meeting as having attended that meeting or are mentioned by an Inquiry witness);
  • (if the Inquiry converts to a Statutory Inquiry) are a Core Participant or a Recognised Legal Representative participating in the Inquiry’s work; and/or
  • work as a member of the Inquiry Team, are supporting the Inquiry by providing advice or expert evidence, or provide the Inquiry with goods or other services.

Collection and analysis of evidence

Information and evidence will be collected by the Inquiry, and analysed to fulfil the Inquiry’s Terms of Reference.

The collection and analysis will involve obtaining documents from third parties, interviewing witnesses and obtaining evidence relating to individuals and witnesses, including Personal Data. This evidence gathering includes information sharing with third parties to allow them to locate, and then provide, relevant information to the Inquiry. This collection and analysis will also involve interviewing witnesses and obtaining evidence relating to witnesses.

One of the primary purposes of the Inquiry is from evidence collected and analysed, to identify:

  • a comprehensive account of the life and career of the killer of Sarah Everard, to identify any missed opportunities and to make recommendations based on the findings; and
  • inform the Terms of Reference for Part 2 of the Inquiry, which will be designed to investigate what further, broader, issues arise for policing and the protection of women.

Information sharing

This Purpose also includes sharing information with third parties where necessary. Further details are set out at paragraphs 24-37 below, but include:

  • (as part of the collection and analysis of evidence) to help third parties to provide information requested by the Inquiry, by identifying relevant individual/s and/or relevant records and information, and to help inform witnesses that are being interviewed;
  • to obtain expert evidence;
  • to inform the work of the Inquiry’s Reference Group;  
  • to assist any hearings that it holds, including: sharing documents with witnesses who appear before the Inquiry’s hearings, where relevant;
  • (as part of legal compliance) to comply with applicable legal obligations and requirements and court orders to disclose relevant Personal Data; and to ensure as required by law, that those accused or subject to criticism are able properly and fairly to respond. If the Inquiry is converted to a Statutory Inquiry, this includes sharing Personal Data with Core Participants and Recognised Legal Representatives, while complying with the Inquiry’s redaction processes to protect Personal Data to ensure that only data necessary for the Inquiry’s performance of its functions will be disclosed;
  • (for risk prevention) to prevent or reduce risk of death, or serious injury, or other harm to affected individuals; and to inform prosecuting and/or regulatory bodies if there are concerns in relation to conduct or the safety of an individual/s and/or the public; and
  • (for the management, operation and administration of the Inquiry) to enable the provision of required goods and services to it by third party contracted suppliers.

Progress reporting

The Inquiry may be required to report on the Inquiry’s progress in relation to timescales and budgets to relevant third parties such as the Home Secretary. No Personal Data identifying any witnesses or third parties, or any information concerning the Inquiry’s investigations, will be shared when providing such progress reports.

Legal advice

The Inquiry may request and receive legal advice in respect of the Inquiry (and this will involve sharing Personal Data, Special Category Personal Data and Criminal Record Data, to the extent relevant and necessary to such legal advice).

Public reporting

The ultimate objective of the investigation and analysis by the Inquiry is for the Chair to prepare and publish a written report/s, setting out her findings and making recommendations, if relevant. The Chair will draw on evidence which includes Personal Data when producing her report/s. Those reports may also reference source documentation on which it is based. The Chair will minimise inclusion of Personal Data in the reports, including details only where necessary. The report/s will be published.

The Inquiry can aggregate Personal Data, pseudonymise or anonymise Personal Data and/or redact it, to minimise Processing of Personal Data and to facilitate necessary and lawful Processing in respect of reports, analysis and publication for the purposes of the Inquiry.

Where the Inquiry considers it necessary to comply with the Data Protection Laws, Personal Data included in the reports will be anonymised or pseudonymised or redacted. Where the Inquiry considers it lawful to do so under the Data Protection Laws, Personal Data will be published in the report/s.  

If the Inquiry is converted to a Statutory Inquiry, this includes publishing evidence (for example witness statements and transcripts from hearings) to ensure it is accessible to anyone following the Inquiry’s proceedings, as is required by law, while complying with the Inquiry’s redaction processes to protect Personal Data to ensure that only data necessary for the Inquiry’s performance of its functions will be disclosed.

Inquiry management and operation

Personal Data may be collected and Processed by the Inquiry, or by a third party on the Inquiry’s behalf, to identify where there are problems in securing evidence requested by the Inquiry, or to measure the effectiveness of any measures implemented to secure additional evidence or encourage further witnesses. This information may be shared with the organisations from which the Inquiry has requested information, or the employer of a witness, to allow the Inquiry to identify what issues are hindering the sharing of information, and to agree measures to resolve the delays.

Personal Data may also be processed by the Chair to respond to and prepare responses to media enquiries. Personal Data will only be shared with the media where permitted by law.

Inquiry website and cookies

The operation of the Inquiry website – www.angiolini.independent-inquiry.uk – to provide information about the Inquiry to the public. The Inquiry may post updates and other non-personal data on its website to ensure that the Inquiry is run in an accountable and transparent manner.

If the Inquiry is converted to a Statutory Inquiry, the Inquiry may post evidence to its website.

To ensure the effective operation of the Inquiry, the website deploys cookies technology which can analyse individual visits to the website and how it is used, but only during their current actual visit to the website. For further information, please see the Inquiry Website’s cookie policy, available at https://www.angiolini.independent-inquiry.uk/cookie-policy/.

Inquiry telephone and email

The Inquiry will operate accessible means of allowing others to interact with the Inquiry, including a means for them to register their interest in the Inquiry, provide their contact information, feedback and provide evidence and information for the above Purposes.

Administration of the Inquiry

The Inquiry will deal with any complaints and manage contracts with Inquiry Processors.

Data Retention

During the Inquiry and until all Personal Data collected is (save to the extent contained in the published report/s) securely deleted, the Inquiry will retain and store all information collected, including documentation and records obtained or created by the Inquiry in case of need during the relevant stated retention period.

Legal compliance

To comply with legal and regulatory obligations and requirements; to deal with the exercise of individual rights, queries, complaints, claims and any legal proceedings. This includes information sharing to comply with legal obligations, court orders and fair process legal requirements.

Risk Prevention

The Inquiry may need to disclose Personal Data to protect the safety of an individual to a health professional or the police; and/or to disclose Personal Data to the police or relevant regulatory body where there are concerns about protection of the public or other individuals.

  1. Each of the above Purposes includes all reasonable and related preparatory and supporting Processing, including for record keeping and IT hosting, support and maintenance, audit and data security.

Back to Top

Legal Bases for all Personal Data Processing

  1. A Legal Basis is required for all Processing of Personal Data by the Inquiry. The Legal Bases enabling this Inquiry to Process Personal Data are set out below.
  2. To Process Special Category Personal Data, in addition to a Legal Basis for Processing Personal Data generally, a Legal Basis for Processing Special Category Personal Data, is required (including any relevant additional condition which must be met to comply with Data Protection Laws), as set out below.
  3. To Process Criminal Records Data, in addition to a Legal Basis for Processing Personal Data generally, a relevant additional Legal Basis (condition) for Processing Criminal must be met to comply with Data Protection Laws as detailed below.

Public interest

The Inquiry can rely on this where the Processing of the Personal Data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Chair’s Terms of Reference for the Inquiry have been conferred on her by the Secretary of State for the Home Department.

This will apply to Processing for the Purposes of contact information, collection and analysis of evidence, information sharing, progress reporting, public reporting, legal advice, Inquiry management and operation, operating the Inquiry website, telephone and mailbox, administration of the Inquiry and data retention. It will also apply to Processing for the Purpose of legal compliance where not based on a legal obligation or for risk prevention information sharing outside emergency cases.

Legitimate interest

The Inquiry can rely on this basis where Processing the Personal Data is necessary for it to pursue its legitimate interests (or those of a third party). It must make sure that it has considered the potential impact of such Processing on the affected individual, their rights and the protection of their Personal Data and mitigate any such impact to ensure the Processing is, on balance, justified and proportionate.

This will apply to all Processing set out under public interest above, to the extent that basis does not apply.

Vital interest

The Inquiry can rely on this basis where the Processing of Personal Data is necessary to protect the vital interests of an individual, or another person and the Inquiry is unable to contact the individual to obtain consent without placing the individual, or the other person, at risk. This means where the Processing is needed to protect the relevant individual or person in a life or death situation, or from risk of very serious and imminent harm.

This will apply to Processing for the Purpose of risk prevention (including related information shared in emergency cases).

Legal obligation

Where Processing the Personal Data is necessary for the Inquiry to comply with a legal obligation with which it must comply, it can rely on this basis. Likewise, where processing the Personal Data is necessary for the Chair to comply with a legal obligation to which she must comply, she can rely on this basis.

This will normally apply to Processing for the Purpose of legal compliance

(including relevant information sharing).

Consent

Where the affected individual gives their voluntary, informed, express consent to the Inquiry for it to Process their Personal Data for one or more specific Purposes, the Inquiry can rely on this basis. 

This will apply to Processing for the Purposes of using Inquiry website cookies. It will also apply to Processing for any Purpose where none of the other Legal Bases in this section are relevant.

Back to Top

Legal Bases for Processing Special Category Personal Data

Substantial public interest

The Inquiry can rely on this where Processing the Personal Data is necessary for reasons of substantial public interest and proportionate to the aim being pursued. Proper account must have been taken of any impact on the affected individual and their rights to ensure appropriate safeguards have been implemented. In the context of this Inquiry, it can be relied on in a number of contexts where Processing is necessary:

  • statutory and government purposes: for the purpose of a function conferred on the Inquiry by enactment or rule of law and/or a function of a Minister of the Crown or a government department;
  • prevention or detection of unlawful acts: to prevent or detect an unlawful act and must be undertaken without individual consent in order not to put that objective at risk;
  • protecting the public against dishonesty: for a protective function to protect the public against dishonesty, or seriously improper conduct, unfitness or incompetence, mismanagement of a body, or failure in services provided by a body or organisation and must be undertaken without individual consent in order not to put that objective at risk;

This will apply to Processing Special Category Personal Data for the Purposes of contact information, collection and analysis of evidence, information sharing, progress reporting, legal advice, public reporting, Inquiry management and operation, operating the Inquiry website, telephone and mailbox and administration of the Inquiry. It will also apply to Processing for the Purpose of legal compliance where not based on a legal obligation.  It will also apply to Processing for the Purpose of legal compliance where not related to a legal claim, or for risk prevention information sharing outside emergency cases.

Vital interest

The Inquiry can rely on this basis where its Processing of Personal Data is necessary to protect the vital interests of an individual, or another person, and where that individual is legally or physically incapable of providing their consent, or where, due to the nature of risk, the Inquiry is unable to contact that individual to obtain their consent in time to protect that individual or another person. This means where the Processing is needed to protect the relevant individual or another person in a life or death situation, or from risk of very serious and imminent harm.

This will apply to Processing for the Purpose of risk prevention in emergency cases.

Legal claims

The Processing of the Personal Data must be needed to establish, exercise or defend legal claims. This will apply to Processing for the Purpose of legal advice and/or legal compliance related to claims.

Explicit consent

It applies where the individual gives their explicit, voluntary and informed consent to one or more specific Purposes.

This will apply to Processing of Special Category Personal Data for any

Purpose where none of the other Legal Bases in this section are relevant.

Back to Top

Legal Bases for Processing Criminal Records Data

Substantial public interest

It applies in the same way as it would to Processing Special Category

Data.

This will apply to Criminal Records Data for the Purposes of contact information, collection and analysis of evidence, information sharing, progress reporting, public reporting, Inquiry management and operation, operating the Inquiry website, telephone and mailbox and administration of the Inquiry. It will also apply to Processing for the Purpose of legal compliance where not based on a legal obligation and for risk prevention outside emergency cases.

Legal claims

The Processing of the Personal Data must be needed to establish, exercise or defend legal claims, to obtain legal advice or in connection with actual or prospective legal proceedings.

This will apply to Processing for the Purpose of legal advice/compliance related to claims.

Consent

It applies where the individual gives their express, voluntary and informed consent to one or more specific Purposes.

This will apply to Processing of Criminal Records Data for any Purpose where none of the other Legal Bases in this section are relevant.

Back to Top

Who else will Personal Data be shared with?

Third party service provider Processors

  1. Any information, including Personal Data, provided to the Inquiry, may be transferred to third-party contractors providing services to it, such as the operation of IT systems used, or to allow the secure storage of information, as well as allowing the Inquiry to review and analyse information. The contractors will act as Processors acting on behalf, and under the control, of the Inquiry.  Where this is the case, these Processors are subject to stringent contractual obligations in relation to ensuring the security and confidentiality of the information, including Personal Data, they hold on behalf of the Inquiry. This means that they cannot do anything with that Personal Data unless instructed to do so. These Processors cannot share any Personal Data with any organisation apart from the Inquiry and/or unless instructed to do so, except where required to do so by law or Court order.

Back to Top

Other data sharing

  1. The Inquiry will not share any Personal Data unless the sharing is deemed necessary and falls within one of the information sharing scenarios set out in privacy information provided to affected individuals by the Inquiry from time to time, such as in this privacy notice. The Inquiry has processes in place, including redaction processes and/or pseudonymisation, anonymisation and/or aggregation, which govern the protection of Personal Data.

Back to Top

Accurate identification and authorisation to obtain Inquiry evidence

  1. The Inquiry may need to share Personal Data with a person or organisation which the Inquiry believes holds information that is relevant to the Inquiry; for example, when sharing names and dates of birth when requesting police records or HR records. This may also include sharing information you give to the Inquiry with another person or organisation who is giving evidence via an interview with the Inquiry or providing evidence during an Inquiry hearing, so that they may comment on it, or have regard to it when providing evidence. Transcripts of hearings heard in private may also be sent to those in attendance to check accuracy.
  2. This may also include sharing Personal Data to obtain expert evidence.

Back to Top

Publication

  1. The ultimate objective of the investigation and analysis by the Inquiry is for the Chair to prepare and publish a written report/s, setting out her findings and making recommendations, where relevant. The Chair will draw on Personal Data when producing her report/s. Those reports may also reference source documentation on which it is based. The reports will be published.
  1. At this stage it is intended that any Inquiry hearings will be conducted in private. If however the Chair reaches a stage where she cannot meet her Terms of Reference due to the inability to compel evidence, she may make a request to the Home Secretary requesting that the Inquiry be converted to a Statutory Inquiry; in such a scenario, the Inquiry’s hearings, except in exceptional circumstances and as required by law, will be held in public and evidence referred to at hearings will become publicly available. Other evidence and information may be available on the Inquiry’s website. Therefore, evidence, which may contain Personal Data, would be published and shared with third parties as follows in the context of a Statutory Inquiry:
    1. with Core Participants and their Recognised Legal Representatives;
    2. published on the Inquiry’s website;
    3. referred to during public hearings.
  2. This privacy notice will be updated in the event that the Inquiry becomes a Statutory Inquiry.

Back to Top

Internal operation of the Inquiry

  1. The Inquiry will need to share Personal Data with those advising and supporting it, for example from or to the Chair, to members of the Inquiry Team, for the purposes of the Chair fulfilling the Terms of Reference conferred on her.

Back to Top

Fair process sharing

  1. Where the Chair intends to make criticisms about an organisation or an individual in her report/s, the Chair may be legally required to provide that person and/or organisation with information about proposed criticisms to be made, and the evidence upon which it is based, which may contain Personal Data, in order to allow them the right to challenge or rebut any proposed criticisms made against them or to seek legal advice and/or representation in respect of the allegations (fair process). This is a legal obligation, sometimes referred to as Maxwellisation.

Back to Top

Risk prevention

  1. The Inquiry may share Personal Data where the disclosure is necessary for the safety of an individual/s and the disclosure is made either to:
    1. a medical professional or counsellor operating under an obligation of confidentiality; or
    2. to the Police; or
    3. to a regulatory body/bodies if there are concerns in relation to the conduct or the safety of an individual/s or the public.
  1. In the above situations, the Inquiry will, wherever possible, discuss the disclosure with the relevant data subject/s concerned and take on board any comments he/she may make, but where the Inquiry considers that there is a real and imminent risk to an individual/s (or where legal obligations prevent the Inquiry from doing so), they may make such a disclosure without any further reference to the relevant data subject/s.

Back to Top

Legal advice

  1. The Inquiry will share Personal Data, Special Category Personal Data and/or Criminal Records data with its legal advisers when obtaining legal advice in relation to the Inquiry.

Back to Top

Legal obligation or court order

  1. The Inquiry will share relevant necessary Personal Data with a third party to the extent the disclosure is required to comply with a legal obligation, such as a Court order, with which they must comply.

Back to Top

Other data sharing

  1. Online browsing information about visits to the Inquiry’s website will only be shared with third parties:
    1. where required for the proper operation of the Inquiry’s website (such as to present requested website pages or information, or to deal with another request from an individual visiting the website);
    2. otherwise where the visitor to the Inquiry’s website has consented to such sharing with the named third party, such as when the website’s cookies policy and consent process identifies a third party and explains about their cookie which will be installed with the visitor’s consent, to which the visitor has agreed. For further information please see the cookie policy for the Inquiry’s website, available at https://www.angiolini.independent-inquiry.uk/cookie-policy/. The cookie policy explains what cookies are and how the Inquiry’s website uses them and why, such as ensuing the website functions properly, is more secure and provides a better user experience.

Back to Top

Post Inquiry Report: Processing after the Inquiry

  1. Once the Inquiry has concluded and the Inquiry report has been published, data that is to be retained as part of the historic record will be transferred to the National Archives, for the purposes of indefinite retention of Inquiry records in accordance with the Public Records Act 1958, although any Personal Data included will continue to be protected in accordance with this policy. Personal Data that is not required for archiving purposes will be destroyed.
  2. The Chair and members of the Inquiry Team will not retain any Personal Data following the conclusion of the Inquiry.

Back to Top

International transfers

  1. All Personal Data held is stored within the United Kingdom. Any Personal Data Processed by any third-party service provider Processor appointed by the Inquiry, or a member of the Inquiry Team on behalf of the Inquiry, may be transferred and stored securely within the European Economic Area. This region is currently recognised under Data Protection Laws as having laws which adequately safeguard the Processing of Personal Data and the rights of individuals in respect of their Personal Data.
  2. Where an International Transfer arises, if required by Data Protection Laws to ensure adequate safeguard, appropriate safeguards, such as the approved relevant form of data transfer agreement in place from time to time will be entered into between the Inquiry/data exporter and the recipient data importer. This shall apply in respect of the transfer of relevant Personal Data from the UK to the European Economic Area and/or, where necessary, for its return.

Back to Top

Security of Personal Data

Confidential

  1. Any Personal Data provided to the Inquiry will be kept confidential, and will not be used for purposes other than set out in this Privacy Notice (or any related supplemental privacy information, or subsequent privacy notice provided to affected individuals).
  2. When Processed by or for the Inquiry, only the Chair, the Inquiry Team and experts instructed to assist the Chair, if any, will, or may, be given access to Personal Data, where necessary to perform their tasks, and will all:
    1. have received training on their Data Protection Law obligations and on keeping Personal Data secure;
    2. be given access to Personal Data only where necessary;
    3. have obtained appropriate security clearance and will follow the relevant Government security rules and procedures for the transmission, handling, storage and removal of documents; and
    4. have the ability to be monitored and audited in respect of what Personal Data they have accessed in the course of their work in respect of the Inquiry.

Back to Top

Security measures

  1. The Inquiry has implemented extensive measures intended to ensure that any information, including Personal Data processed for and/or by the Inquiry, is kept secure and separate from other information. These measures include:
    1. the use of encryption on systems used;
    1. the use of systems to restrict access to the information to specified individuals only; and
    1. keeping a record of who has had access to specific information and when they accessed it.
  2. Hard copy documents relating to the Inquiry are stored in locked, secure locations that can only be accessed by the Chair and Inquiry Team.
  3. The Inquiry has undertaken, and/or will undertake, appropriate checks to ensure that any third-party Processors who Process Personal Data provide sufficient guarantees to comply with the Data Protection Laws before their appointment; and if appointed are contractually obliged to comply with mandatory requirements required to comply with Data Protection Laws, in particular to take all appropriate technical and organisational measures (including to ensure the confidentiality, controlled access to and Processing of, and security of Personal Data).

Back to Top

Individual rights, complaints and contact

Individual rights

  1. Individuals have the right to:
    1. request information about how their Personal Data is processed;
    2. request access to their Personal Data, including a copy of their Personal Data;
    3. request that any errors in their Personal Data are corrected without any undue delay;
    4. request that any incomplete Personal Data is completed, including by means of a supplementary statement;
    5. request that their Personal Data is erased if there is no longer a justification for it to be processed;
    6. request that the processing of their Personal Data is restricted;
    7. object to the processing of their Personal Data; and/or
    8. request a copy of any Personal Data they have provided to the Inquiry in an electronic format, and for this to be provided in a structured, commonly used and machine-readable format.
  2. Where the Inquiry is relying on an individual’s consent as the basis to process their Personal Data, the individual has the right to withdraw their consent to the processing of their Personal Data at any time.
  3. These rights may be dependent on the reasons for which the Inquiry uses an individual’s Personal Data. If this is the case and the rights the individual tries to exercise do not apply, the Inquiry will respond and explain the reasons why it is unable to fully comply with the request(s).
  4. If the individual wishes to make a request, they must try to provide as much detail as possible about the information concerned, to help the Inquiry to deal with the request and if the individual wants to be contacted by a specific channel or using specific contact information, this should be explained.
  5. Due to the sensitivity of the information being processed by the Inquiry, any requestor may be contacted to provide satisfactory evidence to confirm their identity before the Inquiry starts to comply with their request.

Back to Top

Complaints

  1. If an individual considers that the Inquiry has misused or mishandled their Personal Data, or if the individual believes that their Personal Data has been Processed outside the scope of the privacy information provided to the individual, please contact the Inquiry on the details below at paragraph 55.
  2. The individual is also entitled to refer any complaints to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office,
Wycliffe House, Water Lane, Wilmslow, Cheshire,
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk.

  1. Further information as to the functions and powers of the Information Commissioner’s Office, and how to complain can be found on their website:  www.ico.org.uk. Any complaint to the Information Commissioner is without prejudice to the individual’s right to seek redress through the Courts.

Back to Top

Contact details

  1. If an individual has any queries or complaints in respect of the Inquiry’s Processing of their Personal Data or wishes to exercise their individual legal rights in respect of any related Personal Data Processed by the Inquiry as set out in this document, please contact:

E-mail: info@angiolini.independent-inquiry.uk
Telephone: 07468 424 017

Back to Top

Freedom of information

  1. The Inquiry operates independently from its sponsoring government department, the Home Office, and the Secretary of State for the Home Department who commissioned the Inquiry. The Home Office and the Secretary of State have no right of access to communications between the Chair and the Inquiry Team, evidence collected by the Inquiry, it’s assessment of such evidence, and/or legal advice provided to the Inquiry and the Chair.
  2. The Chair and Inquiry are not public authorities subject to the Freedom of Information Act 2000 or the Environmental Information Regulations 2004.

Back to Top

Review of and changes to this notice

  1. This notice will be regularly reviewed and may be subject to revision. Any revision to the privacy notice will be highlighted on the website. If we make fundamental changes to this privacy notice, we will seek to inform you in subsequent communications sent by the Inquiry.

Back to Top

Terms explained

Chair

Lady Elish Angiolini LT DBE PC KC, appointed by the Home Secretary, Rt Hon Priti Patel MP

Controller

The organisation or person who decides what Personal Data to collect, why and how and who is as a result legally responsible for ensuring that any such Personal Data is Processed in accordance with the Data Protection Laws.

Core participant

Where the Inquiry has been converted to a Statutory Inquiry, a Core Participant is a person, organisation or other entity with a significant interest in the Inquiry and designated a Core Participant in the Inquiry pursuant to Rule 5 of the Inquiry Rules 2006.

Criminal records data

Criminal Records Data, which includes information relating to:

  • any criminal convictions of an individual;
  • sentences imposed on an individual;
  • prosecutions of an individual; and/or
  • actual or alleged criminal offences by an individual

Data protection laws

The laws applicable to the Processing of Personal Data by the Inquiry and/or which safeguard the related Personal Data and/or privacy rights of affected individuals.

European Economic Area

The European Union member states from time to time, together with Iceland, Liechtenstein and Norway.

ICO or Information Commissioner’s Office

The regulatory authority in the UK whose function is to ensure compliance with the Data Protection Laws and/or public access to information laws, like the Freedom of Information Act 2000

Inquiry

The Angiolini Inquiry undertaken by the Chair, which is an independent, non-statutory inquiry tasked with the following:

Part 1: establishing a comprehensive account of the career of the killer of Sarah Everard, to identify any missed opportunities and to make recommendations based on the findings; and

Part 2: investigating what further, broader, issues arise for policing and the protection of women, informed by the findings from Part 1.

Inquiry team

The Inquiry Team consists of the following:

  • the Inquiry Secretariat;
  • the Inquiry Legal Team (which consists of Solicitors to the Inquiry and Counsel to the Inquiry, if appointed, and support staff).

International transfer(s)

The transfer of Personal Data from within the United Kingdom outside the United Kingdom and/or its return.

Legal basis or bases

Under Data Protection Laws, a Controller cannot Process an individual’s Personal Data for just any reason or purpose they want – only those which are permitted by the Data Protection Laws. Data Protection Laws set specific grounds or ‘legal bases’ for which Personal Data can be used lawfully. All and any Processing of any Personal Data must fall within one legal basis for normal Personal Data use.

In addition:

  • any Special Category Personal Data can only be Processed for a Purpose within one of the Special Category Personal Data Legal Bases; and
  • any Criminal Records Data can similarly only be Processed for a Purpose within one of the Criminal Records Data Legal Bases.

Personal data

Personal Data is defined as any information relating to or identifying any individual(s), either directly or indirectly, including by reference to, for example, a name, identification number or one or more factors specific to that individual.

It may in addition fall into one of two other categories: Special Category Personal Data, or Criminal Records Data.

Process, processing, processes, processed

This covers any use of any Personal Data of any type by the Inquiry, whether active, for example emailing it, or passive, for example storing it in archive boxes. It covers every use of Personal Data from its collection; recording and storing it; reading, copying or printing it; amending or copying it; sharing, disclosing or publishing it; to deleting or destroying it.

Processor

The organisation or person appointed by a Controller, on whose behalf and on whose instructions the Personal Data concerned is Processed, such as a service provider hosting a website for a client, or storing Personal Data for a client.

Purposes

The reasons why Personal Data is Processed, such as to collect evidence and undertake an investigation.

Recognised legal representative

Where the Inquiry has been converted to a Statutory Inquiry, a Recognised Legal Representative is a qualified lawyer that has been appointed to act for a Core Participant or any other person required or permitted to give evidence or produce documents during the course of the Inquiry, in accordance with Rule 6 of the Inquiry Rules 2006.

Reference group

A group of specialist individuals that have/will be appointed by the Chair from time to time to provide advice during the course of the Inquiry’s work.

Special category personal data

Special Category Personal Data (also known as Sensitive Personal Data), which includes information relating to an individual’s:

  • health, including any medical treatment;
  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetic data or biometric data for unique identification; and/or
  • sex life or sexual orientation.

Statutory Inquiry

A statutory public inquiry is an inquiry established under Section 1 of the Inquiries Act 2005 by a government minister where they consider particular events have caused, or are capable of causing, public concern, or there is public concern that particular events may have occurred.

Terms of Reference

The Terms of Reference of the Inquiry detailing its scope and approach. A copy of the Terms of Reference for Part 1 of the Inquiry can be found at https://www.gov.uk/government/publications/angiolini-inquiry-part-1-terms-of-reference.

Back to Top