This notice explains how the Infected Blood Inquiry (the Inquiry) collects and uses personal information. The Inquiry is established as an independent public inquiry exercising statutory functions in the public interest under the Inquiries Act 2005. The Inquiry is a data controller and can be contacted as follows: Infected Blood Inquiry, Aldwych House, 5th Floor, 71-91 Aldwych, London WC2B 4HN Email to: contact@infectedbloodinquiry.org.uk
The purposes for processing personal information
The Inquiry is investigating those matters set out in the Terms of Reference, and it needs to process personal information for the purposes of its investigations and to enable it to carry out its work. Personal information is used by the Inquiry in a number of ways - for example, to gather evidence as part of the Inquiry’s investigation, to facilitate access to the Inquiry, and to communicate with you and keep you updated on the progress of the Inquiry. Personal information may also be used by the Inquiry to comply with the law and contracts that the Inquiry has entered into.
How the Inquiry collects personal information
Most of the personal information the Inquiry processes is provided to it directly by you (or through your legal representative) for one or more of the following reasons:
● You wish to give evidence or to be a core participant to the Inquiry
● You have been asked to provide evidence to the Inquiry, whether a written statement or documents
● You have provided evidence to the Inquiry
● You have responded to the consultation on whether there should be an Inquiry or on the Terms of Reference
● You have contacted the Inquiry by email, telephone or letter
● You wish to attend, or have attended, a meeting with the Inquiry team
● You are representing your organisation in engaging with, or providing services to, the Inquiry.
The Inquiry may also receive information about you in other ways. For example, as part of its investigation the Inquiry will request access to records from a range of sources, such as healthcare providers, the Department of Health, the trusts and funds that have been set up, and government authorities. Other individuals may also include information about you in their evidence to the Inquiry. In most cases information will be provided to the Inquiry on a voluntary basis, but in exceptional circumstances, the Inquiry may require the provision of personal information under section 21 of the Inquiries Act 2005, for the purposes of discharging its statutory functions.
What sort of information does the Inquiry collect?
The Inquiry collects information about people who were infected from blood or blood products and their families, data about the impact of infection, information about the provision of medical care and support for those infected and their families, and other matters within the Terms of Reference of the Inquiry. The Inquiry will also collect and retain contact details. The records the Inquiry holds include personal information, including sensitive personal information relating, for example, to health, racial or ethnic origin and/or a person’s sex life or sexual orientation.
The legal basis for processing personal information
The Inquiry processes personal information fairly and lawfully in compliance with data protection legislation. Personal information is processed because the processing is necessary to enable us to carry out our work, which is a task carried out in the public interest and in the exercise of a statutory function, in this case the Chair’s functions under the Inquiries Act 2005. Sensitive personal information is processed because the processing is necessary for reasons of substantial public interest in the exercise of a statutory function.
How does the Inquiry share personal information?
The Inquiry keeps your personal information secure and only shares it with those who need to see it. To facilitate the work of the Inquiry, personal information may be shared with third party data processors who supply consultation software, and electronic disclosure software and services to the Inquiry. The Inquiry has contracts in place with its data processors, which means they cannot do anything with your personal information unless the Inquiry has instructed them to do it. They will not share your personal information with any organisation apart from the Inquiry, or as directed by the Inquiry. They will hold your data securely and retain it for the period the Inquiry instructs. The Inquiry may have to disclose personal information on a confidential basis to organisations that hold records which could assist the Inquiry with its investigations (such as organisations which provided healthcare or support services), or to experts assisting the Inquiry’s work. The Inquiry may share information received as part of the Inquiry’s investigations with core participants and the public in line with the Inquiry’s Statements of Approach, including the statement relating to Anonymity and Redaction. As your personal information is stored on our IT infrastructure, and shared with our data processors who provide email, and information management and storage services, it may be transferred and stored securely outside the European Union. If that happens, your information will be subject to equivalent legal protection through the use of Model Contract Clauses.
For how long will the Inquiry keep personal information?
The Inquiry will securely store information provided to it, including personal information, and will generally retain it for the duration of the Inquiry depending on the purpose of gathering and using that personal information. At the end of the Inquiry as required by law, the Inquiry record, which may include personal and sensitive personal information, will be transferred to the National Archives where information will be handled according to the safeguards in data protection legislation for archiving in the public interest.
What are your rights?
You are entitled to request information about how your personal data is processed, and to request a copy of that personal data, subject to some exemptions. You have the right in certain circumstances (for example, where the accuracy of the information held by the Inquiry is queried) to request that the processing of your personal data is restricted, or to object to the processing of your personal data. You may also request that the Inquiry corrects or deletes your personal data.
Links to other websites
www.infectedbloodinquiry.org.
Further information and complaints
If you have comments or queries about this privacy notice, please contact the Inquiry at contact@infectedbloodinquiry.org.uk. If you are unhappy about the way that the Inquiry uses your personal data, you may contact the Inquiry’s Data Protection Officer, who provides independent advice and monitoring of our use of personal information:
Steve Jones
Data Protection Officer
70 Whitehall
London
SW1A 2AS
Email to: dpo@cabinetoffice.gov.uk
If you wish to make a complaint about the way the Inquiry handles your personal data, you can contact the Information Commissioner’s Office at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email to: casework@ico.org.uk
Telephone: 0303 123 1113
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Policy on the processing of special category and criminal convictions personal data PDF, 5 pages - 100kb