1. This notice explains how the Essex Mental Health Independent Inquiry (the Inquiry) collects and uses personal information.
2. This notice covers personal information collected or created by the Inquiry. In considering how it handles and uses personal information, the Inquiry has reviewed the best practice guidelines on data management issued by the National Archives Office.
3. Personal information may be used by the Inquiry in a number of ways. These include gathering information and evidence, communicating with those affected by the Inquiry and complying with any legal obligations.
4. The Inquiry expects to handle a wide range of documents within its investigations which may contain personal data. These documents may include letters, emails, medical records, notes, audio files, reports, witness statements, personnel records, minutes from meetings, policies, training records, information from websites and recordings and transcripts of evidence sessions.
5. This notice may be amended to reflect any changes in the Inquiry’s practices or to mention new types of information handled by the Inquiry. When that happens, an updated version of this policy will be made available on the Inquiry website.
Personal Data and Sensitive Personal Data
6. “Personal data” means any information relating to an identified living person, or which could be used to identify a living person. The Inquiry will collect personal data, such as names, contact details, financial and lifestyle information, either directly from the person, or from individuals or organisations who may supply data about other people.
7. The Inquiry will also collect and process some more sensitive information, such as data relating to health, religious beliefs, racial or ethnic origin, trade union membership and matters relating to sex and sexual orientation. This is referred to as “special category data”.
8. The Inquiry will also collect and process data in relation to those who are deceased. Whilst the provisions of data protection legislation only apply to those who are living, the Inquiry will treat the data of deceased individuals respectfully. The Inquiry will take into consideration any concerns raised by the families about how their data are collected and processed by the Inquiry.
Lawful Basis for Processing Data
9. The Inquiry processes personal information fairly and lawfully in accordance with data protection legislation, including the Data Protection Act 2018 and the EU General Data Protection Regulation.
10. The Inquiry collects, stores, shares and uses personal information in order to carry out its work. The work of the Inquiry is a task carried out in the public interest, which is a lawful basis for processing data under the data protection legislation.
11. The work of the Inquiry is also carried out under a direction from the Minister of State for Mental Health, Suicide Prevention and Patient Safety following their decision to establish a non-statutory independent inquiry into deaths in mental health inpatient facilities in Essex. This provides an additional lawful basis for the processing of personal data under the data protection legislation.
12. Where special category data is processed by the Inquiry, this is considered necessary for reasons of substantial public interest. The Inquiry has been tasked with making recommendations to reduce the risk of harm to members of the public and to address failings in mental health services in Essex. The Inquiry does not believe it would be possible to achieve this goal without processing this kind of data or by processing it in some lesser way.
13. The Inquiry will need to share personal data with others. This may involve sharing information with third party data processors who provide information management, administrative services or support to the Inquiry, some of which may be based outside the EU. The Inquiry will require any third party data processors to ensure that personal data is securely stored and correctly handled.
14. The Inquiry will also need to share personal information with individuals or organisations which could assist the Inquiry with its investigations. This may include experts who are asked to provide advice to the Inquiry.
15. The Inquiry may also be required to share information with third parties in order to comply with any legal obligations.
Handling, Storage and Destruction of Information
16. The Inquiry will store personal information securely. All members of the Inquiry will receive training on their obligations in handling personal data.
17. The Inquiry will only retain personal information for as long as it requires to fulfil its public task and to meet the Terms of Reference.
18. The Inquiry will publish a report of its findings and recommendations. Once it has done so, some of the documents obtained or created by the Inquiry will be preserved as part of the public record.
19. Subject to the exceptions set out below, the Inquiry will destroy any documents which it has gathered or created once it comes to an end. Documents will not be destroyed if they are preserved for the public record, where an individual requests the return of an original document or where the Inquiry is required to share or keep a document to comply with any regulation or law.
What are your rights?
20. You are entitled to request information about how your personal data is processed by the Inquiry. You are also able to request a copy of that personal data, to ask for corrections to be made to it. In some circumstances, you may ask for your personal data to be deleted.
21. All requests should be sent to the Inquiry’s Data Protection Officer, using the contact details below.
22. If you have comments or queries about this privacy notice, please contact the Inquiry at firstname.lastname@example.org. If you have any queries about this policy or the way that the Inquiry uses personal data, please contact the Inquiry’s Data Protection Officer, email@example.com.
23. The Inquiry is registered with the Information Commissioner’s Office as a data controller. Details of the Inquiry’s registration, number ZB065538, can be viewed at www.ico.gov.uk.
24. If you wish to make a complaint about the way the Inquiry handles your personal data, you can contact the Information Commissioner’s Office at www.ico.org.uk.