Brook House Inquiry Privacy Notice
The Brook House Public Inquiry (the Inquiry) is an independent public inquiry exercising statutory functions in the public interest, under the Inquiries Act 2005. The Inquiry is the data controller for your personal information.
This privacy notice explains how the Inquiry will use your personal information (also referred to as personal data), who it may be shared with and your rights. The Inquiry is committed to handling personal information in compliance with data protection legislation.
What personal information does the Inquiry need to collect and why?
Purposes of data collection
The Inquiry is investigating the decisions, actions and circumstances surrounding the mistreatment of detainees broadcast in the BBC Panorama programme ‘Undercover: Britain’s Immigration Secrets’ on 4 September 2017. The matters the Inquiry are investigating are set out in its Terms of Reference.
In order to carry out its investigation, conduct its hearings and discharge its duties under the Inquiries Act 2005, the Inquiry will need to collect and process personal information.
The hearings, except in exceptional circumstances and as required by law, will be held in public and evidence referred to at hearings will become publicly available. Personal information may also be contained in the Report of the Inquiry, which will be published after the conclusion of the hearing.
The Inquiry may receive information about you in a number of ways. Information may be requested from organisations involved in the Inquiry or it may be submitted voluntarily. For example, the Inquiry may have requested and been granted access to information held by third parties who are connected to the subject matter of the Inquiry, such as G4S and the Home Office. The Inquiry also has powers to compel an individual or organisation to provide the requested information.
The Inquiry will continue to gather evidence containing personal information in advance of and during the hearings.
The Inquiry will process personal information of:
- Core Participants, within the meaning of the Inquiries Act 2005
- Witnesses or parties who provide evidence to the Inquiry
- Witnesses who access well-being support by Hestia
- Contracted parties to the Inquiry
- Members of the public who contact the Inquiry.
The Inquiry will process a different categories of personal data. This will include:
- Personal data, including biographical data such as name, date of birth, personal description, contact details, images and voice recordings.
- Special category data, including data relating to health, race/ethnicity, religious beliefs and Trade Union membership.
- Personal data relating to criminal convictions and offences – this personal data is subject to strict controls.
The Inquiry will keep your information secure and will only share it with those who are required to see it as part of the Inquiry. All personal information we receive will be handled fairly and lawfully in accordance with data protection legislation.
Legal basis for processing
The Inquiry will only share personal information with third parties when it can do so lawfully or it has consent to do so. The Inquiry’s lawful basis for processing personal and special category personal data:
- The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Chair has official authority to perform the core function of the Inquiry to investigate the matters falling within the Inquiry’s terms of reference. This is provided for under Article 6(1)(e) of the GDPR.
- The processing of evidentiary material is necessary for compliance with legal obligations, which is provided for under Article 6(1)(c) of the GDPR. This includes section 18 (1) of the 2005 Act that provides, subject to restrictions notices, public are to have access to inquiry proceedings and information.
- For providers of services to the Inquiry, the legal basis for processing your personal information will normally be that it is necessary for the performance of a contract to which the inquiry is a party.
- The legal basis for processing special categories data is that it is necessary for reasons of substantial public interest, including the exercise of a function conferred by an enactment or rule of law (i.e. the Inquiries Act 2005), to the extent that it is necessary. This is provided for by Article 9 GDPR and section10 of the Data Protection Act 2018. In some limited cases, we may also ask for the consent of the data subject.
Where the Inquiry is required to process personal information relating to criminal convictions or offences, the processing must be considered necessary for the exercise of a function conferred on the Chair by the Inquiries Act 2005 and the Inquiry Rules 2006. This is provided for by Article 10 GDPR and s. 10(5) of the DPA 2018.
Who we share your data with and why?
An inquiry is publicly accessible, so your personal data may be shared publicly. There are clear processes, including robust redactions processes, in place which govern the protection of your personal information. This is to ensure only information necessary for the Inquiry’s performance of its functions will be disclosed outside the Inquiry or to those instructed by the Inquiry. During the course of undertaking the statutory duties of the Inquiry, your information may be shared by the Inquiry with the following main groups:
- Counsel to the Inquiry
- Solicitor to the Inquiry
- Legal representatives of the Core Participants
- Core Participants
- Expert Witnesses appointed by the Inquiry
- Assessors appointed by the Inquiry
- Third party data processors (such as providers of IT infrastructure or electronic disclosure platforms)
- The public via the Inquiry website or via published reports under s.25 of the 2005 Act
- (where applicable)
- Personal information submitted to the Inquiry may be transferred to IT systems operated by third party data processors for the purposes of storing, reviewing and analysing documents and information. The Inquiry has appropriate technical and organisational measures in place with its data processors, which means they cannot do anything with your personal information unless the Inquiry has instructed them to do it. They will not share your personal information with any organisation apart from the Inquiry, or as directed by the Inquiry. They will hold your personal information securely and retain it for the period the Inquiry requires.
At the conclusion of the Inquiry, information that is to be retained as part of the historic record will be transferred to the National Archives.
We may also share personal information where we are under a legal obligation to do so, or where it is necessary to assist with a criminal investigation to allow other organisations to comply with their statutory functions.
How long will the Inquiry keep your personal information?
Personal information will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal information held by the Inquiry will be transferred for the purposes of indefinite retention of Inquiry records by the National Archives in accordance with the Public Records Act 1958.
What are your rights?
All individuals have a number of rights under the GDPR. This includes the right to request:
- Information about how your personal data is processed and to request a copy of that personal data. This also known as a subject access request.
- Any inaccuracies in your personal data are rectified without delay.
- Any incomplete personal data is completed, including by means of a supplementary
- Your personal data is erased if there is no longer a justification for them to be processed.
- Processing of your personal data is restricted.
- If we are relying on your consent, withdraw consent to the processing of your personal data at any time.
- Object to the processing of your personal data.
- Where we are relying on your consent, or a contract with you, request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.
Any objections will be considered in the context of the Inquiry’s statutory duties and the necessity of processing personal information for that purpose. There are some exemptions, which means we may not always be able to comply with your request in your entirety.
You can exercise your rights by contacting the Inquiry at the details provided below and making a request. You may be asked to provide the Inquiry with proof of your identity before any request can be processed.
Your personal information is stored on the Inquiries’ IT infrastructure and also shared with our data processors. Information may be transferred and stored securely outside the European Economic Area.
Where that is the case, all appropriate technical and legal safeguards will be put in place to ensure you are afforded with same level of protection.
Who can I contact for more information?
Data Protection Officer
The Inquiry’s Data Protection Officer is Ms Yinka Williams. The Data Protection Officer can be contacted DPO@brookhouse.staging.wp.dsd.io or Freepost BROOK HOUSE INQUIRY
If you consider that your personal information has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
The Information Commissioner can be contacted at 0303 123 1113 or at:
Information Commissioner’s Office
Review of this notice
This notice will be regularly reviewed and may be subject to revision. This version of the Privacy Notice was last updated 1st April 2020.