The Public Inquiry into the death of Jalal Uddin (the Inquiry) is an independent public inquiry exercising statutory functions in the public interest, established under the Inquiries Act 2005. The Inquiry is the data controller for your personal information.
This privacy notice explains how the Inquiry will use your personal information (also referred to as personal data), who it may be shared with and your rights. The Inquiry is committed to handling personal information in compliance with data protection legislation.
Who we are
The Jalal Uddin Inquiry was established in order to identify where responsibilities lie for the death of Jalal Uddin and to make appropriate recommendations. The Inquiry will process personal data in order to fulfil its Terms of reference.
What is personal data
Personal data is anything that identifies an individual. It may include names, addresses, contact details or description of a person that could lead to their identification. As a data controller, the Inquiry has a duty to consider the impact of releasing such data on individuals, in line with the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR) 2018
The DPA and GDPR require that organisations pay particular attention to sensitive personal data (also known as special category data) which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
What we use your personal data for
The Inquiry will collect and use personal data for the following reasons:
- to develop an evidence base for the Inquiry’s work
- to communicate with external stakeholders, including officials, journalists, providers of evidence, core participants and witnesses
- to deal with public correspondence
- to respond to data protection requests from individuals (also known as subject access requests or SARs)
- to provide the public with information about the Inquiry through social media channels
- to operate and maintain the Inquiry’s website
What personal data is collected
- Evidence to the Inquiry may include: name, address, email address, job title, employer, opinions, health information, criminal convictions and any other sensitive information you volunteer about yourself or others. Evidence may also include personal data about identifiable individuals that are provided by government bodies or other institutions.
- External communications with stakeholders may include: name, address, email address, job title (where these are provided by you), and employer (where provided by you)
- Contact information and details collected to facilitate the collection of evidence to, or involvement with, the Inquiry. This will include information if you are someone who contacts the Inquiry, whether through the email address given on the Inquiry’s website, by telephone or in any other way
- When you contact us, we may collect: name, address, email address, details of any concerns raised in your correspondence, and any other information you volunteer about yourself or others. This may include special category data or data about criminal convictions, if you volunteer such information
- If you make a data protection request (also known as a subject access request), we will collect: name, address and/or email address, your request, documents needed to verify your identity.
- The Inquiry’s social media channels may include: names, email addresses, photographs, videos, social media handles, opinions, and any other data volunteered by you, including sensitive personal data.
How we handle your personal information
We keep your information secure on our IT infrastructure and only share it with those who have a need to see it and may be transferred to IT systems operated by third party data processors for the purposes of storing, reviewing and analysing documents and information. All personal information we receive is handled fairly and lawfully in line with data protection legislation.
Who we share data with
We share data received as part of the Inquiry’s investigation with core participants and redactions are applied in material that is adduced during the Inquiry’s public hearings and relied upon by the Chairman in his report is also made available on the Inquiry’s website. At times, it may not be possible to hold hearings in public. In these cases, data will be shared or restricted as set out in any notice issued under section 19 of the Inquiries Act 2005.
Personal Data, provided to the Inquiry, may be transferred to third-party contractors providing services to it, such as the operation of IT systems used, or to allow the secure storage of information, as well as allowing the Inquiry to review and analyse information. The contractors will act as Processors acting on behalf, and under the control, of the Inquiry
We may also share personal information where we are under a legal obligation to do so, or where it is necessary to assist with a criminal investigation to allow other organisations to comply with their statutory functions.
International transfers
Personal data is stored on our IT infrastructure and Third party processor’s system, managed jointly with our data processor, and will only be stored securely within the United Kingdom.
How long we keep your personal data
Personal data will be held for as long as it is required for the purpose for which it was collected.
Personal data collected as part of evidence will be held by the Inquiry until it concludes its work. At the end of the Inquiry, some of the personal data it holds will – where it is considered to form part of the historical record – be selected for permanent preservation at The National Archives in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes may be retained by the Inquiry’s sponsoring department for a limited period for audit or accountability purposes and will then be destroyed. As far as possible, personal data collected by the Inquiry will be destroyed when the Inquiry closes.
Personal data held in stakeholder communications will be deleted at the close of the Inquiry. However, correspondence may be kept if it is considered sufficiently significant that it should be retained for the historical record.
Personal information in correspondence will be deleted at the close of the inquiry. However, public correspondence may be kept if it is considered sufficiently significant that it should be retained for the historical record.
Personal data held in relation to data protection requests will be deleted at the close of the Inquiry. Documents used to verify identity will be deleted once identity has been verified.
Inquiry website and cookies
The operation of the Inquiry website www.jalaluddin.independent-inquiry.uk, to provide information about the Inquiry to the public. The Inquiry may post updates and other non-personal data on its website to ensure that the Inquiry is run in an accountable and transparent manner. The Inquiry will also post evidence presented in open hearings to its website.
To ensure the effective operation of the Inquiry, the website deploys cookies technology which can analyse individual visits to the website and how it is used, but only during their current actual visit to the website. For further information, please see the Inquiry Website’s cookie policy, available at www.jalaluddin.independent-inquiry.uk/cookie-policy
This privacy statement applies only to the Jalal Uddin Inquiry website, it does not cover links within the site to other websites.
The legal basis for processing personal data
For the majority of personal data we process, our legal basis for processing your personal data is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the Inquiry’s work to fulfil its Terms of Reference
The processing of evidentiary material is necessary for compliance with legal obligations, which is provided for under Article 6(1)(c) of the GDPR. This includes section 18 (1) of the 2005 Act that provides, subject to restrictions notices, public are to have access to inquiry proceedings and information.
Where we post personal data on social media relating to inquiry activity, our legal basis is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). Where we process personal data generated by social media users, the legal basis for processing that personal data is because the user consents to us doing so (Article 6(1)(a) UK GDPR).
The legal basis for processing your personal data in order to respond to data protection requests is that it is necessary to comply with a legal obligation placed on the Inquiry as the data controller (Article 6(1)(c) UK GDPR).
The legal basis for processing special categories data (also known as Sensitive Personal Data) is that it is necessary for reasons of substantial public interest, including the exercise of a function conferred by an enactment or rule of law (i.e. the Inquiries Act 2005), to the extent that it is necessary. This is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or
trade union membership, and the processing of genetic data, biometric data for the
purpose of uniquely identifying a natural person, data concerning health or data
concerning a natural person’s sex life or sexual orientation. The separate condition
for the Inquiry processing special category data is under Article 9(2)(g) UK-GDPR:
processing necessary for reasons of substantial public interest. This condition is met
under paragraph 6, schedule 1 of the Data Protection Act 2018.
Criminal data – Criminal offence data processed by the Inquiry is authorised in domestic law, under paragraph 6, schedule 1 of the Data Protection Act 2018; the processing is necessary for reasons of substantial public interest for the exercise of a function conferred on a person by the exercise of a function of a Minister of the Crown.
Where the Inquiry is required to process personal information relating to criminal convictions or offences, the processing must be considered necessary for the exercise of a function conferred on the Chairman by the Inquiries Act 2005 and the Inquiry Rules 2006. This is provided for by Article 10 GDPR and s. 10(5) of the DPA 2018.
Your rights in relation to your personal data (Data Subject Rights)
- You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed.
- You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data where you believe that processing is unlawful, unfair or unnecessary. The Inquiry will balance objections against its obligation to perform its public task.
Requests are dealt with on a case-by-case basis. Your rights may be subject to exemptions or limitations.
Freedom of Information
The Inquiry is not a public authority for the purposes of the Freedom of Information Act 2000 (“FOIA”) and will not disclose material in response to requests made pursuant to the FOIA. The Inquiry will, proactively, make information available regarding its policies and procedures, via its website, to enable the public to understand its work and how it operates.
How to contact us
The data controller for your personal data is the Jalal Uddin Inquiry. The contact details for the data controller are Info-JalalUddinInquiry@jalaluddin.public-inquiry.uk. You can use this address to contact the data protection officer to make a data protection request (also known as a subject access request) or to raise any concerns regarding the Inquiry’s processing of your personal data.
The Data Protection Officer for the Inquiry is: Sue Curran
Complaints and appeals
If you have already made a complaint to us and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory authority responsible for data protection in the UK.
The Information Commissioner can be contacted at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Tel: 0303 123 1113 or email icocasework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Review of this notice
This notice will be regularly reviewed and may be subject to revision. This version of the Privacy Notice was last updated 24 April 2024