1. This privacy notice tells you how the Independent Inquiry relating to Afghanistan (‘the Inquiry’) collects and uses personal information, and what you can expect the Inquiry to do with your personal information if it is passed to us.
The purposes for which the Inquiry processes personal information
2. The Inquiry is investigating the matters set out in its Terms of Reference. As a statutory public inquiry, the Inquiry is exercising statutory functions in the public interest under the Inquiries Act 2005.
3. In order to carry out its investigation, to conduct its hearings, and to discharge its duties under the Inquiries Act 2005, the Inquiry needs to collect and process personal information.
How the Inquiry collects personal information
4. Most of the personal information the Inquiry processes is collected / received by it for one or more of the following reasons:
- We are contacted directly. The Inquiry will collect and retain the contact details of those who write to or contact us.
- We collect and retain information about those who attend, or have attended, a meeting with the Inquiry team.
- We collect and retain information about those who represent an organisation (or who are a legal representative of an individual or organisation) and who are engaging with, or providing services to, the Inquiry.
- We collect and retain information about those who wish to give evidence to or to be a core participant to the Inquiry.
5. The Inquiry may also receive personal information in other ways. For example, as part of its investigations the Inquiry will request access to records from a range of sources, such as government authorities including the Ministry of Defence. Organisations or individuals may include personal information about others in their evidence to the Inquiry. In most cases information will be provided to the Inquiry on a voluntary basis, but in exceptional circumstances, the Inquiry may require the provision of evidence, including personal information, under section 21 of the Inquiries Act 2005. This would also be for the purposes of discharging its statutory functions.
Types of personal information that the Inquiry will receive
6. The personal data that the inquiry expects to receive will include, but may not be limited to:
(a) in relation to external communications or public correspondence; the name, address, email address, and job title (where provided) of the author, and details of the author’s employer (where provided). To the extent that an individual expresses views or opinions about the work of the Inquiry these will also be processed.
(b) in relation to evidence provided to the Inquiry; the name, address, email address, and job title (where provided) of the author, and details of the author’s employer (where provided). The evidence may in certain circumstances also include other types of personal data such as opinion, details of health, details of previous criminal convictions, or such other sensitive information as is volunteered or required by the Inquiry.
(c) in relation to subject access requests or other data protection requests made to the Inquiry by individuals; the name, address, email address, and job title (where provided) of the requestor, and details of the author’s employer (where provided).
The legal basis for processing personal information
7. It is necessary for the Inquiry to process personal information to enable us to carry out our work. There are three lawful bases on which the Inquiry may process personal data –
- where the Inquiry does so with the continuing consent of the individual to whom the personal data relates (Article 6(1)(a) below);
- where the Inquiry does so to comply with a legal obligation to which it is subject, for example responding to a subject access request under the Data Protection Act 2018 (Article 6(1)(c) below);
- Where it is conducting a public task carried out in the public interest in the exercise of a statutory function. Here these are the Chair’s functions under the Inquiries Act 2005; this basis will cover the vast majority of the Inquiry’s data processing (Article 6(1)(e) below).
8. As summarised above, the Inquiry processes personal information in accordance with one of the Articles 6(1)(a), (c), or (e) of the General Data Protection Regulation and s8 of the Data Protection Act 2018:
‘Personal data: Article 6 (1) Processing shall be lawful only if and to the extent that at least one of the following applies:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
…
- processing is necessary for compliance with a legal obligation to which the controller is subject;
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’
‘Data Protection Act 2018:
8 Lawfulness of processing: public interest etc
In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for—
…
(c) the exercise of a function conferred on a person by an enactment or rule of law …’
Processing special category data and data relating to previous criminal convictions
9. Separate legal considerations apply to the processing of ‘special category data’ under the General Data Protection Regulations and the Data Protection Act 2018. Special category data is defined under General Data Protection Regulation 9(1) as being data revealing:
‘racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, … the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.’
10. Sensitive personal information is processed because the processing is necessary for reasons of substantial public interest in the exercise of a statutory function.
11. Under paragraph 5 of Part 2 of Schedule 1 of the Data Protection Act 2018 there is a requirement for an appropriate policy document before any special category data may be processed. The Inquiry’s ‘policy’ document for the handling or personal data is substantively contained within this Privacy Notice, and within the Inquiry’s ‘Special Category and Criminal Conviction Personal Data Policy document’ where the data being processed relates to either special category data or details of previous criminal convictions.
Why does the Inquiry hold personal information and how will it use it?
12. Personal information is necessary for the Inquiry’s work and will be used by the Inquiry in several ways – for example:
(a) to gather evidence as part of the Inquiry’s investigations,
(b) to communicate with those who contact us,
(c) to establish, engage on, and comply with work under contracts made with third parties that the Inquiry needs to enter to pursue its work to conclusion,
(d) to manage relationships with its team members lawfully and effectively,
(e) personal information may also be contained in the Report of the Inquiry, which will be published at its conclusion.
13. The Chair of the Inquiry is the data controller for all personal information the Inquiry processes.
Sharing your information
14. We will share some documents received as part of the Inquiry’s investigation with core participants to enable them to participate in the Inquiry. These documents may be subject to restriction orders whereby parts of them are redacted and withheld from onward or public disclosure.
15. Material that is disclosed may include personal data, but we will not disclose special category personal data or other particularly sensitive data, other than to the original document provider, unless the Chair considers it necessary to do so to advance the work of the Inquiry.
16. Unrestricted material that is adduced during the Inquiry’s public hearings may be published on the Inquiry’s website.
17. Reference may be made to evidence received, including personal information, in decisions issued by, or in either an interim or final report published by the Inquiry. Such evidence may be subject to restriction from publication either outside of a limited audience or generally. We will not include in any publication special category personal data or other particularly sensitive data, unless the Chair considers it necessary to explain other matters which appear in the report.
18. The Inquiry will contract or have other arrangements with data processors who are third parties that provide services for us. Under the terms of the agreements / arrangements this means that they cannot do anything with your personal information unless the Inquiry instructs them to do so. They may not share your personal information with any organisation apart from the Inquiry. They must hold all our information securely and retain it for the period we instruct.
Inquiry Contact Details for data processing queries
19. There are several ways you can contact us, including by email. More details can be found on our contact page. You may be asked to provide the Inquiry with proof of your identity before any enquiry can be processed.
Where we keep your personal information
20. We keep your personal information secure and will only share it with those who have a need to see it. All personal information we receive is handled fairly and lawfully in line with data protection law.
How long will the Inquiry keep your personal information?
21. The Inquiry will generally retain information for the duration of the Inquiry depending on the purpose of gathering and using that personal information. At the end of the Inquiry, the Inquiry record will be transferred to The National Archives, or otherwise securely preserved, as required by law. Some records may be retained by the appropriate authority if the sensitivity of the information requires it. Thereafter it will be handled according to the safeguards in data protection law for archiving in the public interest.
Your data protection rights
22. Under data protection law (contained Articles 13-20 of the UK General Data Protection Regulations), individuals have rights over their personal data.
23. Individuals are entitled to:
- request information about how their personal data is being processed, and to request a copy of that personal data, subject to some exemptions.
- to request that the processing of their personal data is restricted in certain circumstances.
- to object to the processing of their personal data, they may also request that the Inquiry deletes their personal data, however, there are legitimate reasons why we may refuse to do so.
An individual is not required to pay any charge for exercising your rights. The Inquiry is permitted one month to respond to a request for information. Please contact the Inquiry’s Data Protection Officer if you wish to make a such a request.
Data Protection Officer contact details
24. The Data Protection Officer can be contacted by email. For further detail see Contact Us. Please title your email FAO DPO.
Your right to complain
25. The Inquiry works hard to protect your information and maintain high standards when it comes to processing your personal information. If you have any queries or concerns, please get in touch via Contact Us.
26. If you remain concerned about how your personal information is being processed, you can make a complaint to the Information Commissioner’s Office (ICO) as the UK supervisory authority. You can contact the Information Commissioner’s Office at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email to: casework@ico.org.uk
Telephone: 0303 123 1113