Privacy Notice

Introduction

1. The Andrew Malkinson Inquiry (“the Inquiry”) is an independent non-statutory inquiry into the miscarriage of justice suffered by Mr Andrew Malkinson. It is chaired by HHJ Sarah Munro KC (“the Chair”). The Terms of Reference (“ToR”) of the Inquiry were published on 26 October 2023 and are set out here: https://andrewmalkinson.independent-inquiry.uk/terms-of-reference/
2. In relation to the Inquiry, the Chair is the Data Controller for your personal data.
3. The purpose of this Privacy Notice is to set out the approach that will be taken by the Inquiry to the collection and use of personal data in relation to its ToR. It is made under Articles 13 and/or 14 and Article 30 of the United Kingdom General Data Protection Regulation (UK GDPR). It sets out how the Inquiry will process your personal data during the Inquiry’s work, the legal basis for the Inquiry’s processing of personal data, who personal data may be shared with, and your rights.
4. It may be necessary to amend this Privacy Notice or to supplement it with further notices to keep it up to date if required. In this event the amended or supplemental Privacy Notice will be published on the Inquiry’s website.

What data will be collected and processed, and why

5. Personal data will be collected, recorded and organised by the Inquiry. Information including personal data will be requested by the Inquiry from relevant individuals / organisations and may be submitted voluntarily e.g. by witnesses and or members of the public.
6. The Inquiry will collect and process personal data in order to:

1. make contact with witnesses and Material Providers;
2. fulfil the ToR; and
3. respond to any question or issue raised about our work.

7. Typically, the Inquiry will process personal data received from:

1. Agencies, organisations, their servants or employees, or witnesses providing material to the Inquiry, or which are contacted by the Inquiry in connection with matters under investigation by the Inquiry;
2. Any individual referred to in information provided to the Inquiry as part of its investigations;
3. Any other Government department, public body, organisations, their servants or employees, or individuals including experts who may hold relevant information that may assist the Chair in fulfilling the Inquiry’s ToR;
4. Anyone who works for or with the Inquiry, including providing goods or services;
5. Contracted parties and/or experts or advisors to the Inquiry; and
6. Anyone who contacts the Inquiry by email or post or in any other way.

8. The organisations will include, but are not restricted to:

1. Greater Manchester Police;
2. Crown Prosecution Service;
3. Criminal Cases Review Commission;
4. Independent Office of Police Conduct;
5. Manchester Crown Court;
6. Court of Appeal;
7. Forensic Science Service (closed in March 2012 and casefiles from all investigation work previously undertaken are now retained and managed by the Forensic Archive Ltd);
8. Forensic Science Regulator; and
9. APPEAL.

9. The following is a non-exhaustive list of categories of personal data that will be processed in relation to the Inquiry’s core functions:

1. Personal data – typically biographical data such as name, date of birth, personal description, contact details, vehicle registration numbers, images and voice recordings. Personal data will also include details of how any alleged offences were investigated, information relating to the suspects in the offences reported resulting in Andrew Malkinson’s convictions, details of prosecutions, former convictions and sentencing, information relating to the conduct and performance of police officers.
2. Special Category Data – this will typically include data relating to health (such as physical health, mental health, injuries and medical treatment), biometric data, genetic data, data relating to race/ethnicity, religious beliefs, and details of individuals’ sex life or sexual orientation.
3. Criminal Records Data – this includes personal data relating to criminal prosecutions, convictions, sentences; charges that did not lead to prosecution; incident reports and actual or alleged criminal offences.

The legal basis for processing personal information

10. The Inquiry processes personal data in accordance with its obligations under the Data Protection Act 2018 (DPA 2018) and UK General Data Protection Regulation 2018 (UK GDPR).
11. In respect of the core functions of the Inquiry:

1. Non-Special Category Personal Data

12. The primary legal basis relied on for lawful processing by the Inquiry of personal data is Article 6 (1)(e) UK-GDPR: processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Chair has official authority to perform the core function of the Inquiry in order to investigate the matters falling within the Inquiry’s ToR.

2. Special Category Data

13. Sensitive personal data (also known as special category data) is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The separate condition for the Inquiry processing special category data is under Article 9(2)(g) UK-GDPR: processing necessary for reasons of substantial public interest. This condition is met under paragraph 6, schedule 1 of the Data Protection Act 2018.

3. Criminal data

14. Criminal offence data processed by the Inquiry is authorised in domestic law, under paragraph 6, schedule 1 of the Data Protection Act 2018; the processing is necessary for reasons of substantial public interest for the exercise of a function conferred on a person by the exercise of a function of a Minister of the Crown. The function is the Inquiry’s work to fulfil its Terms of Reference.

Who the Inquiry may share personal data with and why

15. Personal data may be shared with third parties where this is necessary to fulfil the Inquiry’s ToR or for the performance of the Inquiry’s functions. There are clear and robust processes in place which govern the protection of personal data, including robust redactions processes. Only data necessary for the fulfilment of the Inquiry’s ToR or for the performance of its functions will be shared with third parties.
16. The main groups with whom personal data may be shared are:

1. Material Providers;
2. Witnesses;
3. Legal representatives of Material Providers and witnesses;
4. Expert witnesses appointed by the Inquiry;
5. Third party data processors (such as providers of IT infrastructure/services, secure data storage services, and/or electronic disclosure platforms/services);
6. The public via reports published by the Inquiry; and
7. Current and/or previous employers to obtain current or last known addresses for the purpose of obtaining current contact details of potential witnesses.

How long the Inquiry will keep personal data

17. Personal data will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry some of the personal data held by the Inquiry will, where it is considered to form part of the historic records, be transferred for the purpose of indefinite retention of Inquiry records by the National Archives and/or the Inquiry’s sponsoring department (Ministry of Justice), in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes will be securely destroyed.

Data Subject rights

18. Data subjects have a number of rights under the UK-GDPR in terms of Articles 12-23 – some of which are:

1. The right to request information about how your personal data is processed, and to request a copy of that personal data.
2. The right to request that any inaccuracies in your personal data is rectified without delay.
3. The right to request that any incomplete personal data is completed, including by means of a supplementary statement.
4. The right to request that your personal data are erased if there is no longer a justification for them to be processed.
5. The right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
6. The right to object to the processing of personal data.

These rights may be subject to exemptions or limitations. Requests are dealt with on a case-by-case basis.

Third Party Data Processing

19. Personal Data, provided to the Inquiry, may be transferred to third-party contractors providing services to it, such as the operation of IT systems used, or to allow the secure storage of information, as well as allowing the Inquiry to review and analyse information. The contractors will act as Processors acting on behalf, and under the control, of the Inquiry.

International transfers

20. Personal data is stored on our IT infrastructure, and managed with our data processor, will only be stored securely within the United Kingdom.

Freedom of Information

21. The Inquiry is not a public authority for the purposes of the Freedom of Information Act 2000 (“FOIA”) and will not disclose material in response to requests made pursuant to the FOIA. The Inquiry will, proactively, make information available regarding its policies and procedures, via its website, to enable the public to understand its work and how it operates.

Inquiry Contact

The Andrew Malkinson Inquiry can be contacted at:

Andrew Malkinson Inquiry
102 Petty France,
London,
SW1H 9AJ

Email: info@andrewmalkinsoninqury.uk

Data Protection

If an individual has any queries or complaints in respect of the Inquiry’s Processing of their Personal Data or wishes to exercise their individual legal rights in respect of any related Personal Data Processed by the Inquiry as set out in this document, please contact the Inquiry Data Protection Officer at the above postal address or

Email: DPO@andrewmalkinsoninqury.uk

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner’s Office,
Wycliffe House,
Water Lane, Wilmslow,
Cheshire,
SK9 5AF

Tel: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Review of this notice

This notice may be subject to revision. This version of the Privacy Notice was last updated on 30 May 2024.