Privacy Information Notice – TEWV Public Inquiry

Introduction

1. The Tees, Esk & Wear Valleys NHS Foundation Trust Inquiry (the Inquiry) is a statutory inquiry under the Inquiries Act 2005 investigating failings in mental health care at Tees, Esk & Wear Valleys NHS Foundation Trust. This notice explains how the Inquiry collects and uses personal information.
2. This notice covers personal information collected or created by the Inquiry. In considering how it handles and uses personal information, the Inquiry has reviewed the best practice guidelines on records management, information retention, and handling sensitive material issued by the National Archives Office.
3. In order for the Inquiry to meet its Terms of Reference, it will be necessary for the Inquiry to obtain and use personal information in several ways. These include gathering information and evidence, obtaining witness statements, communicating with those affected by the Inquiry and the wider public, operating our website, the internal management of the Inquiry (for example the data of our staff) and complying with any legal obligations. Personal information may also be referred to within public hearings, published by the Inquiry on its website and included within the Inquiry’s final report.
4. The Inquiry expects to handle a wide range of material and documents within its investigations which may contain personal data. These may be provided voluntarily from individuals or organisations. The Inquiry also has powers to compel the provision of documents to assist in meeting its Terms of Reference. These documents may include (but are not limited to) letters, emails, electronic messages, medical records, notes, audio files, reports, witness statements, personnel records, minutes from meetings, policies, training records, information from websites, recordings and transcripts of evidence sessions and hearings.
5. This notice may be amended to reflect any changes in the Inquiry’s practices or to mention new types of information handled by the Inquiry. When that happens, an updated version of this policy will be made available on the Inquiry website.

Personal Data and Special Category Data

6. “Personal data” means any information relating to an identified living person, or which could be used to identify a living person. The Inquiry will collect personal data, such as names, contact details, financial and lifestyle information, images, voice and video recordings either directly from the person, or from individuals or organisations who may supply data about other people.
7. The Inquiry will also collect and process some more sensitive information, such as data relating to health, religious beliefs, racial or ethnic origin, trade union membership and matters relating to sex and sexual orientation. This is referred to as “special category data”. The Inquiry may also process sensitive personal data relating to criminal offences. Further information about how the Inquiry processes and protects these categories of data is set out in the Inquiry’s Appropriate Policy Document.
8. The Inquiry will also collect and process data in relation to those who are deceased. Whilst the provisions of data protection legislation only apply to those who are living, the Inquiry will treat the data of deceased individuals respectfully. The Inquiry will take into consideration any concerns raised by the families about how their data are collected and processed by the Inquiry.

Lawful Basis for Processing Data

9. The Inquiry processes personal information fairly and lawfully in accordance with data protection legislation, including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).
10. The Inquiry collects, stores, shares and uses personal information in order to carry out its work. The work of the Inquiry further to its Terms of Reference is a task carried out in the public interest, in accordance with the Inquiries Act 2005, which is a lawful basis for processing data under the data protection legislation (Article 6 (1)(e) UK GDPR).
11. Personal information provided to the Inquiry by an individual may be processed with their consent (which can be withdrawn) in accordance with Article 6 (1)(a) and Article 7 of the UK GDPR.
12. In addition to processing personal information with the consent of the individual, the Inquiry may process personal information on the alternative legal grounds set out in Article 6 (1) of the UK GDPR, including as set out in paragraphs 13 to 16, below.
13. Personal information provided to the Inquiry by a party it has entered into a contract with (for example, for administrative services required for the internal management of the Inquiry) may be processed in order to comply with contractual obligations (Article 6 (1)(b) UK GDPR).
14. Personal information may be processed where it is necessary for the Inquiry to comply with a legal obligation, such as the duty to ensure reasonable public access to information and evidence (Article 6 (1)(c) UK GDPR).
15. There may be occasions on which the Inquiry processes personal data on the grounds of vital interest (Article 6 (1)(d) UK GDPR). These would include situations in which information sharing is necessary in order to prevent a threat to life or significant harm to an individual, in accordance with the Inquiry’s Safeguarding Policy. In some instances, this may require the Inquiry to process special category personal data in relation to health in accordance with Article 9 (2)(c) UK GDPR.
16. It is necessary for reasons of substantial public interest for special category data, and for criminal offences data, to be processed by the Inquiry in accordance with Article 9 (2)(g) of UK GDPR. In fulfilling its Terms of Reference under the Inquiries Act 2005, the Inquiry will consider recommendations to reduce the risk of harm to members of the public and to address failings in mental health services in the Tees, Esk and Wear Valley area. It would not be possible to achieve this goal without processing this kind of data or by processing it in some lesser way.

Sharing Information

17. The Inquiry will need to share personal data with others. This may involve sharing information with third party data processors who provide information management, administrative services or support to the Inquiry, the data storage facilities of which may be based outside the EU. The Inquiry will require any third-party data processors to ensure that personal data is securely stored and correctly handled.
18. The Inquiry will also need to share personal information with individuals or organisations which could assist the Inquiry with its investigations and to meet its Terms of Reference. This may include members of the Inquiry team; individuals and organisations who are ‘Core Participants’ or otherwise involved in the Inquiry together with their legal advisors; experts or assessors who are asked to provide advice to the Inquiry and other organisations and individuals who are tasked to assist the Inquiry team in the operation of the Inquiry. The Inquiry may also share information with the general public (via Inquiry hearings or through evidence or information posted on the Inquiry website).
19. The Inquiry may also be required to share information with third parties in order to comply with any legal obligations or in accordance with its Safeguarding Policy.

Handling, Storage and Destruction of Information

20. The Inquiry will store personal information securely and handle such information fairly and lawfully in accordance with data protection legislation. All members of the Inquiry will receive training on their obligations in handling personal data.
21. The Inquiry will only retain personal information for as long as it requires to fulfil its public function and to meet the Terms of Reference.
22. The Inquiry will publish a report of its findings and recommendations. Once it has done so, some of the documents obtained or created by the Inquiry will be preserved as part of the public record, and as required transferred to the National Archives in accordance with the Public Records Act 1958.
23. Subject to the exceptions set out below, the Inquiry will destroy any documents which it has gathered or created once it comes to an end. Documents will not be destroyed if they are preserved for the public record, where an individual requests the return of an original document or where the Inquiry is required to share or keep a document to comply with any regulation or law.

What are your rights?

24. You are entitled to request information about how your personal data is processed by the Inquiry. You are also able to request a copy of that personal data, to ask for corrections to be made to it. In some circumstances, you may ask for your personal data to be deleted. You may in certain circumstances ask for the processing of your personal data to be restricted or to object to the processing of it.
25. All requests should be sent to the Inquiry’s Data Protection Officer, using the contact details below.

Further Information

26. If you have any queries about this policy or the way that the Inquiry uses personal data, please contact the Inquiry’s Data Protection Officer via email at TBC*
27. The Inquiry is registered with the Information Commissioner’s Office as a data controller. Details of the Inquiry’s registration, number TBC*, can be viewed on the ICO website.

Complaints about the use of your personal data

28. If you have concerns about how the Public Inquiry has handled your personal data, you can raise a complaint with us. You can do this by contacting our Data Protection Officer at TBC*
29. When you submit a complaint, please provide as much detail as possible about your concern and any relevant correspondence, so we can investigate effectively.
30. We will:

• acknowledge receipt of your complaint within 30 calendar days;
• investigate your concerns and keep you informed as appropriate; and
• provide you with a response explaining the outcome of our investigation.

31. If you remain dissatisfied with our response, you have the right to raise your complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection.

*Please note that this information will be updated as it becomes available. Find more information about what an Inquiry means and guidance for patients and service users.