Appropriate Policy Document

Introduction

1. This document outlines how the Lampard Inquiry (‘‘the Inquiry’’) will process and protect Special Category Data and Criminal Offences Data.

2. The document meets the requirement set out at paragraph 5 of Schedule 1 to the Data Protection Act 2018 (“the DPA 2018”) that an Appropriate Policy Document be in place where the processing of Special Category Data and Criminal Offence Data is necessary for reasons of “substantial public interest”.

Special Category Data

3. Special Category Data is defined by Article 9 of the General Data Protection Regulation UK (“the UK GDPR”) as personal data which reveals:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data for the purpose of uniquely identifying a natural person
• data concerning health
• data concerning a natural person’s sex life or sexual orientation.

Criminal Offence Data

4. Criminal Offence Data, as provided for by Article 10 of the UK GDPR, is personal data relating to criminal convictions and offences, or related security measures, and, in accordance with section 11(2) of the DPA 2018 includes personal data relating to:

• the alleged commission of offences by the data subject, or
• proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.

Purpose of Processing

5. The Inquiry is a statutory inquiry having been converted pursuant to section 15 of the Inquiries Act 2005 (“the 2005 Act”). The Inquiry is investigating the matters set out in its Terms of Reference and does so within the legal framework set down by the 2005 Act. The Inquiry intends also to apply the Inquiry Rules 2006 (“the Inquiry Rules’’).

6. The Inquiry processes Special Category Data and Criminal Offence Data for the purposes of its investigations and to enable it to carry out its work, including the conduct of hearings. Those hearings, save for in circumstances required and/or permitted by law, will be held in public and so evidence (which may include Special Category Data and Criminal Offence Data) referred to at hearings, may become publicly available. Such data may also be contained in the Report of the Inquiry. 

7. Further information as to the types of information processed by the Inquiry, how it is processed, and individuals’ rights can be found in the Inquiry’s Privacy Notice here.

Lawful Basis for Processing

8. The Inquiry processes personal data on the following lawful bases, as set out in the UK GDPR:

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e))
• Processing is necessary for compliance with legal obligations (Article 6(1)(c))
• In the case of providers of services to the Inquiry, the processing being necessary for the performance of a contract to which the person is a party (Article 6(1)(b))
• In some limited cases when notification will be given in advance, consent (Article 6(1)(c)).

9. When the Inquiry processes Special Category Data, it does so under the following lawful condition, as set out in UK GDPR Article 9:

• processing is necessary for reasons of substantial public interest (Article 9(2)(g)), for the purpose of exercising a function conferred by an enactment or rule of law of the United Kingdom (DPA 2018, Section 10(3) and Schedule 1 paragraph 6), namely the Inquiries Act 2005 and Inquiry Rules 2006.

10. Article 10 of the UK GDPR permits the processing of Criminal Offence Data under the control of official authority or where the processing is lawfully authorised. The Inquiry therefore processes Criminal Offence Data under Article 10 of the UK GDPR by exercising the official authority vested in it by the Inquiries Act 2005 and Inquiry Rules 2006 and/or as lawfully authorised by the DPA 2018.

11. Section 10(3) of the DPA 2018 provides that in order for the processing of Special Category of Data and Criminal Offence Data to be necessary for reasons of substantial public interest, under Article 9(2)(g) of the UK GDPR, such processing must meet one of the conditions set out in Part 2 of Schedule 1.

12. Section 10(5) of the DPA 2018 provides that in order for the processing of Criminal Offence Data to meet the requirement in Article 10 that it is authorised by UK law, it must meet a condition in Part 1, 2 or 3 of Schedule 1 to the DPA 2018.

13. The Lampard Inquiry processes Special Category Data and Criminal Offence Data in order to meet its statutory purposes in accordance with paragraph 6 of Part 2 to Schedule 1, although in this context, the requirement for the processing of criminal offence data to be necessary for reasons of substantial public interest is removed: DPA 2018, Schedule 1, paragraph 36. 

Accountability

14. The Inquiry is a data controller and maintains a Record of Processing Activities in accordance with paragraphs 1 and 2 of Article 30 of the UK GDPR and section 61 of the DPA 2018. As required by law, the Inquiry undertakes appropriate data protection risk and impact assessments.

15. The Inquiry is responsible for complying with the principles relating to the processing of personal data as set out in Article 5 of the UK GDPR:

1. Lawfulness, Fairness and Transparency
   The Inquiry will ensure that personal data is only processed where a lawful basis applies, and/or where processing is otherwise lawful. The Inquiry will process personal data fairly and ensure that data subjects are not in any way misled as to the purposes for processing their personal data. The Inquiry will process personal data with transparency, including by the publishing of information in the Inquiry’s Privacy Notice here.
2. Purpose Limitation
   The Inquiry will collect and process personal data only for specified, explicit and legitimate purposes consistent with the Inquiry’s Terms of Reference. The Inquiry will not process personal data for purposes that are incompatible with the purposes for which it was collected unless it is required and/or permitted to do so by relevant legislation. Further information as to the purposes for which personal data is collected and processed can be found in the Inquiry’s Privacy Notice here.
3. Data minimisation
   The Inquiry will only collect personal data that is relevant, and limited to that which is necessary for the purposes for which it will be processed. The Inquiry will satisfy itself that it has sufficient data to fulfil those purposes. The Inquiry will regularly review the personal data that it has collected to ensure that it is relevant and sufficient but that it is limited only to what is required.
4. Accuracy
   The Inquiry will ensure that personal data collected is accurate and kept up to date. The Inquiry will consider any requests concerning the accuracy of the data it holds to ensure compliance with the individual’s right to rectification.
5. Storage Limitation
   The Inquiry will only keep personal data in a form which identifies the data subject until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal data will be transferred for the purposes of indefinite retention of the Inquiry Records to the relevant Government Department or appropriate Public Record Office, in accordance with Rule 18 of the Inquiry Rules and the requirements of the Public Records Act 1958. Personal data that is not required for archiving purposes will be destroyed or anonymised when no longer required.
6. Integrity and Confidentiality
   The Inquiry will ensure that appropriate organisational and technical measures and controls are in place to protect and safeguard personal data. The Inquiry will ensure that personal data is shared only with those who are required to see it as part of the Inquiry’s process. Personal data will only be disclosed to third parties and/or contractors with specific instructions and once the Inquiry has secured agreement that the information will be kept confidential and secure. The Inquiry will keep under review at all times whether processing or disclosure of particular personal data is necessary to enable it carry out its work.

Review

16. This policy will be reviewed regularly. If this policy requires amendment during the course of the Inquiry, an updated version will be published on the Inquiry’s website at the earliest opportunity. Any amendments will be subject to the review and approval of the Chair.

Further information

17. If you have any queries about this policy or the way that the Inquiry uses personal data, please contact the Inquiry’s Data Protection Officer via email at: contact@lampardinquiry.org.uk.

Updated July 2024

You can download a copy of our Appropriate Policy Document here.