Statement of approach: Redaction, Data Protection and Privacy

Baroness Kate Lampard CBE, 1 October 2024

Introduction

During the course of its investigations, the Inquiry will receive a wide range of material containing personal data, including special category and criminal offence data. It must store and process this information fairly and lawfully, in accordance with data protection legislation, including the Data Protection Act 2018 and the UK General Data Protection Regulation.

Terms of Reference

Written into the Inquiry’s Terms of Reference is a particular provision which states that the Inquiry is required to share or make personal information public only as is necessary and proportionate for it to fulfil its Terms of Reference (paragraph 10). These Terms define the scope of the Inquiry and set out the issues and parameters for investigation. I am bound to act in accordance with them, as is the rest of the Inquiry team.

Privacy and Appropriate Policy Notices

The Inquiry has published two Notices on its website which set out why, how and in what way the Inquiry will receive and handle personal data and ensure special category data and criminal offence data is properly processed and protected. These can be accessed here and here. I do not intend to repeat the content of the Notices in this Statement, however I do wish to remind all those engaging with the Inquiry, as well as those whose personal information may be shared during the course of investigations, that all personal data will be processed lawfully, fairly and transparently.

The Inquiry will only request personal data and information relating to those who are now deceased when it is potentially relevant. Requests will also be limited to that which is necessary and proportionate for the Inquiry to fulfil its Terms of Reference. Equally, data will only be shared with those who are required to see it as part of the Inquiry’s processes. I do encourage those who may have concerns to read our Notices in full, and to contact the Inquiry should any points for clarification arise.

Purpose of this Statement

In order to investigate matters properly in accordance with its Terms of Reference, and to comply with my duty under section 18 of the Inquiries Act 2005 to take reasonable steps to make Inquiry proceedings and records public, the Inquiry may need to disclose certain pieces of information (which would include personal data and information about those who are now deceased) to others.

The purpose of this Statement is for me to set out how the Inquiry will share such information with Core Participants, witnesses, contracting parties, and members of the public. It is intended to reassure those whose data is held by the Inquiry, as well as the friends and families of those who are now deceased whose information is held by the Inquiry, that personal and sensitive information will be properly and appropriately handled at all stages.

Receipt

It is anticipated that the Inquiry will receive a wide range of documentation, some of which may not contain any personal data or information relating to those who are now deceased. However, the Inquiry is investigating the deaths of particular individuals, seeking evidence from their families and friends, and reviewing material associated with the care and treatment they received. The Inquiry has also stated that all potentially relevant documentation should be provided in complete and unredacted form. It is therefore inevitable that information will be received by the Inquiry which engages the laws on data protection and privacy.

Process

As is set out in the Inquiry’s Protocol on Documents, accessible here, on receipt of any documentation the Inquiry will initiate a process for secure handling. While it is said that any document or information contained in a document may be disclosed to Core Participants or published on the Inquiry website, I should add that this will always be subject to paragraph 10 of the Inquiry’s Terms of Reference, to which I have referred above.

Disclosure for Investigative Purposes

In order to progress its investigations and meet its Terms of Reference, it is anticipated that the Inquiry team will disclose documents which it considers to be relevant and necessary to Core Participants and witnesses (and, where represented, their legal advisers). The team might also need to share data with third party contractors – including, but not limited to, expert witnesses, assessors and other third-party data processors, such as those who are involved in running the Inquiry’s secure document management site.

These documents may contain personal data and information relating to those who are now deceased. In respect of each document for which disclosure is thought relevant and necessary, the Inquiry will assess and consider the balance that needs to be struck between the need to disclose information, and the data protection and privacy rights of the individual(s) involved. Clearly, special category data – for example that which relates to a person’s race, religious beliefs or health – brings with it added sensitivities and the need for increased scrutiny by the Inquiry team.

Where required, redactions will be applied in accordance with Restriction Orders I have made, or will make, under section 19 of the Inquiries Act 2005. Subsection (3) sets out that I must only restrict the disclosure or publication of information when required by law, or where I consider it would be helpful to the Inquiry to fulfil its Terms of Reference or necessary in the public interest. This is because of my duty under section 18 of the Inquiries Act 2005, which I have mentioned above. Further information on Restriction Orders can be found in the Inquiry’s Protocol on Restriction Orders, Redaction, Anonymity and Special Measures, which can be accessed here.

Alongside this Statement of Approach, I have published a general Restriction Order – Restriction Order No. 12 (Data Protection and Privacy). This is to ensure that, where redactions are applied, they are applied in accordance with the rules of law relating to data protection and privacy. It is also to ensure that personal and sensitive information relating to those who are now deceased is not shared unnecessarily. This is because I am aware of general guidance and policy on patient confidentiality, and that documents may well contain personal and sensitive information about a deceased individual that it is not necessary or proportionate for the Inquiry to disclose to fulfil its Terms of Reference.

Further, I am mindful of my duties under section 17 of the Inquiries Act 2005 and the need to ensure that the Inquiry progresses effectively. It may be disproportionate for the Inquiry to redact large amounts of personal information, however I wish to reassure all those involved that the Inquiry will always take a careful and considered approach when documents are being shared with Core Participants, witnesses and third parties.

Where the Inquiry intends to disclose highly damaging and/or particularly sensitive information and the data subject (i.e. the person to whom the data relates) is still living and is readily contactable by the Inquiry, the Inquiry will – as a general rule – attempt to make contact, and afford them a reasonable chance to object to disclosure. There may be situations where it is considered impractical or inappropriate for the Inquiry to make contact. There may also be situations where, despite objection, it is still considered necessary by the Inquiry for that individual’s data to be disclosed in order to properly investigate matters and to meet its Terms of Reference. In such circumstances, the Inquiry will consider whether it may be appropriate to provide a summary or gist of the information.  

Moreover, personal data and information relating to those who are now deceased will only be shared with those who have agreed to keep such data and information confidential. Undertakings, which require the recipient to keep the contents of any disclosure made confidential, will be obtained by the Inquiry from all those with whom it engages before documents are shared. No document(s) will be disclosed to any Core Participant, witness, or third party who refuses to abide by the terms of this agreement.

Where the recipient of a document considers it necessary to share that document with another, they must inform the Inquiry and I, on the advice of my Legal team, will determine whether it is necessary and proportionate for it to be shared.

Disclosure to Core Participants and Witnesses for Hearings and Publication

The position in respect of disclosure of documents to Core Participants and witnesses for hearings, and to the public more generally, is slightly different. I am conscious of the fact that this Inquiry has been set up to get to the truth of what happened and to make recommendations that will bring about positive change. As I have set out above, I am also aware of my duties under section 18 of the Inquiries Act 2005 to secure public access to evidence and proceedings, and of the principle of open justice. Nevertheless, I am mindful that the sharing or publication of personal data, including special category and criminal offence data, and information relating to those who are now deceased, might not always be necessary and proportionate for the Inquiry to fulfil its Terms of Reference. Further, I am keen to maintain privacy, where possible, and to balance this with the Inquiry’s need to meet its Terms of Reference.

Before a document containing personal and sensitive information is shared with Core Participants and witnesses or published – regardless of whether it relates to a living individual or to someone who is now deceased – the Inquiry will consider whether its publication is necessary and proportionate, in accordance with paragraph 10 of the Inquiry’s Terms of Reference, and whether there is any other legal bar to it being shared or published. My team will assess and consider the balance that needs to be struck between the need to disclose information, and the data protection and privacy rights of the individual(s) involved. This is regardless of the type or category of data that might be made available. Redactions may be applied as a result, or a summary provided by the Inquiry team. Consideration will also be given to what is already in the public domain.

Where the Inquiry intends to share or publish documents containing highly damaging and/or particularly sensitive information which remains unredacted, and if the data subject (i.e. the person to whom the data relates) is still living and is readily contactable by the Inquiry, the Inquiry will – as a general rule – attempt to make contact, and afford them the chance to object. There may be situations where it is considered impractical or inappropriate for the Inquiry to make contact. There may also be situations where, despite objection, it is still considered necessary and proportionate by the Inquiry for that individual’s data to be shared or published. In such circumstances, the Inquiry will consider whether it ought to provide a summary of the information.

Conclusion

I am satisfied that the above approach is in line with the Inquiry’s Terms of Reference, and that it fairly sets out how the Inquiry will lawfully process personal data and information relating to those who are now deceased. I repeat that it will only be shared or made public where it is considered relevant, necessary and proportionate.

I would again like to express my gratitude to all those engaging with the Inquiry. I am aware of the importance of the matters under investigation and repeat that I intend to deliver a thorough, robust and meaningful report.