1. The Cranston Inquiry (the Inquiry) is an independent non-statutory inquiry into the circumstances of the mass casualty event incident which occurred on 24 November 2021 in the Dover Strait when a small boat attempted to cross the Channel, resulting in the loss of at least 27 lives.
2. The Inquiry is chaired by Sir Ross Cranston (“the Chair”). The Terms of Reference (“ToR”) of the Inquiry were published on 11 January 2024 and can be found here.
3. In relation to the Inquiry, the Chair is the data controller for your personal information.
4. The purpose of this Privacy Notice is to set out the approach that will be taken by the Inquiry to the collection and use of personal data in relation to its ToR. It is made under Articles 13 and/or 14 and Article 30 of the United Kingdom General Data Protection Regulation (UK GDPR). It sets out how the Inquiry will process your personal data during the Inquiry’s work, the legal basis for the Inquiry’s processing of personal data, who personal data may be shared with, and your rights. The Inquiry is committed to handling personal information in compliance with data protection legislation.
5. This Privacy Notice uses some terms and definitions which you may not be familiar with. To help you, these terms are shown in bold the first time they appear and are explained at the end of this Privacy Notice.
6. It may be necessary to amend this Privacy Notice to keep it up to date. In this event the amended Privacy Notice will be published on the Inquiry’s website.
What personal information does the Inquiry need to collect and why?
Purposes of data collection
7. The Inquiry is investigating the circumstances of the mass casualty event that led to the loss of at least 27 lives in the Dover Strait on 24 November 2021. The matters the Inquiry are investigating are set out in its ToR.
8. In order to fulfil its ToR (which will include carrying out an investigation and conducting hearings), the Inquiry will need to collect and process personal information.
9. The hearings will be held in public and evidence referred to at hearings (which may include personal information) will become publicly available (except where the Chair considers that there are circumstances which justify a private hearing, as set out in the Procedural Protocol). Personal information may also be contained in the Report of the Inquiry, which will be published after the conclusion of the hearing.
Data collected
10. The Inquiry may receive information about you in a number of ways. Information may be requested from organisations involved in the Inquiry or it may be submitted voluntarily. For example, the Inquiry may have requested and been granted access to information held by third parties who are connected to the subject matter of the Inquiry, such as HM Coastguard and the Home Office. The Inquiry will continue to gather evidence containing personal information in advance of and during the hearings. Typically, the Inquiry will process personal data received from:
- government departments, public bodies, organisations and agencies, their servants or employees;
- witnesses providing material to the Inquiry;
- contracted parties and/or experts or advisors to the Inquiry;
- an individual referred to in information provided to the Inquiry as part of its investigations;
- anyone who works for or with the Inquiry;
- anyone who contacts the Inquiry by email or post or in any other way.
11. The Inquiry will process different categories of personal data. This may include:
- personal data, including biographical data such as name, date of birth, personal description, contact details, images and voice recordings.
- special category data (personal data that needs more protection because it is sensitive), including data revealing or concerning health (such as physical health, mental health, injuries and medical treatment), race/ethnicity, religious or philosophical beliefs, sexual orientation, genetic data, biometric data, political opinions and Trade Union membership.
- personal data relating to criminal convictions and offences (including charges that did not lead to prosecution, incident reports and actual or alleged criminal offences) – this personal data is subject to strict controls.
12. The Inquiry will keep your information secure and will only share it with those who are required to see it as part of the Inquiry. All personal information we receive will be handled fairly and lawfully in accordance with data protection legislation.
Legal basis for processing
13. The Inquiry will only share personal information with third parties when it can do so lawfully or it has consent to do so.
14. The Inquiry’s lawful basis for processing personal data, special category data and personal information relating to criminal convictions and offences is as follows:-
- The Inquiry’s lawful basis for processing personal data is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Chair has official authority to perform the core function of the Inquiry to investigate the matters falling within the Inquiry’s terms of reference. This is provided for under Article 6(1)(e) of the UK GDPR.
- In addition to Article 6(1)(e) of the UK GDPR, the legal basis for processing special categories data is that it is necessary for reasons of substantial public interest. This is provided for by Article 9(2)(g) UK GDPR and is met under paragraph 6, schedule 1 of the Data Protection Act 2018.
- Where the Inquiry is required to process personal information relating to criminal convictions or offences, the processing is authorised in domestic law (as required by Article 10 UK GDPR) under section 10(5) and paragraph 6, schedule 1 of the Data Protection Act 2018. The processing is necessary for reasons of substantial public interest and is necessary for the purpose of the exercise of a function conferred upon the Chair by a Minister of the Crown.
- For providers of services to the Inquiry, the legal basis for processing your personal information will normally be that it is necessary for the performance of a contract to which the Inquiry is a party as provided for by Article 6(1)(b) of the UK GDPR.
Who do we share your data with and why?
15. The Inquiry intends to conduct its work as openly and transparently as possible, so your personal data may be shared publicly. Your personal information will be protected in accordance with the Inquiry’s Disclosure and Redaction Protocols. This is to ensure only information necessary for the Inquiry’s performance of its functions will be disclosed outside the Inquiry or to those instructed by the Inquiry. During the course of undertaking the Inquiry, your information may be shared by the Inquiry with the following main groups:
- individuals working on the Inquiry to include Counsel, Solicitors and the Secretariat;
- legal representatives of the Full Participants;
- Full Participants;
- Expert Witnesses appointed by the Inquiry;
- third party data processors (such as providers of IT infrastructure or electronic disclosure platforms);
- the public via the Inquiry website or via published reports (where applicable).
Third Party Data Processing
16. Personal information submitted to the Inquiry may be transferred to IT systems operated by third party data processors for the purposes of storing, reviewing and analysing documents and information. The Inquiry will have appropriate technical and organisational measures in place with its data processors, which means they cannot do anything with your personal information unless the Inquiry has instructed them to do it. They will not share your personal information with any organisation apart from the Inquiry, or as directed by the Inquiry. They will hold your personal information securely and retain it for the period the Inquiry requires. The contractors will act as Processors acting on behalf and under the control of the Inquiry.
International transfers
17. Your personal information is stored on the Inquiries’ IT infrastructure and also shared with our data processors. Your personal information will be stored securely within the United Kingdom and will not be transferred outside the United Kingdom.
How long will the Inquiry keep your personal information?
18. At the conclusion of the Inquiry, information that is to be retained as part of the historic record, including some personal information, will be transferred to the National Archives for the purposes of indefinite retention of Inquiry records by the National Archives in accordance with the Public Records Act 1958. We may also share personal information where we are under a legal obligation to do so, or where it is necessary to assist with a criminal investigation to allow other organisations to comply with their statutory functions. Personal data that is not required for archiving purposes will be securely destroyed.
What are your rights?
19. All individuals have a number of rights under the UK GDPR. This includes the right to request:
- information about how your personal data is processed and to request a copy of that personal data. This is also known as a subject access request;
- any inaccuracies in your personal data are rectified without delay;
- any incomplete personal data is completed, including by means of a supplementary statement;
- your personal data is erased if there is no longer a justification for them to be processed;
- processing of your personal data is restricted (for example where accuracy is contested);
- object to the processing of your personal data.
20. Any objections will be considered in the context of the Inquiry’s duties and the necessity of processing personal information for that purpose. There are some exemptions and limitations, which means we may not always be able to comply with your request in your entirety. You can exercise your rights by contacting the Inquiry at the details provided below and making a request. You may be asked to provide the Inquiry with proof of your identity before any request can be processed.
Freedom of information
21. The Inquiry is not a public authority for the purposes of the Freedom of Information Act 2000 (“FOIA”) and will not disclose material in response to requests made pursuant to the FOIA. The Inquiry will, proactively, make information available regarding its policies and procedures, via its website, to enable the public to understand its work and how it operates.
Who can I contact for more information?
Data Protection queries or complaints
22. If you have any queries or complaints in relation to the Inquiry’s handling of your personal data or wish to exercise any legal rights in respect of it, please contact info@cranston-independent-inquiry.uk.
Complaints
23. If you consider that your personal information has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
24. The Information Commissioner can be contacted at 0303 123 1113 or at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email: casework@ico.org.uk.
Review of this notice
25. This notice will be regularly reviewed and may be subject to revision. This version was last updated/published on 15 February 2024.
Terms explained
Chair
Sir Ross Cranston
Controller
The organisation or person who decides what Personal Data to collect, why and how and who is as a result legally responsible for ensuring that any such Personal Data is Processed in accordance with the Data Protection Laws.
Information Commissioner’s Office
The regulatory authority in the UK whose function is to ensure compliance with the Data Protection Laws and/or public access to information laws, like the Freedom of Information Act 2000
Process, processing, processed
This covers any use of any personal data of any type by the Inquiry, whether active, for example emailing it, or passive, for example storing it in archive boxes. It covers every use of personal data from its collection; recording and storing it; reading, copying or printing it; amending or copying it; sharing, disclosing or publishing it; to deleting or destroying it.
Processor
The organisation or person appointed by a controller, on whose behalf and on whose instructions the personal data concerned is processed, such as a service provider hosting a website for a client, or storing personal data for a client.