Privacy Notice

1. The Manston Independent Inquiry (the ‘Inquiry’) is an independent non-statutory
Inquiry established to investigate and report on the decisions, actions and
circumstances leading to the conditions encountered (the ‘Incident’) by those detained
at the Manston Short-Term Holding Facility (‘Manston’) between 1 June 2022 and 22
November 2022.

2. The Terms of Reference (the ‘ToRs’) for the Inquiry were published on 12 February
2025 and can be found on the website. The Inquiry is chaired by Sophie Cartwright KC
(the ‘Chair’)

3. This Privacy Notice uses some terms and definitions which you may be unfamiliar with.
To help you, these terms are shown in bold type the first time they appear and are
more fully explained at the Annex at the end of this Privacy Notice in the order they
appear in this Privacy notice.

4. In relation to the Inquiry, the Chair is the data controller for your personal information.

5. In the course of its work to discharge the ToRs, the Inquiry may collect and process
your personal information (also referred to as personal data). This Privacy Notice is
made under Articles 13 and/or 14 and Article 30 of the United Kingdom General Data
Protection Regulation (‘UK GDPR’). It explains:

• The legal basis for processing personal data;

• What personal data the Inquiry needs to collect and why;

• Who personal data may be shared with and why; and

• Your rights.

6. The Inquiry is committed to handling your personal data in compliance with data
protection legislation. The Inquiry has established an Appropriate Policy setting out its
approach to special category and criminal convictions and offences personal
data which can be found on the website.

A. What personal information does the Inquiry need to collect and why?  

Purposes of data collection

7. The Inquiry is investigating the decisions, actions and circumstances leading to the
Incident encountered by those detained at Manston between 1 June 2022 and 22
November 2022. The ToRs (available on the website) set out the purpose, scope,
methods and principles guiding the Inquiry’s investigation.

8. In order for the Inquiry to carry out its investigation and to discharge its duties under
the ToRs, the Inquiry will need to collect and process personal data. The Inquiry may
also need to process personal data in order to but not limited to:

• develop an evidence base for the Inquiry’s work;
• communicate with external stakeholders, including officials, journalists,
  providers of disclosure material (‘Material’) to the Inquiry, those designated as
  Inquiry Participants by the Inquiry and witnesses;
• deal with public correspondence;
• respond to data protection requests (otherwise known as subject access
  requests) from individuals; and
• operate and maintain the Inquiry’s website.

9. As appropriate and strictly in accordance with the requirements of the ToRs, public
hearings may in due course be held by the Inquiry and, in that event, evidence
(including personal data) referred to at hearings will become publicly available.
Personal data may also be referred to and published by the Inquiry on its website and
in the Inquiry’s Report which will be published in accordance with the ToRs.

Data collected

10. As part of its investigations, the Inquiry expects to handle a wide range of Material and
therefore may receive information about you in a number of ways. Information may be
requested from organisations involved in the Inquiry or it may be submitted voluntarily.
For example, the Inquiry may request and be granted access to information held by
third parties who are connected to the subject matter of the Inquiry. Typically, the
Inquiry will process personal data received from:

• government departments, public bodies, organisations and agencies, their
  servants and employees;
• witnesses providing witness statements and, where relevant, Material to the
  Inquiry;
• contracted parties and/or experts or advisors to the Inquiry;
• an individual referred to in information provided to the Inquiry as part of its
  investigations;
• individuals who make a data protection request (also known as a subject
  access request) as the Inquiry will likely collect data relating to but not limited
  to names, addresses, email addresses, any relevant details in that request and
  documents needed to verify identity;
• anyone who works for or with the Inquiry; and
• anyone who contacts the Inquiry by email or post or in any other way.

11. The Inquiry will process different categories of personal data. This may include:

• personal data, including biographical data such as name, date of birth, personal
  description, contact details, images and voice recordings;
• special category personal data (this is personal data that needs more protection
  because it is sensitive), including data revealing or concerning health (such as
  physical health, mental health, injuries and medical treatment), race/ethnicity,
  religious or philosophical beliefs, sexual orientation, genetic data, biometric
  data, political opinions and Trade Union membership; and
• criminal convictions and offences personal data relating to criminal convictions
  and offences (including charges that did not lead to prosecution), incident
  reports and actual or alleged criminal offences – this personal data is subject
  to strict controls.

12. Further information about how the Inquiry processes and protects special category and
criminal convictions and offences personal data is set out in the Inquiry’s Appropriate
Policy.

13. The Inquiry will keep your information secure and will only share it with those who are
required to see it as part of the Inquiry. All personal data we receive will be handled
fairly and lawfully in accordance with data protection legislation.

Inquiry website and cookies

14. The operation of the Inquiry website www.manston.independent-inquiry.uk, is to
provide information about the Inquiry to the public. The Inquiry may post updates,
Material and other non-personal data on its website to ensure that the Inquiry is run in
as transparent a manner as possible.

15. To ensure the effective operation of the Inquiry, the website deploys cookies
technology which can analyse individual visits to the website and how it is used, but
only during their current actual visit to the website. For further information, please see
the Inquiry website’s cookie policy, available at https://www.manston.independent-inquiry.uk/cookie-policy

16. This Privacy Notice applies only to the Inquiry website; it does not cover or extend to any links within the site to other websites.

B. Legal basis for processing

17. The Inquiry will process personal data, special category and criminal convictions and
offences personal data fairly and lawfully in accordance with data protection legislation,
including the Data Protection Act 2018 and the UK GDPR.

18. The Inquiry will only share personal information with third parties when it can do so
lawfully or it has consent to do so.

19. The Inquiry’s lawful basis for processing personal data, special category data and
criminal convictions and offences personal data is as follows: –

• The Inquiry’s legal basis for processing personal data is that the processing is
  necessary for the performance of a task carried out in the public interest or in
  the exercise of official authority vested in the controller. The Chair has official
  authority to perform the core function of the Inquiry to investigate the matters
  falling within the Inquiry’s terms of reference. This is provided for under Article
  6(1)(e) of the UK GDPR.
• The legal basis for processing your personal data in order to respond to data
  protection requests is that it is necessary to comply with a legal obligation
  placed on the Chair as the data controller (Article 6(1)(c) of the UK GDPR.
• The legal basis for processing special category personal data is that it is
  necessary for reasons of substantial public interest. This is provided for by
  Article 9(2)(g) of the UK GDPR and is met under paragraph 6, schedule 1 of
  the Data Protection Act 2018. In some limited cases and where necessary we
  may ask for consent from data subjects to process this category of personal
  data.
• Where the Inquiry is required to process personal data relating to criminal
  convictions and offences, the processing is authorised in domestic law (as
  required by Article 10 of the UK GDPR) under section 10(5) and paragraph 6,
  schedule 1 of the Data Protection Act 2018. The processing is necessary for
  reasons of substantial public interest and the purpose of the exercise of a
  function conferred upon the Chair by a Minister of the Crown.
• For providers of services to the Inquiry, the legal basis for processing your
  personal information will normally be that it is necessary for the performance of
  a contract to which the Inquiry is a party as provided for by Article 6(1)(b) of the
  UK GDPR.

C. Who personal data may be shared with and why?

20. The Inquiry intends to conduct its work as openly and transparently as possible, so
your personal data may be shared publicly. Your personal data will be protected in
accordance with disclosure and redaction protocols which will be published by the
Inquiry in due course. This is to ensure that only information necessary for the Inquiry’s
performance of its functions will be disclosed outside the Inquiry or to those instructed
by the Inquiry. During the course of undertaking its work, the Inquiry may share your
information with the following main groups:

• individuals working on the Inquiry to include Counsel, Paralegals, Solicitors and
  the Secretariat;
• legal representatives of those designated as Inquiry Participants by the Inquiry;
• expert witnesses, where appropriate, appointed by the Inquiry;
• third party data processors (such as providers of IT infrastructure or electronic
  disclosure platforms); and
• the public via the Inquiry website, or via published reports or public hearings
  (where applicable).

D. Third Party Data Processing

21. Personal data submitted to the Inquiry may be transferred to IT systems operated by
third party data processors for the purposes of storing, reviewing and analysing
documents and information. The Inquiry will have appropriate technical and
organisational measures in place with its data processors, which means that they
cannot do anything with your personal data unless the Inquiry has instructed them to
do it. They will not share your personal data with any organisation apart from the
Inquiry, or as directed by the Inquiry. They will hold your personal information securely
and retain it for the period the Inquiry requires. The contractors will act as Processors
acting on behalf of and under the control of the Inquiry.

22. We may also share personal data where we are under a legal obligation to do so, or
where it is necessary to assist with a criminal investigation to allow other organisations
to comply with their statutory functions.

International transfers

23. Your personal data is stored on the Inquiry’s IT infrastructure and may also be shared
with our data processors. Your personal information may be transferred and stored
securely outside the UK. Where that is the case, all appropriate technical and legal
safeguards will be put in place to ensure you are afforded with the same level of
protection through an adequacy decision, or the use of contractual documents, such
as an International Data Transfer Agreement.

How long will the Inquiry keep your personal information?

24. At the conclusion of the Inquiry, information contained in Inquiry records that is to be
retained as part of the historic record, including some personal information, will be
transferred to The National Archives for the purposes of permanent preservation of
Inquiry records by The National Archives in accordance with the Public Records Act

25. Personal data held outside of Inquiry records will be retained until the close of the
Inquiry at which point some will be transferred to the Home Office, as the Inquiry’s
sponsor body, because there is a legal requirement to do so, such as in financial
records or staff records. All other personal data will be deleted at the conclusion of the
Inquiry.

E. What are your rights?

26. All individuals have a number of rights under the UK GDPR. This includes the right to
request:

• information about how your personal data is processed and to request a copy
  of that personal data. This is known as a subject access request;
• any inaccuracies in your personal data are rectified without delay;
• any incomplete personal data is completed, including by means of a
  supplementary statement;
• your personal data is erased if there is no longer a justification for them to be
  processed;
• processing of your personal data is restricted (for example where accuracy is
  contested);
• object to the processing of your personal data.

27. Any objections will be considered in the context of the Inquiry’s duties and the
necessity of processing personal information for that purpose. There are some
exemptions and limitations which means that we may not always be able to comply
with your request in its entirety. You can exercise your rights by contacting the Inquiry
at the details provided below and making a request. You may be asked to provide the
Inquiry with proof of your identity before any request can be processed.

Freedom of information

28. The Inquiry is not a public authority for the purposes of the Freedom of Information Act
2000 (‘FOIA’) and will not disclose Inquiry material in response to requests made
pursuant to the FOIA. The Inquiry will, proactively, make information available
regarding its policies and procedures, via its website, to enable the public to
understand its work and how it operates.

Who can I contact for more information?

Data Protection queries or complaints

29. If you have any queries or complaints in relation to the Inquiry’s handling of your
personal data or wish to exercise any legal rights in respect of it, please contact info@manston.independent-inquiry.uk

30. If you consider that your personal data has been misused or mishandled, you may
make a complaint to the Information Commissioner, who is an independent
regulator.

31. The Information Commissioner can be contacted by telephone at 0303 123 1113, by
email at icocasework@ico.org.uk or by post at

Review of this notice

32. This notice will be regularly reviewed and may be subject to revision. This version was
last updated/published on 08 July 2025