1. The Manston Independent Inquiry (the ‘Inquiry’) is an independent non-statutory inquiry established to investigate and report on the decisions, actions and circumstances leading to the conditions encountered (the ‘Incident’) by those detained at the Manston Short-Term Holding Facility (‘Manston’) between 1 June 2022 and 22 November 2022.
2. The Terms of Reference (the ‘ToRs’) for the Inquiry were published on 12 February 2025 and can be found on the website. The Inquiry is chaired by Sophie Cartwright KC (the ‘Chair’).
3. This Privacy Notice uses some terms and definitions which you may be unfamiliar with. To help you, these terms are shown in bold type the first time they appear and are more fully explained at the Annex at the end of this Privacy Notice in the order they appear in this Privacy notice.
4. In relation to the Inquiry, the Chair is the data controller for your personal information.
5. In the course of its work to discharge the ToRs, the Inquiry may collect and process your personal information (also referred to as personal data). This Privacy Notice is made under Articles 13 and/or 14 and Article 30 of the United Kingdom General Data Protection Regulation (‘UK GDPR’). It explains:
● What personal data the Inquiry needs to collect and why;
● The legal basis for processing personal data;
● Who personal data may be shared with and why; and
● Your rights.
6. The Inquiry is committed to handling your personal data in compliance with data protection legislation. The Inquiry has established an Appropriate Policy setting out its approach to special category and criminal convictions and offences personal data which can be found on the website.
A. What personal information does the Inquiry need to collect and why?
Purposes of data collection
7. The Inquiry is investigating the decisions, actions and circumstances leading to the Incident encountered by those detained at Manston between 1 June 2022 and 22 November 2022. The ToRs (available on the website) set out the purpose, scope, methods and principles guiding the Inquiry’s investigation.
8. In order for the Inquiry to carry out its investigation and to discharge its duties under the ToRs, the Inquiry will need to collect and process personal data. The Inquiry may also need to process personal data in order to but not limited to:
● develop an evidence base for the Inquiry’s work;
● communicate with external stakeholders, including officials, journalists, providers of disclosure material (‘Material’) to the Inquiry, those designated as Inquiry Participants by the Inquiry and witnesses;
● deal with public correspondence;
● respond to data protection requests (otherwise known as subject access requests) from individuals; and
● operate and maintain the Inquiry’s website.
9. As appropriate and strictly in accordance with the requirements of the ToRs, public hearings may in due course be held by the Inquiry and, in that event, evidence (including personal data) referred to at hearings will become publicly available. Personal data may also be referred to and published by the Inquiry on its website and in the Inquiry’s Report which will be published in accordance with the ToRs.
Data collected
10. As part of its investigations, the Inquiry expects to handle a wide range of Material and therefore may receive information about you in a number of ways. Information may be requested from organisations involved in the Inquiry or it may be submitted voluntarily. For example, the Inquiry may request and be granted access to information held by third parties who are connected to the subject matter of the Inquiry. Typically, the Inquiry will process personal data received from:
● government departments, public bodies, organisations and agencies, their servants and employees;
● witnesses providing witness statements and, where relevant, Material to the Inquiry;
● contracted parties and/or experts or advisors to the Inquiry;
● an individual referred to in information provided to the Inquiry as part of its investigations;
● individuals who make a data protection request (also known as a subject access request) as the Inquiry will likely collect data relating to but not limited to names, addresses, email addresses, any relevant details in that request and documents needed to verify identity;
● anything posted to our social media channels is automatically archived alongside our account This includes (but is not limited to) comments, photos, videos, usernames, and any special category data users choose to share – such as gender, race, political views, or sexual orientation;
● anyone who works for or with the Inquiry;
● anyone who contacts the Inquiry by email or post or in any other way – including registration for attendance at public hearings; and
● identifiable footage of visitors to any of the hearing venues that may be captured on CCTV.
11. The Inquiry will process different categories of personal data. This may include:
● personal data, including biographical data such as name, date of birth, personal description, contact details, images and video or audio recordings;
● special category personal data (this is personal data that needs more protection because it is sensitive), including data revealing or concerning health (such as physical health, mental health, injuries and medical treatment), race/ethnicity, religious or philosophical beliefs, sexual orientation, genetic data, biometric data, political opinions and Trade Union membership; and
● criminal convictions and offences personal data relating to criminal convictions and offences (including charges that did not lead to prosecution), incident reports and actual or alleged criminal offences – this personal data is subject to strict controls.
12. Further information about how the Inquiry processes and protects special category and criminal convictions and offences personal data is set out in the Inquiry’s Appropriate Policy which can be found on the Inquiry website.
13. The Inquiry will keep your information secure and will only share it with those who are required to see it as part of the Inquiry. All personal data we receive will be handled fairly and lawfully in accordance with data protection legislation.
Inquiry website and cookies
14. The operation of the Inquiry website www.manston.independent-inquiry.uk, is to provide information about the Inquiry to the public. The Inquiry may post updates, Material and other non-personal data on its website to ensure that the Inquiry is run in as transparent a manner as possible.
15. To ensure the effective operation of the Inquiry, the website deploys cookies technology which can analyse individual visits to the website and how it is used, but only during their current actual visit to the website. For further information, please see the Inquiry website’s cookie policy, available at www.manston.independentinquiry.uk/cookie-policy
16. This Privacy Notice applies only to the Inquiry website; it does not cover or extend to any links within the site to other websites.
B. Legal basis for processing
17. The Inquiry will process personal data, special category and criminal convictions and offences personal data fairly and lawfully in accordance with data protection legislation, including the Data Protection Act 2018 and the UK GDPR.
18. The Inquiry will only share personal information with third parties when it can do so lawfully, or it has consent to do so.
19. The Inquiry’s lawful basis for processing personal data, special category data and criminal convictions and offences personal data is as follows: –
● The Inquiry’s legal basis for processing personal data is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Chair has official authority to perform the core function of the Inquiry to investigate the matters falling within the Inquiry’s terms of reference. This is provided for under Article 6(1)(e) of the UK GDPR.
● The legal basis for processing your personal data in order to respond to data protection requests is that it is necessary to comply with a legal obligation placed on the Chair as the data controller (Article 6(1)(c) of the UK GDPR.
● Where we post personal data on social media relating to inquiry activity (such as recordings of hearings), the legal basis is that processing is necessary for the performance of a task carried out in the public interests or in the exercise of official authority vested in the data controller (Article 6(1)(e) of the UK GDPR).
● Where we process personal data generated by social media users (which includes data such as comments or usernames of those posting onto a Manston Inquiry account), the legal basis for that processing is that the user consents to us doing so (Article 6(1)(a) of the UK GDPR.
● The legal basis for processing special category personal data is that it is necessary for reasons of substantial public interest. This is provided for by Article 9(2)(g) of the UK GDPR and is met under paragraph 6, schedule 1 of the Data Protection Act 2018. In some limited cases and where necessary we may ask for consent from data subjects to process this category of personal data.
● Where the Inquiry is required to process personal data relating to criminal convictions and offences, the processing is authorised in domestic law (as required by Article 10 of the UK GDPR) under section 10(5) and paragraph 6, schedule 1 of the Data Protection Act 2018. The processing is necessary for reasons of substantial public interest and the purpose of the exercise of a function conferred upon the Chair by a Minister of the Crown.
● For providers of services to the Inquiry, the legal basis for processing your personal information will normally be that it is necessary for the performance of a contract to which the Inquiry is a party as provided for by Article 6(1)(b) of the UK GDPR.
C. Who personal data may be shared with and why?
20. The Inquiry intends to conduct its work as openly and transparently as possible, so your personal data may be shared publicly. Your personal data will be protected in accordance with disclosure and redaction protocols which will be published by the Inquiry in due course. This is to ensure that only information necessary for the Inquiry’s performance of its functions will be disclosed outside the Inquiry or to those instructed by the Inquiry. During the course of undertaking its work, the Inquiry may share your information with the following main groups:
● individuals working on the Inquiry to include Counsel, Paralegals, Solicitors and the Secretariat;
● legal representatives of those designated as Inquiry Participants by the Inquiry;
● expert witnesses, where appropriate, appointed by the Inquiry;
● third party data processors (such as providers of IT infrastructure or electronic disclosure platforms); and
● the public via the Inquiry website, or via published reports or public hearings (where applicable).
Third Party Data Processing
21. Personal data submitted to the Inquiry may be transferred to IT systems operated by third party data processors for the purposes of storing, reviewing and analysing documents and information. The Inquiry will have appropriate technical and organisational measures in place with its data processors, which means that they cannot do anything with your personal data unless the Inquiry has instructed them to do it. They will not share your personal data with any organisation apart from the Inquiry, or as directed by the Inquiry. They will hold your personal information securely and retain it for the period the Inquiry requires. The contractors will act as Processors acting on behalf of and under the control of the Inquiry.
22. We may also share personal data where we are under a legal obligation to do so, or where it is necessary to assist with a criminal investigation to allow other organisations to comply with their statutory functions.
International transfers
23. Your personal data is stored on the Inquiry’s IT infrastructure and may also be shared with our data processors. Your personal information may be transferred and stored securely outside the UK. Where that is the case, all appropriate technical and legal safeguards will be put in place to ensure you are afforded with the same level of protection through an adequacy decision, or the use of contractual documents, such as an International Data Transfer Agreement.
How long will the Inquiry keep your personal information?
24. At the conclusion of the Inquiry, information contained in Inquiry records that is to be retained as part of the historic record, including some personal information, will be transferred to The National Archives for the purposes of permanent preservation of Inquiry records in accordance with the Public Records Act 1958. As well as all official documents the Inquiry has relied on in order to produce its findings, this will also include external data provided by the public – for example social media posts/comments on the Inquiry’s official account.
25. Personal data held outside of Inquiry records will be retained until the close of the Inquiry at which point some will be transferred to the Home Office, as the Inquiry’s sponsor body, because there is a legal requirement to do so, such as in financial records or staff records. All other personal data will be deleted at the conclusion of the Inquiry.
D. What are your rights?
26. All individuals have a number of rights under the UK GDPR. This includes the right to request:
● information about how your personal data is processed and to request a copy of that personal data. This is known as a subject access request;
● any inaccuracies in your personal data are rectified without delay;
● any incomplete personal data is completed, including by means of a supplementary statement;
● your personal data is erased if there is no longer a justification for them to be processed;
● processing of your personal data is restricted (for example where accuracy is contested);
● object to the processing of your personal data.
27. Any objections will be considered in the context of the Inquiry’s duties and the necessity of processing personal information for that purpose. There are some exemptions and limitations which means that we may not always be able to comply with your request in its entirety. You can exercise your rights by contacting the Inquiry at the details provided below and making a request. You may be asked to provide the Inquiry with proof of your identity before any request can be processed.
Freedom of information
28. The Inquiry is not a public authority for the purposes of the Freedom of Information Act 2000 (‘FOIA’) and will not disclose Inquiry material in response to requests made pursuant to the FOIA. The Inquiry will, proactively, make information available regarding its policies and procedures, via its website, to enable the public to understand its work and how it operates.
E. Who can I contact for more information?
Data Protection queries or complaints
29. If you have any queries or complaints in relation to the Inquiry’s handling of your personal data or wish to exercise any legal rights in respect of it, please contact info@manston.independent-inquiry.uk.
30. If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
31. The Information Commissioner can be contacted by telephone at 0303 123 1113, by email at casework@ico.org.uk or by post at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Review of this notice
32. This notice will be regularly reviewed and may be subject to revision. This version was last updated/published on 10 March 2026.
Annex: Key Terms explained
- Data controller: the organisation or person who decides what Personal Data to collect, why and how, and who is as a result legally responsible for ensuring that any such Personal Data is processed in accordance with Data Protection laws.
- Process, processing, processed: These terms cover any use of any personal data of any type by the Inquiry, whether active (for example by emailing it) or passive (for example by storing it in archive boxes). It covers every use of personal data from its collection; recording and storing it; reading, copying or printing it; amending or copying it; sharing, disclosing or publishing it; to deleting or destroying it.
- Personal data: this means any information relating to an identified living person, or which could be used to identify a living person. It includes biographical data such as name, date of birth, personal description, contact details, images and voice recordings.
- Special category personal data: this is more sensitive personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union memberships, genetic data, biometric data to identify natural persons and data concerning sex and sexual orientation.
- Criminal convictions and offences personal data: this is personal data relating to criminal convictions and offences.
- Processor: The organisation or person appointed by a controller, on whose behalf and on whose instructions the personal data concerned is processed, such as a service provider hosting a website for a client or storing personal data for a client.
- Information Commissioner’s Office: The regulatory authority in the UK whose function is to ensure compliance with Data Protection laws and/or public access to information laws such as the Freedom of Information Act 2000.