Privacy notice

We process your personal data for a number of reasons, all of which help us to perform our duty under the law.

If you contact us by telephone, email, or letter, using the contact form on our website, or in any other way, we will retain any personal data you provide to us in doing so, and we may use it to contact you about the work of the Inquiry. We may also use it to help us with our investigations and to help us decide which institutions or organisations need to be investigated. 

We may approach you to ask you to provide evidence to the Inquiry, in which case we will retain any personal data in the evidence you provide to us and we may use it to contact you about the work of the Inquiry. 

If you provide us with evidence, for example by meeting with us to provide a statement, or in writing in response to a statutory notice under section 21 of the Inquiries Act 2005, or by attending an Inquiry hearing to give evidence in person at a hearing, or in any other way, we will retain any personal data you provide in doing so. We will also retain any personal data you provide in any communications we have with you. We will use any such personal data to help us do the work we need to do to fulfil our Terms of Reference.

The law also allows us to recover records and information and we regularly require to do so. These can include personal data from a range of sources, including providers of residential care for children, local authorities, Police Scotland, the Crown Office and Procurator Fiscal Service, and the Scottish Government. 

When someone visits our website we collect information to measure the use of the website. We do not collect information that identifies anyone but we do track how many individuals have viewed different pages so we know what information appears to be of most interest. Further information is provided in our Terms and conditions.

We collect data about children in care, data about the abuse of children in care, and data about the impact of such abuse. We collect and retain contact details, data known as special category data, and information about criminal convictions. 

The records we recover might contain personal data which could include sensitive data (‘special category data’) such as data relating to a person’s racial or ethnic origin, health, or sexual orientation. Personal data might also include data relating to a person’s criminal convictions (‘criminal offence data’).

We keep your personal data secure and only share it with those who need to see it. 

Personal data is held in secure encrypted electronic storage systems which are only accessible by individuals working for or on behalf of the Inquiry. Any hard copy information is held in secure conditions within premises to which members of the public do not have access. 

All personal data we receive is handled fairly and lawfully in line with data protection legislation. 

We may have to disclose your personal data, on a strictly confidential basis, to organisations that provide(d) or arrange(d) residential care for children, to people who are alleged to have abused children in care, to organisations that hold records that could assist the Inquiry with its investigations, to experts instructed by us, or to the police. 

In some cases, we may publish your data to allow us to fulfil our Terms of Reference. However, we are extremely careful about what data is made public and only publish it where we are satisfied, having had regard to data protection and inquiries legislation and any restriction orders issued by the Chair, that it is necessary and appropriate to do so.

Some people’s identities are protected by the Chair’s General Restriction Order and, unless they have expressly waived their anonymity, their identities will usually be protected by appropriate redaction (blacking out of certain words in evidence that could identify that person to the general public) before publication. Details of those who are entitled to such protection are set out in the Chair’s General Restriction Order. 

If you are concerned or unsure about whether your personal information may be made public, you can ask our witness support team about whether you are protected by the General Restriction Order.

The Chief Executive of the Inquiry is our ‘data controller’. As data controller, (s)he is obliged by law to determine the purposes for and means by which we process all and any data including how it is held, how it is used, and when and/or how it is destroyed. 

Each year the Inquiry registers with the Information Commissioner, who supervises compliance with data protection legislation in the UK. A copy of our current registration certificate is available here.

If you contact us by telephone, email, or letter, or if we contact you, we will retain any personal data that, in doing so, you provide to us. We will do so solely to enable us to carry out our work. We will generally retain the data for the duration of the Inquiry. 

Under our Terms of Reference we are required to create a national public record. The Inquiries Act 2005 and the Inquiries (Scotland) Rules 2007 require the Chair to keep a comprehensive record of the Inquiry. That means we must, at the end of the Inquiry, transmit certain records we hold, including personal, special category, and criminal offence data, to the Keeper of the Records of Scotland.

We process personal data because, as a public inquiry established under statute, we require to do so. We process personal data lawfully in compliance with the General Data Protection Regulation (GDPR) and all other UK data protection legislation. 

Our lawful basis, as defined by the GDPR, for the majority of personal data we process, is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the work which the Inquiry is required to do to fulfil its Terms of Reference.

In relation to some other data we process, for example data protection requests from individuals, the lawful basis for processing your personal data is that it is necessary to comply with a legal obligation placed on us as the data controller (Article 6(1)(c) UK GDPR).

Under data protection laws, the processing we carry out must be necessary for the performance of a task in the public interest or in the exercise of official authority vested in the Chair of the Inquiry. In our case, all that we do is for the benefit of the public, the Inquiry having been established because the Scottish Ministers were satisfied it was appropriate to do so, given public concerns about the long-term and continuing abuse of children in residential care in Scotland or whose care was arranged in Scotland, and the need to seek recommendations for the protection of children in care in the future. 

Complying with our legal obligation means we process your personal data because it is necessary for us to comply with the law that applies to us. In our case our legal obligations as a public inquiry are set out in the Inquiries Act 2005 and the Inquiries (Scotland) Rules 2007. The Inquiries Act empowers a government minister to set up a public inquiry; it sets out what we, as a public inquiry, must do and what we have the power to do. The Inquiries Rules make further detailed provisions that we must follow. 

We also process personal data in pursuit of our legitimate interests, meaning that we carry out necessary processing for the purpose of our interests in fully carrying out our investigations, in creating a comprehensive public record of the work of the Inquiry including of the nature and extent of abuse of children in care in Scotland, in writing findings and reports, in issuing findings and reports and in deciding on and drafting appropriate recommendations. 

We rely on these bases for processing only when we believe our interests are not overridden by your fundamental rights and freedoms.

Sensitive personal data (also known as special category data) is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

The legal basis for processing any sensitive personal data, or data about criminal convictions, where we receive it, is that it is necessary for reasons of substantial public interest for the exercise of a function conferred on a person by an enactment, or the exercise of a function of a Minister of the Crown (para 6, schedule 1, Data Protection Act 2018). The function is the work the Inquiry requires to do to fulfil its Terms of Reference.

You have the right to request: 

• access to the personal data we hold about you
• that incorrect information we hold about you be corrected
• that we stop or limit the processing of data we hold about you
• that we erase the information we hold about you. 

Your rights may be subject to exemptions or limitations. Requests are dealt with on a case-by-case basis.

In all cases we will consider your request very carefully. In some cases, if we consider that your information falls within one of the exemptions set down in the Data Protection Act 2018, we may have to decline your request. 

If you wish to contact us about the terms of this privacy notice, please write to SCAIdataprotection@childabuseinquiry.scot

If you wish to make a complaint about how the Inquiry has handled your personal data, in the first instance please contact SCAIdataprotection@childabuseinquiry.scot 

If you are unhappy with the outcome of discussions with us you are entitled to contact the Information Commissioner’s Office online at Make a complaint | ICO, by calling their helpline on 0303 123 1113, or by writing to them at: 

UK Information Commissioner's Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire