Privacy notice

We process your personal data for a number of reasons, all of which help us to fulfil our Terms of Reference.

When a person visits our website we collect information to measure the use of the website. We do not collect information that identifies anyone but we do track how many individuals have viewed different pages so we know what information appears to be of most interest. Further information is provided on our Terms & Conditions page. (HYPERLINK)

If you contact us by telephone, email or letter, or if you use the contact form on our website, we will retain any personal data you provide to us in doing so, and we may use it to contact you about the work of the Inquiry. We may also use it to help us with our investigations and to help us decide which institutions or organisations need to be investigated.

We may approach you to ask you to give evidence to the Inquiry, in which case we will retain any additional personal data you provide to us and we may use it to contact you about the work of the Inquiry.

If you provide us with evidence, whether by giving a statement, or in response to a statutory notice under section 21 of the Inquiries Act 2005 requiring you to submit written evidence, or by attending the Inquiry to give evidence in person, or in any other way, we will retain any personal data you provide in doing so. Also we will retain any personal data which you provide in any communications we have with you in relation to your evidence. We will use any such personal data to help us with our investigations and/or otherwise fulfil our Terms of Reference.

We also recover records from a range of sources, including providers of residential care for children, local authorities, Police Scotland, the Crown and Procurator Fiscal Service, and the Scottish Government.

We collect data about children in care, data about the abuse of children in care and data about the impact of such abuse. We collect and retain contact details, data known as special category data and information about criminal convictions.

The records we recover might include personal data including sensitive personal data such as data relating to a person’s criminal convictions, offences, private life or sexual orientation.

We keep your personal data secure and only share it with those who need to see it.

Personal data is held in secure encrypted electronic storage systems that are only accessible by individuals working for or on behalf of the Inquiry. Any hard copy information is held in secure conditions within premises to which members of the public do not have access.

All personal data we receive is handled fairly and lawfully in line with data protection legislation.

We may have to disclose personal data, on a strictly confidential basis, to organisations which provide(d) or arranged residential care for children, to people who are alleged to have abused children in care, to organisations which hold records which could assist the Inquiry with its investigations, to experts or to the police.

In some cases, we may publicise your data to allow us to fulfil our Terms of Reference. However, we are extremely careful about what data is made public and only publish it where we are satisfied, having had regard to data protection and inquiries legislation and any restriction orders issued by the Chair, that it is appropriate to do so.

Some people are entitled to be anonymous and, unless they have expressly waived their anonymity, their identities will be protected by appropriate redaction before publication. Details of those who are entitled to anonymity are set out in the Chair’s General Restriction Order, which you can see here. (HYPERLINK) https://www.childabuseinquiry.scot/procedures/general-restriction-order/

If you are concerned or unsure about whether your personal information may be made public, you can ask our witness support team about whether you are entitled to anonymity.

The Chief Executive of the Inquiry is our “data controller”. As data controller, she is obliged by law to determine the purposes for and means by which we process all and any data including how it is held, how it is used, and when and/or how it is destroyed.

Each year the Inquiry registers with the Information Commissioner – who supervises compliance with Data Protection legislation in the UK. A copy of our current registration certificate is available here. (HYPERLINK) https://www.childabuseinquiry.scot/key-documents/ico-registration/

If you contact us by telephone, email or letter during the Inquiry, or if we contact you, we will retain any personal data which, in doing so, you provide to us. We will do so solely to enable us to carry out our work. We will generally retain the data for the duration of the Inquiry.

Under our Terms of Reference we are required to create a national public record, and the Inquiries Act 2005 and the Inquiries (Scotland) Rules 2007 require the Chair to keep a comprehensive record of the Inquiry. That means we must, at the end of the Inquiry, transmit certain records we hold, including personal and sensitive personal data, to the Keeper of the Records of Scotland.

We process personal data lawfully in compliance with the General Data Protection Regulation (‘GDPR’) and all other UK data protection legislation.

Our ‘lawful basis’, as defined by the GDPR, is usually the need to comply with a legal obligation; the obligation relied on will usually be that we are carrying out a task we require, in the public interest, to perform and/or that we are pursuing our legitimate interest in fulfilling our Terms of Reference.

Complying with our legal obligation means we process your personal data because it is necessary for us to comply with the law that applies to us. In our case our legal obligations as a public inquiry are set out in the Inquiries Act 2005 and the Inquiries (Scotland) Rules 2007. The Inquiries Act empowers a government minister to set up a public inquiry; it sets out what we, as a public inquiry, must do and what we have the power to do. The Inquiries Rules set out certain procedures we must follow.

Under data protection laws, the processing we carry out must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Chair of the Inquiry. In our case, all we do is for the benefit of the public, the Inquiry having been established because the Scottish Ministers were satisfied it was appropriate to do so, given the extent to which there was public concern about the abuse of children in care dating back over many years, the need to understand what happened in the past and the need to seek recommendations for the protection of children in care in the future.

We also use personal data in pursuit of our legitimate interests, meaning that we carry out necessary processing for the purpose of our interests in fully carrying out our investigations, in creating a clear public record of the nature and extent of abuse of children in care, in making findings, in issuing reports and in deciding on and drafting appropriate recommendations.

We rely on these bases for processing only when we believe our interests are not overridden by your fundamental rights and freedoms.

Sometimes the processing we carry out allows us to rely on one or more of the exemptions set down in the Data Protection Act 2018. If it does we then have to decide whether or not it is appropriate to provide information in response to any request you make to assert your rights under the GDPR. Sometimes we will do so even if there is an exemption that we can rely upon. Sometimes we will conclude that it is not appropriate for us to provide you with the information you have requested - this will, for example, be the case if complying with your request would make it more difficult for us to fulfil our Terms of Reference or if it puts another person’s personal data at risk of being revealed.

You have the right to request:

• access to the personal data we hold about you
• that incorrect information we hold about you be corrected
• that we stop or limit the processing of data we hold about you
• that we erase the information we hold about you

In all cases we will consider your request very carefully. In some cases, if we consider that your information falls within one of the exemptions set down in the Data Protection Act 2018 and that agreeing to your request could hinder our ability to fulfil our Terms of Reference, we may have to decline your request.

If you wish to contact us about the terms of this privacy notice, please write to SCAIdataprotection@childabuseinquiry.scot

If you wish to make a complaint about how the Inquiry has handled your personal data, in the first instance please contact SCAIdataprotection@childabuseinquiry.scot

If you are unhappy with the outcome of discussions with us, please refer to the policy below: 

Data Protection Complaints Policy

1. Purpose and scope

The Scottish Child Abuse Inquiry (‘the Inquiry’) is an independent public inquiry. We exercise statutory functions, in the public interest, under the Inquiries Act 2005. Our Terms of Reference require us to investigate the nature and extent of abuse of children in residential care in Scotland.

This policy outlines how the Inquiry handles complaints regarding the processing of personal data, as required by section 164A of the Data Protection Act 2018. You can make a complaint if you believe that your rights under the UK General Data Protection Regulation (GDPR) or Part 3 of the Data Protection Act 2018 have been infringed.

2. How to make a complaint

You can make a complaint in one of the following ways:

• Electronic form: available on the Inquiry website: childabuseinquiry.scot/contact
• Email: SCAIdataprotection@childabuseinquiry.scot
• Post: PO Box 24202, Edinburgh EH3 1JN
• Phone: 0800 0929 300 (a member of staff will take a note of your complaint and acknowledge it in writing to an email or postal address you provide).
• British Sign Language (BSL) users can contact the Inquiry direct through an online sign language interpreter: www.ContactScotland-bsl.org   

3. Our commitment and timeframes

• Acknowledgement: we will acknowledge receipt of your complaint within 30 days.
• Investigation: we will investigate your concerns without undue delay, making all appropriate enquiries.
• Updates on progress: we will keep you informed of the progress of our investigation and will let you know if it is complex or is going to require more time than initially thought.
• Notification of outcome: we will provide a clear written outcome, explaining our findings and any remedial actions taken, without undue delay.

4. Special considerations

• Requests on behalf of others: if a third party (such as a solicitor or family member) complains on your behalf, we must check their authority to act for you (for example, via a signed letter of authority or power of attorney).
• Evidence: we may ask for reasonable and proportionate evidence to help us investigate your complaint, such as proof of identity.

5. Complaints to the regulator

If you are dissatisfied with our final outcome or how we handled your complaint, you have the right to complain to the Information Commissioner’s Office (ICO). You should typically do this within three months of our final response.

Contact details for the ICO are as follows:

• Website: ico.org.uk
• Helpline: 0303 123 1113

6. Internal governance and record keeping

The Inquiry maintains a central log of all data protection complaints, including dates, actions taken, and final outcomes. This data is reviewed regularly to identify any necessary improvements to our data protection practices.