What is this privacy notice for?
The UK Covid-19 Inquiry (the “Inquiry”) ‘Every Story Matters’ service is an online form allowing individuals (over 18) to provide their experiences of the pandemic and share how the pandemic has impacted their lives, without the formality of giving evidence or attending a public hearing. We are a data controller for this work.
As part of gathering different experiences we will also be conducting face to face research through a company called IPSOS. IPSOS will be conducting this research on our behalf under contract. We are joint controllers for this work. View the IPSOS privacy notice.
In this privacy notice, we will explain:
- what information we collect
- when we collect it
- how we use this in relation to the Inquiry
It also helps you understand your rights and how to contact us if you need more information.
Who we are
We are an independent Inquiry team, sponsored by the Cabinet Office.
What personal data will be collected and processed?
We will process any personal data that you may provide to us via the web form, such as health information, criminal convictions, opinions, ethnicity and postcode. Specific optional demographics questions, such as ethnicity, religion, gender identity, postcode and others are asked to help us understand how experiences of the pandemic varied among people from different groups and different geographic areas, including as an assessment of socioeconomic status.
We also use website analytics to gather information on how our site is used.
IPSOS will analyse the face to face research data and will provide us with an anonymised report.
What do we use your data for?
We process your responses from ‘Every Story Matters’ to build evidence for the Inquiry. We may also use an anonymised dataset from the Inquiry to inform future research.
What is our legal basis to use your information?
Our legal basis for processing your personal data is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the Inquiry’s work to fulfil its Terms of Reference.
The legal basis for processing any sensitive personal data, or data about criminal convictions, where we receive it, is that it is necessary for reasons of substantial public interest for the exercise of a function conferred on a person by an enactment, or the exercise of a function of a Minister of the Crown (para 6, schedule 1, Data Protection Act 2018). The function is the Inquiry’s work to fulfil its Terms of Reference.
Who do we share your information with?
Our research and analysis provider IPSOS will analyse the responses we receive via the online form to inform the Inquiry and help us fulfil our Terms of Reference. They are our data processor acting under contract for this work.
IPSOS will also analyse the responses from the face to face research and provide us with an anonymised dataset. We are joint controllers for this work.
We will publish some of the individuals’ responses we receive. We will endeavour to remove any information that may lead to an individual being identified.
Anonymised responses may also be shared with other Covid-19 inquiries held under statute (to inform that Inquiry), government departments, public sector organisations and relevant third parties within other public bodies across the United Kingdom in order to help develop policy.
We may also share data with the appropriate agencies/authorities if we have any safeguarding concerns.
How long do we keep your data?
Personal data collected as part of Every Story Matters will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal data held by the Inquiry will – where it is considered to form part of the historic record – be transferred for the purposes of indefinite retention of Inquiry records by the National Archives in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes will be destroyed.
Anonymised data collected from the Inquiry may be used to inform future research.
We will retain website analytics data for 2 years, which auto-renews on re-acceptance of cookies.
What are my rights?
- You have the right to request information about how your personal data are processed.
- You have the right to request a copy of that personal data. For data provided as part of the face to face research, please see further information about face to face research.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
- You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data (see below).
Your right to object
You have the right to object to the processing of your personal data. You must give specific reasons, based on your particular situation, why you are objecting to the processing of your data.
This right is subject to limitations and requests are dealt with on a case-by-case basis.
Your rights may be subject to exemptions or limitations. Requests are dealt with on a case-by-case basis.
Where is my personal data stored?
As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, or the use of appropriate contractual documents, such as the International Data Transfer Agreement.
How to contact us
To contact the UK Covid-19 Inquiry Office: contact@covid19.public-inquiry.uk
You can raise any privacy and data protection concerns with the UK Covid-19 Inquiry Data Protection Officer. The Data Protection Officer provides independent advice and monitoring of the Inquiry’s use of personal information: DPO@covid19.public-inquiry.uk
You can also contact the IPSOS Data Protection Officer with any concerns privacy and data protection concerns in relation to the face to face research: compliance@ipsos.com
Complaints and appeals
If you have already made a complaint to us and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory authority responsible for data protection in the UK.
The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or 0303 123 1113 or icocasework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Review
This privacy notice was last reviewed May 2023.