Appropriate Policy

Special category and criminal conviction personal data (Appropriate Policy)

Introduction

1. This document outlines how the Orgreave Inquiry (‘‘the Inquiry’’) will protect special category and criminal convictions personal data.
2. It meets the requirement at paragraph 5 of Schedule 1 to the Data Protection Act 2018 that an appropriate policy document be in place where the processing of special category personal data is necessary for reasons of substantial public interest. The specific conditions under which data may be processed by the Inquiry for reasons of substantial public interest are set out at paragraphs 5, 6 and 26 of Schedule 1 to the Data Protection Act 2018.
3. For further information on our conditions for processing please refer to the Inquiry’s Privacy Notice.

Purposes of data collection

4. The purposes for which the Inquiry collects and processes your personal data are the effective conduct of the Inquiry and discharging the Terms of Reference pursuant to the Inquiries Act 2005 (‘‘the 2005 Act’’). It does so by means of a legal process within the framework of the 2005 Act and the Inquiry Rules 2006 (‘‘the Rules’’).
5. The way in which personal data is used is set out in the Privacy Notice. Under Article 30 of the UKGDPR the Inquiry’s record of processing activities (ROPA) will state:
   • The condition relied upon;
   • The legal basis for processing personal data under Article 6 of the UK GDPR;
   • The legal basis for processing special category personal data under Article 9 of the UK GDPR
   • The condition for processing sensitive personal data under the Data Protection Act 2018; and
   • Procedures for securing compliance

Data Protection Principles

6. Article 5 of the General Data Protection Regulation sets out the data protection principles. These are the Inquiry’s procedures for ensuring that we comply with them:

Principle 1 Lawfulness, fairness and transparency:

7. Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
8. The Inquiry will:
   • Ensure that personal data is only processed where a lawful basis applies, and where processing is otherwise lawful;
   • Only process personal data fairly, and will ensure that data subjects are not misled about the purposes of any processing; and
   • Ensure the transparency of processing, including via the information provided in the privacy notice published on the Inquiry website.

Principle 2 Purpose limitation

9. Personal data shall be collected for specified, explicit and legitimate purposes consistent with the Inquiry’s terms of reference and not further processed in a manner that is incompatible with those purposes.
10. The Inquiry will:
    • Only collect personal data for specified, explicit and legitimate purposes, and will inform data subjects what those purposes are in a published privacy notice; and
    • Not use personal data for purposes that are incompatible with the purposes for which it was collected (unless doing so is permitted by the relevant legislation).

Principle 3 Data minimisation

11. Personal data shall be adequate, relevant and limited to what is necessary in relation/ to the purposes for which they are processed (data minimisation’).
12. The Inquiry will:
    • The Inquiry will ensure that Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed, and we will complete a Data Protection Impact Assessment when appropriate to ensure we have sufficient data to properly fulfil these purposes.
    • The Inquiry will only collect and/or disclose the minimum personal data that it needs for the purpose for which it is collected and/or disclosed. The Inquiry will ensure that the data it collects is adequate, relevant and reviewed regularly.

Principle 4 Accuracy

13. Personal data shall be accurate and, where necessary, kept up to date.
14. The Inquiry will:
    • ensure that personal data is accurate and kept up to date where necessary by taking particular care where its use of the personal data has a significant impact on individuals
    • ensure we record mistakes and/or challenges to the accuracy of our data and ensure compliance with the individual’s right to rectification. The Inquiry will take every reasonable step to ensure that inaccurate data is erased or rectified without delay.

Principle 5 Storage Limitation

15. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
16. The Inquiry will
    • only keep personal data in identifiable form until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal data will be transferred for the purposes of retention of the Inquiry records by The National Archives in accordance with the Public Records Act 1958, where it will be available for historical research.
    • Personal data that is not required for archiving purposes will be destroyed, in line with the Inquiry’s retention schedule or anonymised when no longer required.

Principle 6 Integrity and Confidentiality

17. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures. The Inquiry will audit periodically for compliance.
18. The Inquiry will:
    • Ensure that personal data is shared only with those who are required to see it as part of the legal process of the Inquiry (which, as part of the Inquiry’s duties under the Inquiries Act 2005, may include the public).
    • At all times, consider whether the processing or disclosure of such data is necessary for it’s proceedings and functioning.
    • Ensure that appropriate organisational and technical measures are in place to protect personal data. These include robust redactions processes that govern the protection of personal data. These processes ensure that – save where consent is provided by the data subject – only personal data necessary for the Inquiry’s performance of its functions will be disclosed outside the Inquiry or to those instructed by the Inquiry.

Principle 7 Accountability

19. The Inquiry is the Data Controller and shall be responsible for, and be able to demonstrate compliance with, the UK GDPR principles. The Secretary to the Inquiry is the Senior Information Risk Owner for the Inquiry who is responsible for ensuring that the Inquiry is compliant with these principles.
20. The Inquiry will:
    • Ensure that records are kept of all personal data processing activities, and that these are provided to the Information Commissioner on request;
    • Carry out a Data Protection Impact Assessment for any high-risk personal data processing, and consult the Information Commissioner if appropriate;
    • Appoint a Data Protection Officer to provide independent advice and monitoring of the Inquiry’s personal data handling, and ensure that this person has access to the Chair and Secretary of the Inquiry;
    • Have appropriate data protection policies in place;
    • Have internal processes in place to ensure that personal data is only collected, used or handled in a way that is compliant with data protection law.

Data controller’s policies as regards retention and erasure of personal data

21. The Inquiry will ensure, where personal data, special category or criminal convictions personal data is processed, that:
    • There is a record of that processing, and that that record will set out, where possible, the time limits envisaged for erasure of the different categories of personal data;
    • Where it no longer requires personal data, special category or criminal convictions personal data for the purpose for which it was collected, it will delete it or render it permanently anonymous in line with the Inquiry’s Retention Schedules; and
    • Data subjects receive (via the privacy notice) full privacy information about how their data will be handled, the period for which the personal data will be stored as outlined in the Inquiry’s Retention Policy & Schedules, or if that is not possible, the criteria used to determine that period.

The Inquiry is a data controller.

This policy was last updated in March 2026.