Appropriate Policy

Introduction  (Back to top)

1. This policy sets out the approach that will be taken by the Patrick Finucane Inquiry (the Inquiry) to processing special category and criminal offence data, as well as the safeguards which are in place for such processing.  It has been developed to meet the requirements in the Data Protection Act 2018 (DPA 2018). It is to be read together with the Inquiries Act 2005 (the Act), the Inquiry Rules 2006 (the Rules) and the other protocols which have been published on the Inquiry’s website.  

2. This policy may be amended from time to time, in which case an amended version will be published on the Inquiry website. 

Special category and criminal offence data  

3. Special category data is defined by Article 9 of the UK General Data Protection Regulation (GDPR) as personal data which reveals:  

• Racial or ethnic origin  

• Political opinions  

• Religious or philosophical beliefs  

• Trade union membership  

• Genetic data  

• Biometric data for the purpose of uniquely identifying a natural person  

• Data concerning health  

• Data concerning a natural person’s sex life or sexual orientation  

4. Article 10 of the GDPR makes provision for the processing of personal data relating to criminal convictions and offences. Section 11(2) of the DPA 2018 provides that references to criminal convictions and offences include: (a) the alleged commission of offences; and (b) proceedings for an offence committed or alleged to have been committed or the disposal of such proceedings, including sentencing.  

Lawful basis for processing   (Back to top)

5. The Inquiry is a statutory inquiry established under the Act. Its Terms of Reference are available here.  

6. As part of the Inquiry’s functions, it may process special category and criminal offence data on the following bases:  

1. The processing is necessary for the performance of a task carried out in the public interest or a task carried out in the exercise of official authority vested in the Chair of the Inquiry (Article 6(1)(e));  

2. The processing is necessary for compliance with legal obligations (Article 6(1)(c));  

3. In the case of providers of services to the Inquiry, the processing is necessary for the performance of a contract (Article 6(1)(b));  

4. In some limited cases, consent (Article 6(1)(a)).  

7. The Inquiry’s Privacy Policy  provides further information including the types of information processed by the Inquiry, how it is processed and individuals’ rights.  

Conditions for processing special category data and criminal offence data

8. The Inquiry processes special category data under the following bases:  

1. The processing is necessary for reasons of substantial public interest (Article 9(2)(g));  

2. In some limited cases, the data subject has given explicit consent for one or more specified purposes (Article 9(2)(a)).  

9. Article 10 of the GDPR permits the processing of personal data relating to criminal convictions and offences under the control of official authority or where the processing is lawfully authorised. The Inquiry therefore processes criminal offence data under Article 10 of the GDPR in circumstances where it is exercising official authority that enables it to do so; in this case exercising its functions under the Act and investigating its Terms of Reference.  

10. Section 10(3) of the DPA 2018 provides that in order for the processing of special categories of personal data and criminal offence data to be necessary for reasons of substantial public interest, under Article 9(2)(g) of the GDPR, such processing must meet one of the conditions set out in Part 2 of Schedule 1. The Inquiry processes special category and criminal offence data in order to meet its statutory purposes (Schedule 1, Part 2 paragraph 6).  

Compliance with the data protection principles   (Back to top)

11. In accordance with the accountability principle, the Inquiry maintains records of processing activities under Article 30 of the GDPR and section 61 of the DPA 2018. We carry out data protection impact assessments where appropriate in accordance with Articles 35 and 36 of the GDPR and section 64 of the DPA 2018 for law enforcement processing to ensure data protection by design and default. The Secretary to the Inquiry is the Senior Information Risk Owner for the Inquiry who is responsible for ensuring that the Inquiry is compliant with these principles. 

12. The Inquiry follows the data protection principles set out in Article 5 of the GDPR as follows:  

a. Lawfulness, fairness and transparency  

The Inquiry is a statutory inquiry established under the Act with its Terms of Reference made under section 5 of the Act. The Inquiry’s proceedings are governed by the Act and the Rules. In particular, section 18 of the Act requires the Chair to take reasonable steps to enable members of the public to attend the Inquiry, or to see or hear a transmission of proceedings at the Inquiry and access evidence produced to the Inquiry.  

b. Purpose limitation  

The Inquiry does not process personal data for purposes that are incompatible with the purposes for which it is collected. When we process personal data to fulfil our statutory functions, we do so in accordance with the Act and the Rules in order to investigate the matters set out in the Terms of Reference. When we share special category data, sensitive data or criminal offence data with another controller, processor or jurisdiction, we will ensure that the data transfers are compliant with relevant laws and regulations and use appropriate international treaties, data sharing agreements and contracts as necessary.  

c. Data minimisation  

We collect personal data that is adequate, relevant and limited to the relevant purposes for which it is processed. We ensure that the information we process is necessary for and proportionate to our purposes.  

d. Accuracy  

Personal data shall be accurate and, where necessary, kept up to date. Where we become aware that personal data is inaccurate or out of date, having regard to the purpose for which it is being processed, we will take every reasonable step to ensure that data is erased or rectified without delay.  

e. Storage limitation  

Personal data, special category data, and criminal offence data collected as part of the evidence will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry, some of the personal data held by the Inquiry will – where it is considered to form part of the historic record – be transferred for the purposes of indefinite retention of inquiry records by The National Archives in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes will be destroyed or transferred to the Inquiry’s sponsor department for retention for a limited period.  

f. Integrity and confidentiality 

We have put in place appropriate technical, physical and managerial procedures to safeguard and secure the information we collect about individuals.  We have strict security standards, and all our staff and other people who process personal data on our behalf get regular training about how to keep information safe.  We limit access to personal information to those who have a business or legal need to see it (this includes the Inquiry team and third parties).  Third parties or contractors that the Inquiry engages will only process your personal information on our instructions or with our agreement, and where they do so they have agreed to treat the information confidentially and to keep it secure.                         

Further information  (Back to top)

13. For further information, please contact enquiries@finucane.independent-inquiry.uk.

Review  (Back to top)

14. This version of the Appropriate Policy was published on 9 March 2026.