Core participant privacy notice

We, the Emma Caldwell Inquiry ("we/us/our" or the "Inquiry"), are the controller of the personal data that we process about you as a Core Participant (as defined below) or a prospective Core Participant in the Inquiry. This means that we are legally responsible for how we process personal data about you. It also means that we are required to comply with data protection laws when processing your personal data. 

A "Core Participant" is a person, organisation, or other entity with a significant interest in the Inquiry, and designated as a Core Participant in the Inquiry under Rule 4 of the Inquiries (Scotland) Rules 2007 (the "2007 Rules"). This privacy notice explains how we will use personal data that Core Participants or prospective Core Participants provide to us, who it may be shared with and Core Participants'  or prospective Core Participants' rights in respect of their personal data. 

We have appointed a Data Protection Officer (“DPO”), Morton Fraser MacRoberts LLP.

If you have any questions about this privacy notice or how we process your personal data, please contact us and we will forward it on to our DPO, as necessary. 

1. What personal data do we process about you?
As a Core Participant or a prospective Core Participant, we process the personal data that is provided to us by you or other providers of evidence as part of your application for designation as a Core Participant and/or other personal data that we may obtain from you or others on an ongoing basis during the course of the proceedings of the Inquiry, including: 

  • your name;
  • your contact information, including your address, telephone number and e-mail address;
  • particulars of your organisation, including your occupation, your job title and/or role/position within the organisation;
  • your date of birth;
  • your images and voice recordings which we record as part of streaming the proceedings of the Inquiry on our website and/or or YouTube channel;
  • the content of your Core Participant application, including how you satisfy the criteria to be designated as a Core Participant and particulars of your legal representative from time to time, if you choose to be legally represented at the Inquiry;
  • your participation in the Inquiry and any personal data that you provide in relation to the terms of reference of the Inquiry, including: 
    - disclosure of the identity of any third parties who hold information that might be relevant to the terms of reference of the Inquiry; 
    - any evidence or documents that you provide or produce to the Inquiry (whether orally or in writing); 
    - your suggestions regarding the list of issues to be considered by the Inquiry and the list of witnesses who will give evidence to the Inquiry; 
    - your opening and closing statements at hearings of the Inquiry; 
    - your suggested questions or lines of questioning to ask of witnesses submitted to Counsel to the Inquiry; 
    - the questions you ask of witnesses when such witnesses are providing oral evidence to the Inquiry (with the Chair to the Inquiry’s permission); and
    - your comments on the Inquiry’s interim report (if an interim report is delivered by the Inquiry); 
  • your application to the chair of the Inquiry ("Chair") for an award to be made for assistance with the costs of legal representation, if required; 
  • any special category data that you choose to disclose to the Inquiry (see below);  
  • any other personal data that you provide when you otherwise engage with us; and 
  • images captured by our CCTV when you attend the Inquiry. 

2. Why do we process this personal data about you? 
We process such personal data: 

  • for the purposes of the proceedings of the Inquiry in accordance with the terms of reference and the legislation applicable to inquiries, including the Inquiries Act 2005 (“2005 Act”) and the 2007 Rules and fulfilling the Inquiry's terms of reference;
  • to permit the Chair to determine whether to designate you as a Core Participant;
  • to permit the Chair to determine your application for an award for assistance with the costs of legal representation which are to be incurred;
  • to permit the solicitor to the Inquiry to determine your application for an award for assistance with the costs of legal representation which have already been incurred;
  • as part of any dispute regarding the amount of an award for assistance with the costs of legal representation, including referrals to the Auditor of the Court of Session;
  • to publish your designation as Core Participant on the Inquiry’s website;
  • as part of streaming the proceedings of the Inquiry on the website, YouTube or other publicly accessible platform and thereafter making these available on our website, YouTube or other publicly accessible platform to ensure the Inquiry is accessible and transparent as possible;
  • to prepare, deliver and publish the report of the Inquiry (including any interim report);  
  • when disclosing or publishing evidence and documents given, produced or provided to the Inquiry; and
  • for security purposes and prevention and/or detection of crime when using CCTV at the Inquiry. 
     

Special category data and personal data relating to criminal convictions and offences

We sometimes need to process special category data (personal data relating, for example, to health, racial and ethnic origin, criminal convictions, sex life or sexual orientation) and personal data relating to criminal convictions and offences when fulfilling the above purposes.

When we do this, we do so for reasons of substantial public interest; this being the public interest in the Inquiry fulfilling its duties under the 2005 Act and to allow the Chair to exercise their duties conferred on them by law. We understand this type of personal data is higher risk and we will only use this personal data where necessary and in line with our Appropriate Policy Document.

3. What is our legal basis for processing your personal data? 
Data protection laws require us to have a legal basis for processing your personal data.
 
Our legal bases for processing your personal data are that it is:  

  • necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Chair of the Inquiry in accordance with the 2005 Act and the 2007 Rules;  
  • necessary to comply with legal obligations to which we are subject regarding the proceedings of an inquiry contained in the 2005 Act and the 2007 Rules; and
  • in our legitimate interests of maintaining security at the Inquiry and prevention and/or detection of crime when using CCTV.

Our legal basis for processing your special category data and personal data relating to criminal convictions and offences are as follows:

  • it is necessary for reasons of substantial public interest; and
  • it is authorised by domestic law by virtue of the 2005 Act. 

Data protection laws require further substantial public interest conditions for our processing special category and criminal convictions and offences data. Our processing is necessary for statutory and government purposes as part of the exercise of functions conferred on the Chair of the Inquiry by the 2005 Act and the 2007 Rules.   

4. Who do we share your personal data with? 
We may disclose your personal data to the following organisations for the purposes described in section 2 of this privacy notice: 

  • your legal representative;
  • expert witnesses appointed by the Inquiry;
  • our service providers, including our IT service and document management system providers, for the purposes of storing, reviewing and analysing documents and information;
  • our solicitors, professional advisers and consultants (including our DPO) for advice on matters concerning the Inquiry;
  • the Auditor of the Court of Session, if you dispute the amount of an award for assistance with the costs of legal representation and a referral to the Auditor is required;
  • the public via the Inquiry’s website, YouTube and/or similar video hosting platforms or within the report of the Inquiry, subject to appropriate redactions being made;
  • the press and other interested parties, subject to appropriate redactions being made;
  • other Core Participants where necessary, subject to suitable redactions being made;
  • the Police or other law enforcement agency to assist with a criminal investigation; and
  • the Keeper of the Records of Scotland. 

5.  Will your personal data be sent outside the UK? 
Any information published on our website or YouTube and/or similar video hosting platforms will naturally be accessible outside of the UK. You can read about YouTube’s handling of personal data YouTube privacy settings to protect your data – how YouTube works.

Our IT service and document management service providers may be based or may make use of data storage facilities that are located outside the United Kingdom. Their handling and use of your personal data will involve us and/or them transferring it outside the United Kingdom. When we and/or they do this, we will ensure similar protection is afforded to it by:  

  • only transferring it or permitting its transfer to countries that provide an adequate level of protection for personal data under data protection laws; or
  • using specific contracts with such organisations, which are approved for use in the United Kingdom, and which give your personal data the same protection it has in the United Kingdom after it is transferred.  

There may be circumstances where we need to contact a party outside of the United Kingdom e.g. an independent expert witness or other party relevant to the work of the Inquiry and if this occurs we will ensure any sharing of personal data is kept to a minimum and any transfer is in line with data protection legislation.

Please contact the Inquiry for further information on the specific mechanism used by us when transferring your personal data outside the United Kingdom and we will forward it on to our DPO, as necessary.

6.    How long do we keep your personal data? 
We can keep your personal data for as long as we need to for the purposes described in this privacy notice, including to meet any legal requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we handle and use your personal data and whether we can achieve those purposes through other means, and the applicable legal or other requirements.  

At the end of the Inquiry or for a maximum of 12 months thereafter, any personal data we still hold about you will be deleted. The exception to this is if this data is to form part of the historic record of the Inquiry, some of which may include special category or personal data relating to criminal convictions and offences, in which case it will be transferred to the Keeper of the Records of Scotland, and stored and handled according to data protection law relating to archiving in the public interest.

All other data that is not part of the record will be deleted at the end of the Inquiry.

7.    What rights do you have in relation to your personal data that we process? 
It is important that the personal data that we process about you is accurate and current. Please keep us informed of any changes by contacting the Inquiry and we will forward it on to our DPO, as necessary. 
Under certain circumstances, the law gives you the right to:  

  • Access a copy of your personal data and to check that we are processing it in accordance with legal requirements;
  • Correct any inaccurate or complete any incomplete personal data that we process about you;
  • Delete your personal data where there are no grounds for us continuing to process it. You also have the right to ask us to do this where you object to us processing your personal data;
  • Restrict our processing of your personal data, for example, if you contest the accuracy of your personal data;
  • Object to us processing your personal data where we rely on public task or legitimate interests grounds for data processing;
  • Obtain and reuse the personal data that we hold about you for your own purposes in certain circumstances.

Please contact us if you wish to make any of the above requests. When you make a request, we may ask you for specific information to help us confirm your identity for security reasons. You will not need to pay a fee when you make any of the above requests, but we may charge a reasonable fee or refuse to comply if your request for access is clearly unfounded or excessive. 

Please note these rights are not absolute and we will explain clearly the reasons we cannot comply with a request to exercise these rights where appropriate, in conjunction with our DPO where necessary. You will not be subject to decisions that will have a significant or legal impact on you based solely on automated decision-making.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

8.    Feedback and complaints 
We welcome your feedback on how we process your personal data, please contact us. 

You have the right to make a complaint to the Information Commissioner’s Office 
(“ICO”), the UK regulator for data protection, about how we process your personal data. The ICO’s contact details are as follows: 
Telephone: 0303 123 1113 
Website:     https://ico.org.uk/concerns/ 

If you would like to receive this privacy notice in alternative format, for example, audio, large print or braille, please contact us. 

9.    Updates to this privacy notice  
We may update this privacy notice at any time, and you should check our website occasionally to ensure you are aware of the most recent version that will apply each time you access our website. We will provide you with an updated version when we are required to do so by law. 

Last updated: December 2025

Privacy notice - Core Participants - December 2025 PDF | 208.6KB