Privacy notice

This notice explains how the Emma Caldwell Inquiry collects and uses personal information.

The Emma Caldwell Inquiry ("we/us/our" or the "Inquiry") is an independent public inquiry exercising statutory functions in the public interest, established under the Inquiries Act 2005 (“2005 Act”).

We need to collect, use and otherwise process personal information in order to fulfil our statutory duties and our terms of reference. This privacy notice explains how we do this.

We are the controller of your personal data, which means that we are legally responsible for how we hold and use your personal data.

If you are a core participant then we will issue you with a separate privacy notice, which sets out how we handle and use your personal data, special category data and personal data relating to criminal convictions and offences for that purpose. Our privacy notices can be found on the Key Documents page of this website.

We have appointed a Data Protection Officer (“DPO”), Morton Fraser MacRoberts LLP.

If you have any questions about this privacy notice or how we hold or use your personal data, please contact the Inquiry. 

The Inquiry will seek appropriate advice and input from the DPO to answer your query, if necessary.

1.    What personal data do we process about you?
As an inquiry we require to gather evidence and liaise with a wide range of individuals on a number of matters. Our website is a place for you to find out more about the Inquiry and how you can get involved in the Inquiry.

The personal information we may process to fulfil our statutory duties and the terms of reference is difficult to define exhaustively.

However, we anticipate we will collect and process, (to the extent necessary depending on the circumstances and the identity of the individual/his or her involvement in the work of the Inquiry):

  • personal data and special category data (such as personal data relating to health, and racial and ethnic origin) about you when you contact us by telephone, e-mail or letter, or report a problem with our website. This may include your name, address and contact details, your opinion on matters relevant to the Inquiry and any information about your interest in the Inquiry when you otherwise engage with us, if you choose to provide this to us;
  • personal data about you through the use of cookies on our website. For further information, please see our Cookie Policy; and
  • personal information about individuals, core participants designated in that capacity by the Chair of the Inquiry under rule 4 of the Inquiries (Scotland) Rules 2007 (“the 2007 Rules”) and their employees, providers of evidence or other relevant materials, witnesses (whether by way of written statement or via oral evidence given at hearings), independent expert witnesses instructed by the Inquiry, individuals who may be subject to criticism as per rules 12 and 13 of the 2007 Rules, the providers of services to the Inquiry (such as IT, recruitment, procurement, security, transcription facilities and witness support), members of the public, legal representatives (including recognised legal representatives as per rule 5 to 7 of the 2007 Rules), other entities we may liaise with, members of the press, visitors to the Inquiry and any other individual who liaises with the Inquiry.

We may also collect personal data relating to criminal convictions and offences.

Depending on the circumstances we may collect this personal information direct from you/your legal representative or a third party such as (without limitation) core participants, independent expert witnesses, witnesses, regulatory bodies or government authorities. Others may include personal information about you in their evidence to the Inquiry.

2.    Why do we process this personal data about you?
Our primary purpose of processing personal data is to fulfil our statutory duties under the 2005 Act, to assist with our investigations and to fulfil the Inquiry's terms of reference.

In doing this, we use personal data in a number of different ways, including:

  • the gathering of evidence as part of our investigations;
  • enabling people to access the work of the Inquiry;
  • allowing us to consider your comments, enquiries, complaints and suggestions and respond, if necessary;
  • communicating with individuals with an interest or involvement in our work to keep them updated about our progress;
  • complying with our obligations under the law or agreements we have entered into; and
  • making improvements to our website in response to your feedback.

We may also use personal data relating to criminal convictions and offences when an offence has been, or is suspected of having been, committed.

3.    What is our legal basis for processing your personal data?
The Inquiry processes personal information fairly and lawfully in compliance with data protection legislation. Such processing of personal information is necessary to enable us to carry out our work.

In some cases, personal information will be provided to and processed by the Inquiry on a voluntary basis and in others (where necessary), the Inquiry may require the provision of personal information using its powers under section 21 of the 2005 Act for the purposes of discharging its statutory functions.

Our legal bases for processing your personal data are that it is:

  • necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Chair of the Inquiry in accordance with the 2005 Act and 2007 Rules;
  • necessary to comply with legal obligations to which we are subject regarding the proceedings of an inquiry contained in the 2005 Act and the 2007 Rules; and
  • in our legitimate interests of maintaining security at the Inquiry and prevention and/or detection of crime when using CCTV.

There may be some personal data we collect which may fall outside of the above. In those cases, we rely on our legitimate interest to process your personal data. For example, it is in our and your legitimate interest that we process your personal data in order to respond to your queries, provide you with information requested or otherwise deal with your comments or feedback. It is in our legitimate interest to process your personal data to make improvements to our website in response to your feedback, if appropriate. In considering whether we have a legitimate interest in processing your personal data, we will take into account any impact of our processing of your personal data on you and what steps we can take to minimise any such impact.

To the extent we are processing special category data or personal data relating to criminal convictions and offences, we also rely on the fact it is:

  • necessary for the performance of a task carried out in the substantial public interest; and
  • is in the exercise of a function conferred on us under the 2005 Act.

4.    Who do we share your personal data with?
To enable the work of the Inquiry, we may disclose your personal information to the following individuals and/or organisations for the purposes described above:

  • the staff of the Inquiry, including the Chair and Counsel;
  • your legal representative;
  • the legal representatives of other individuals or organisations listed below;
  • independent expert witnesses instructed by the Inquiry;
  • core participants, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
  • individuals who or organisations which are to provide evidence to the Inquiry in a written statement or as an oral witness and/or their legal representatives, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
  • individuals who or organisations which might be or have been the subject of criticism in the proceedings or report(s) of the Inquiry and/or their legal representatives, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
  • our solicitors, professional advisers and consultants (including our DPO) for advice on matters concerning the Inquiry;
  • the public via the Inquiry’s website, YouTube and/or similar video hosting platforms or within the report(s) of the Inquiry, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
  • the press and other interested parties, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
  • the Auditor of the Court of Session, if you dispute the amount of an award for assistance with the costs of legal representation and a referral to the Auditor is required;
  • our service providers with whom we have agreements to provide services and which have been procured and vetted for us by the Scottish Government, including our IT service and document management system providers, for the purposes of storing documents and information, supporting the Inquiry’s systems, enabling publication of Inquiry materials, subject to the instructions of the Inquiry as to what they are permitted to do with the information;
  • government bodies; and
  • the Police and law enforcement agencies in certain circumstances, for example, where an offence has been, or is suspected of having been, committed;
  • the Keeper of the Records of Scotland to comply with the provisions of rule 16(3) of the 2007 Rules.

5.    Will your personal data be sent outside the UK?
Our IT service and document management service providers may be based or may make use of data storage facilities that are located outside the United Kingdom. Their handling and use of your personal data will involve us and/or them transferring it outside the United Kingdom. When we and/or they do this, we will ensure similar protection is afforded to it by:

  • only transferring it or permitting its transfer to countries that provide an adequate level of protection for personal data under data protection laws; or
  • using specific contracts with such organisations, which are approved for use in the United Kingdom, and which give your personal data the same protection it has in the United Kingdom after it is transferred.

There may be circumstances where we need to contact a party outside of the United Kingdom e.g. an independent expert witness or other party relevant to the work of the Inquiry and if this occurs we will ensure any sharing of personal data is kept to a minimum and any transfer is in line with data protection legislation.

It should also be noted that any information published on our website or YouTube and/or similar video hosting platforms will naturally be accessible outside of the UK.

You can read about YouTube’s handling of personal data YouTube privacy settings to protect your data – how YouTube works.

Please contact us for further information on the specific mechanism used by us when transferring your personal data outside the United Kingdom.

6.    How long do we keep your personal data?
We will only keep your personal data for as long as we need to for the purposes described in section 2 of this privacy notice, including to meet any legal or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or other requirements.

Depending on the nature of your query, we may keep your personal data until the end of the Inquiry or for a maximum of 12 months thereafter, at which point, some of the personal data (where it is to form part of the historic record of the Inquiry), some of which may include special category data and personal data relating to criminal convictions and offences, will be transferred to the Keeper of the Records of Scotland, where such information will be stored and handled according to data protection law relating to archiving in the public interest.

All other data that is not part of the record will be securely deleted at the end of the Inquiry.

7.    How the Inquiry keeps personal data secure
The security of your personal data is important to us and we have appropriate technical and organisational measures to safeguard your personal data. We also have procedures in place to deal with any suspected data security breach. We will notify you and the Information Commissioner’s Office (“ICO”) of a suspected data security breach where legally required to do so.

8.    What rights do you have in relation to your personal data that we process?
It is important that the personal data that we process about you is accurate and current. Please keep us informed of any changes by contacting us. Under certain circumstances, the law gives you the right to:

  • Access a copy of your personal data and to check that we are processing it in accordance with legal requirements;
  • Correct any inaccurate or complete any incomplete personal data that we process about you;
  • Delete your personal data where there are no grounds for us continuing to process it. You also have the right to ask us to do this where you object to us processing your personal data;
  • Restrict our processing of your personal data, for example, if you contest the accuracy of your personal data;
  • Object to us processing your personal data where we rely on public task or legitimate interests grounds for data processing;
  • Request a copy in structured, commonly used and machine-readable format of any personal data you have provided to us on a consent basis and have this transferred to another organisation.

Please contact us if you wish to make any of the above requests. When you make a request, we may ask you for specific information to help us confirm your identity for security reasons. You will not need to pay a fee when you make any of the above requests, but we may charge a reasonable fee or refuse to comply if your request for access is clearly unfounded or excessive.

Please note these rights are not absolute and we will explain clearly the reasons we cannot comply with a request to exercise these rights where appropriate, in conjunction with our DPO where necessary.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

9.    Third party links
This website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share personal data about you. We do not control these third party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy notice of every website you visit to understand how they collect, hold and use your personal data.

10.    Feedback and complaints
We welcome your feedback on how we process your personal data, please contact us.

You have the right to make a complaint to the ICO, the UK regulator for data protection, about how we process your personal data. The ICO’s contact details are as follows:

Telephone:    0303 123 1113
Website:    https://ico.org.uk/concerns/

If you would like to receive this privacy notice in alternative format, for example, audio, large print or braille, please contact us.

11.    Updates to this notice
We may update this privacy notice at any time, and you should check our website occasionally to ensure you are aware of the most recent version that will apply each time you access our website. We will provide you with an updated version when we are required to do so by law.

Last updated: December 2025
 

Privacy notice - December 2025 PDF | 148.5KB