At the CCRC we are committed to protecting your personal information (‘personal data’) and being transparent about what we do with it.
We are committed to using your personal information in accordance with all applicable laws concerning the protection and processing of personal information and not to do anything with your information you wouldn’t reasonably expect.
This Privacy Policy sets out how and why we obtain and use your personal information, your rights in relation to your personal data and how to complain if you think we are not using your personal data correctly.
The Criminal Cases Review Commission is the data controller for the personal information we hold. There are many ways you can contact us, including by phone, email and post.
Our postal address:
Criminal Cases Review Commission
23 Stephenson Street
Birmingham
B2 4BH
Tel: 0121 233 1473 / 0300 456 2669
Email: info@ccrc.gov.uk
This policy is written in accordance with the General Data Protection Regulation and the Data Protection Act 2018. CCRC is registered as a Data Controller with the Information Commissioner’s Office under number Z4700510.
You can contact our Data Protection Officer at dpo@ccrc.gov.uk or via our postal address. Please mark the envelope ‘Data Protection Officer’.
This policy was last updated in February 2020.
Why we process information about you
The CCRC collects processes and shares personal information in order to carry out our functions. Our main function is to investigate cases where people believe they have been wrongly convicted of a criminal offence or wrongly sentenced.
The majority of personal data we process is passed to us by our applicants, their representatives, or is contained in the information that we obtain from other organisations that had involvement in the case.
Such information may include personal data about others involved in a criminal case such as witnesses, victims, solicitors, barristers, experts and others.
We collect and process the personal information of individuals who apply for a position with us in order to process those applications.
We also process personal information of people who have contacted us with a general enquiry or have made a Freedom of Information request. The data collected in these instances will be the minimum required to process the enquiry or complete the request.
If we process personal information about you, you are a ‘data subject’.
The type of personal information we collect and process
Applicants and investigations
We collect and retain personal data that is relevant to applications received by us that we investigate. This is in order to decide whether a case can be referred back to the court of appeal.
We will share this data with third parties where necessary (please see the section “Who the information may be shared with” below).
If you are an applicant, the personal data we collect about you are your full name, date of birth, address details as well as information about your conviction. We also collect some ethnicity information about you where you agree to give this to us as part of the application form. Ethnicity information is not linked to the application and will not be accessible by those dealing with your case. We use ethnicity information only in an anonymised form for statistical purposes in order to monitor how we perform.
We hold information about individuals who were connected to a case, i.e. witnesses or victims in a criminal case that we review. We do not collect or record the personal information about those who are not the applicant in a structured way (for example as part of a database). Information that we hold about witnesses, victims and others involved in a criminal case is generally contained in the records that we obtain from other organisations (for example the police).
The CCRC has legal powers to obtain any material or information we think we need to investigate a case. We often obtain case related information from the police, the courts and other organisations such as the NHS and social services. Once we have started looking into a case we will decide what material we need. This data is often special category or sensitive data. Under the DPA2018 this is classed as Sensitive Processing. Like the other data we receive from third parties, this data is not held in a structured way (for example as part of a database) and is contained in the records we obtain from third parties (i.e. the NHS) and we meet the requirements for Sensitive Processing.
If you apply for a position with the CCRC
As part of any recruitment process, the CCRC collects and processes personal data relating to job applicants. The information we collect about you includes:
- your name, address and contact details, including email address and telephone number;
- details of your qualifications, skills, experience and employment history;
- information about your current level of remuneration, including benefit entitlements;
- whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
- information about your entitlement to work in the UK; and
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
We collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.
We will also collect personal data about you from third parties, such as references supplied by former employers and information from criminal records checks. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.
You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process. However, if you do not provide the information, the organisation may not be able to process your application properly or at all.
General public
We may also hold some personal information about other people who have contacted us with a general enquiry or Freedom of Information request. This is usually limited to their name and contact details they have supplied to us in order to deal with an enquiry or request.
Purposes of processing and lawful basis of processing
Applicants and investigations
Our purpose is to investigate possible miscarriages of justice in criminal cases according to our duties and powers set out in the Criminal Appeal Act 1995.The legal basis we rely on to process personal data is section 35(2)(b) of the Data Protection Act 2018 (DPA 2018), which allows us to process personal data when the processing is necessary for the performance of a task carried out for that purpose by a competent authority. The DPA 2018 lists the CCRC as a competent authority.
If you apply for a position with the CCRC
The CCRC needs to process data to take steps at your request prior to entering into a contract with you. It also needs to process your data to enter into a contract with you.
In some cases, the CCRC needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts.
The CCRC has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the organisation to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. The organisation may also need to process data from job applicants to respond to and defend against legal claims.
The CCRC is legally obliged to process health information if it needs to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.
Where the CCRC processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes.
For all CCRC positions, it is necessary to carry out National Security Vetting checks to ensure that individuals are permitted to undertake the role in question.
The CCRC will not use your data for any purpose other than the recruitment exercise for which you have applied.
General public
For the processing of personal information about people who have contacted us with a general enquiry or Freedom of Information request, we rely on legitimate interest.
Who the information may be shared with
Applicants and investigations
We sometimes need to share the personal information we process with the individuals themselves, including those acting for them (such as a solicitor), and also with other organisations.
Where this is necessary, we will comply with all aspects of the applicable data protection legislation and not disclose any personal information where it would not be lawful to do so.
If you apply to the CCRC, we will use your personal data, including details about your conviction, in order to obtain information from others about the case that you have asked us to look at. This may be those who have files about you and your case that we need in order to investigate your application. We may also make other enquiries as necessary and this could include checking, for example, matters relating to a previous witness or a victim.
Where this is required, we may therefore use their personal data to make enquiries. We always make sure that any personal data is used in a way that is permitted under the law. If you apply to the CCRC we will use the information you give us to help look into your case.
The organisations and individuals we may share your personal information with include, but are not limited to:
- Trial courts, including Magistrates’ and Crown Courts
- Appeal Courts
- Investigating authorities, such as the police·Prosecuting authorities, such as the Crown Prosecution Service (CPS)
- Social Services
- GPs
- Legal representatives who previously dealt with you.
- Experts that we instruct to re-test evidence or to provide a fresh opinion about a matter
If you apply for a position with the CCRC
The CCRC will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. The CCRC will then share your data with former employers to obtain references for you and the Ministry of Justice Security Branch, who will carry out National Security Vetting checks.
The organisation will not transfer your data outside the European Economic Area.
Retention period for information collected
Applicants and investigations
Once the case has been closed (either referred for appeal, or closed without referral for appeal), the records obtained from other organisations are returned or destroyed after three months. We retain our electronic case file for five years.
Once the five years has elapsed the electronic case file is deleted but a record of the case number and minimal details for archive purposes are retained.
If you apply for a position with the CCRC
If your application for employment is unsuccessful, the CCRC will hold your data on file for 12 months after the end of the relevant recruitment process. If you agree to allow the organisation to keep your personal data on file, the CCRC will hold your data on file for a further 12 months for consideration for future employment opportunities. At the end of that period or once you withdraw your consent; your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in the Employee privacy notice.
General public
Details of other people we deal with (General Enquiries, FoI requests) are retained until they are no longer required.
Staff details
The retention periods of these details are contained within the Staff Privacy Notice.
Access to personal information
You can find out what personal data we have about you by making a ‘subject access request’. Our website has guidance about making a Subject Access Request.
You can make your request verbally or in writing. If you make your request verbally, we recommend that you follow it up in writing so that we can be confident that we provide you with the correct information.
If you have a restriction on your account with us, you may only be able to make your request in writing or via a legal representative.
Because we can only disclose personal information directly about the ‘data subject’, we may also need to confirm your identity.
You can call us or write to us by post or email asking for your personal data.
Criminal Cases Review Commission
23 Stephenson Street
Birmingham
B2 4BH
Tel: 0121 233 1473 / 0300 456 2669
Email: dpo@ccrc.gov.uk
There is no charge for subject access requests.
Your other rights
To exercise your other rights please contact the Data Protection Officer at the above postal address or by emailing dpo@ccrc.gov.uk.
Applicants and investigations
The DPA 2018 in part 3, Law Enforcement Processing, sets out the following rights of Data Subjects:
Right of access
This is commonly known as subject access request and is the right which allows you access to your personal data and supplementary information however it is subject to certain restrictions.
Right to rectification
You are entitled to have your personal data rectified if it is inaccurate or incomplete.
Right to erasure or restriction of processing
You have the right to request the deletion or removal of your personal data and/or the right to ‘block’ or restrict the processing of your personal data where there is no compelling reason for its continued processing.
Right not to be subject to automated decision-making
Automated decision making is a decision made by automated means without any human involvement. The CCRC does not undertake any automated decision making.
If you apply for a position with the CCRC and general public
The GDPR sets out the following rights of data subjects:
Right of access
This is commonly known as subject access request and is the right which allows you access to your personal data and supplementary information however it is subject to certain restrictions.
Right to rectification
You are entitled to have your personal data rectified if it is inaccurate or incomplete.
Right to erasure
You have the right to request the deletion or removal of your personal data where there is no compelling reason for its continued processing.
Right to restrict processing
You have the right to ‘block’ or restrict the processing of your personal data where there is no compelling reason for its continued processing.
Right to portability
You have the right to obtain your data in a common format from us and reuse it for your own purposes
Right not to be subject to automated decision-making
We do not undertake any automated decision making.
How we use cookies
CCRC uses cookies to collect anonymous site usage data to tell us how our site is used. We also use cookies to enable you to use social media functions such as sharing pages on Twitter or Facebook or watching YouTube videos on the website. This also provides us with anonymous data that we can analyse to find how our information is shared outside of the website. To see how we use cookies, what they are, and which ones we use please go to our Cookies page. This page also includes instructions on how to disable cookies if you don’t want them to be used.
Making a complaint to the CCRC
If you wish to make a complaint about the way your personal data has been handled, please write to:
Data Protection Officer
Criminal Cases Review Commission
23 Stephenson Street
Birmingham
B2 4BH
Or email: dpo@ccrc.gov.uk
Making a complaint to the Information Commissioner
For independent advice about the Data Protection Act 2018, GDPR or to make a complaint about how the CCRC has handled your data you can contact the ICO:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF