Privacy Notice of the Eljamel Inquiry
This Notice explains how the Eljamel Inquiry collects and uses personal information
The Eljamel Inquiry (“the Inquiry”, “we”) is an independent public inquiry established and exercising statutory functions in the public interest under the Inquiries Act 2005 (“the 2005 Act”).
We need to collect, use and otherwise process personal information in order to fulfil our statutory duties and our Terms of Reference and this notice explains how we do this. We are the controller of personal information we may collect.
We have appointed a Data Protection Officer (“DPO”), Thorntons Law LLP.
If you have any questions about this notice or how we hold or use your personal information, please contact us by e-mail at dpo@eljamelinquiry.scot or at: The Eljamel Inquiry, Area 2J North, Victoria Quay, Edinburgh EH6 6QQ.
The Inquiry will seek appropriate advice and input from the DPO to answer your query, if necessary.
1. What personal information do we collect, use and process and where do we get it from?
As an Inquiry we require to gather evidence and liaise with a wide range of individuals on a number of matters.
In doing so we will collect personal information about individuals, including Mr Eljamel, former patients of Mr Eljamel, personal representatives of former patients of Mr Eljamel, core participants designated in that capacity by the Chair of the Inquiry under rule 4 of the Inquiries (Scotland) Rules 2007 (“the 2007 Rules”) and their employees, contributors to our public consultation on our Terms of Reference, providers of evidence or other relevant materials, witnesses (whether by way of written statement or via oral evidence given at hearings), applicants to the Independent Clinical Review (“ICR”) (comprising former patients of Mr Eljamel or their personal representatives), independent expert witnesses instructed by the ICR or the Inquiry, individuals who may be subject to criticism as per rules 12 and 13 of the 2007 Rules, members of the sponsor team appointed by Scottish Government to liaise with the Inquiry on behalf of the Scottish Ministers, the providers of services to the Inquiry (such as IT, recruitment, procurement, security, transcription facilities and witness support), members of the public, legal representatives (including recognised legal representatives as per rule 5 to 7 of the 2007 Rules), members of the medical profession e.g. GPs, neurosurgeons, etc., the Chair and employees of the ICR or other entities we may liaise with, members of the press, visitors to the Inquiry and any other individual who liaises with the Inquiry.
Depending on the circumstances we may collect this personal information direct from you/your legal representative or a third party such as (without limitation) NHS Tayside, GPs, private healthcare providers, independent expert witnesses, witnesses, the ICR, regulatory bodies or government authorities. Others may include personal information about you in their evidence to the ICR or to the Inquiry.
2. What personal information do we collect?
The personal information we may process to fulfil our statutory duties and the Terms of Reference is difficult to define exhaustively.
However, we anticipate we will collect, (to the extent necessary depending on the circumstances and the identity of the individual/ his or her involvement in the work of the Inquiry):
• name; address and contact information; information about the relationship between personal representatives and former patients;
• date of birth; Community Health Index (CHI) number; medical records including NHS hospital records, GP records and private hospital records; medical information including mental health information and the impact your medical care has had on you; information about medical treatment and treatment outcomes; professional opinions about the medical care received including independent expert reports (whether instructed by the Inquiry or the ICR);
• your role in the Inquiry e.g. legal representative or member of the press; your professional occupation e.g. of independent expert witnesses or others, together with details of expertise, qualifications, professional experience, training etc, complaints, suspensions or investigations about your role, if relevant;
• your views on the Inquiry’s Terms of Reference and List of Issues;
• complaints, reports or feedback you may have submitted or been the subject of, insofar as relevant to Terms of Reference 3, 4 or 5 which may encompass personal data about you including your opinions;
• information about your professional appointment(s) and inductions insofar as relevant to Term of Reference 1 and 2(d);
• administrative information relating to working patterns and pressures relating to the practice of Mr Eljamel insofar as relevant to Terms of Reference 2(a) and 2(c);
• information relating to training or education you may have provided or received insofar as relevant to Terms of Reference 2(b);
• information relating to research which you may have conducted or been the subject of insofar as relevant to Term of Reference 2(e);
• information relating to investigations into your professional practice, insofar as relevant to Terms of Reference 3, 4, 5, 6, 8, 9, 10, 11, 12 or 13;
• information about you or disseminated by you, insofar as relevant to Terms of Reference 7 or 13;
• information about your clinical supervision, insofar as relevant to Term of Reference 8;
• information about your suspension, insofar as relevant to Term of Reference 9;
• information about your resignation from NHS Tayside, insofar as relevant to Term of Reference 10;
• information about the removal of your name from the GMC medical register, insofar as relevant to Term of Reference 11;
• your images and voice recordings we have recorded if you have given oral evidence;
• accessibility needs (if you are to attend the Inquiry);
• your opinion on matters relevant to the Inquiry and any other information you provide to the Inquiry when you otherwise engage with us;
• images captured by our CCTV when you attend the Inquiry; and
• any other personal information that we require to process to fulfil our Terms of Reference to the extent not covered above.
Some of the material which the Inquiry will collect, use and otherwise process will contain special category information relating, for example, to health, racial and ethnic origin, criminal convictions, sex life or sexual orientation.
We understand a high proportion of personal data that we process will be health data and therefore higher risk and we will only use this personal data where necessary and in line with our Appropriate Policy Document.
We may also collect personal data about you through the use of cookies on our website (www.eljamelinquiry.scot).
For further information, please see our Cookies Policy in the footer of our website.
3. Why do we process this personal information about you?
Our primary purpose of processing personal data is to fulfil our statutory duties under the 2005 Act, to assist with our investigations and to fulfil the Terms of Reference.
In doing this, we use personal information in a number of different ways, including the gathering of evidence as part of our investigations, enabling people to access the work of the Inquiry, communicating with individuals with an interest or involvement in our work to keep them updates about our progress and complying with our obligations under the law or agreements we have entered into.
4. What is the lawful basis upon which we process personal information?
The Inquiry processes personal information fairly and lawfully in compliance with data protection legislation. Such processing of personal information is necessary to enable us to carry out our work.
In some cases, personal information will be provided to and processed by the Inquiry on a voluntary basis and in others (where necessary), the Inquiry may require the provision of personal information using its powers under section 21 of the 2005 Act for the purposes of discharging its statutory functions.
Our lawful basis for processing personal information is the performance of a task carried out in the public interest and in the exercise of official authority under the 2005 Act and 2007 Rules.
To the extent we are processing special category data e.g. health information, we also rely on the fact it is necessary for the performance of a task carried out in the substantial public interest and is in the exercise of a function conferred on us under the 2005 Act.
There may be some personal data we collect which may fall outside of the above e.g. responding to queries, enquiries or suggestions about our website etc.
In these cases, we may rely on legitimate interest to process your personal data to the extent it is not caught by our main public interest/official authority lawful basis explained above.
This would be on the basis it is on your and our legitimate interests to process your personal data in order to assist you or respond to you.
5. Who do we share your personal information with?
The Inquiry keeps personal information secure and only shares it with those who need to see it. Those with whom such information is shared are subject to the provisions of the First Order of the Inquiry.
To enable the work of the Inquiry, we may disclose your personal information to the following individuals and/ or organisations for the purposes described above:
• the staff of the Inquiry, including the Chair and Counsel;
• your legal representative;
• the legal representatives of other individuals or organisations listed below;
• independent expert witnesses instructed by the Inquiry;
• the ICR, including the Chair and staff members of the ICR, independent neurosurgical experts instructed by the ICR;
• core participants, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• NHS Tayside and/or other material providers, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• individuals who or organisations which are to provide evidence to the Inquiry in a written statement or as an oral witness and/ or their legal representatives;
• subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• individuals who or organisations which might be or have been the subject of criticism in the proceedings or report(s) of the Inquiry and/ or their legal representatives, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• our solicitors, professional advisers and consultants for advice on matters concerning the Inquiry;
• the public via the Inquiry’s website, YouTube and/or similar video hosting platforms or within the report(s) of the Inquiry, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• the press and other interested parties, subject to redactions being made and otherwise in accordance with the Inquiry’s Protocols and Orders;
• the Auditor of the Court of Session, if you dispute the amount of an award for assistance with the costs of legal representation and a referral to the Auditor is required;
• our service providers with whom we have agreements to provide services and which have been procured and vetted for us by the Scottish Government, including our IT service and document management system providers, for the purposes of storing documents and information, supporting the Inquiry’s systems, enabling publication of Inquiry materials, subject to the instructions of the Inquiry as to what they are permitted to do with the information;
• the Police or other law enforcement agency;
• organisations responsible for the regulation of the health professions, including but not limited to the General Medical Council, the Nursing and Midwifery Council; and
• the Keeper of the Records of Scotland to comply with the provisions of rule 16(3) of the 2007 Rules.
6. Will your personal information be sent outside the UK?
Our IT systems host information in the UK. However, there may be circumstances where we need to contact a party outside of the UK or EEA e.g. an independent expert witness or other party relevant to the work of the Inquiry and if this occurs we will ensure any sharing of personal data is kept to a minimum and any transfer is in line with data protection legislation.
It should also be noted that any information published on our website or YouTube and/or similar video hosting platforms will naturally be accessible outside of the UK.
You can read about YouTube’s handling of personal data YouTube privacy settings to protect your data – how YouTube works
7. How long do we keep your personal information?
We may keep your personal information until the end of the Inquiry or a maximum of 12 months thereafter, at which point, some of the personal data (where it is to form part of the historic record of the Inquiry in accordance with rule 16(3) of the 2007 Rules), some of which may include special category information, will be transferred to the Keeper of the Records of Scotland, where such information will be stored and handled according to data protection law relating to archiving in the public interest.
All other data that is not part of the record will be securely deleted at the end of the Inquiry or otherwise returned to the relevant party.
8. What rights do you have in relation to your personal information that we process?
Under certain circumstances, the law gives you the right to:
• Access a copy of your personal information and to check that we are processing it in accordance with legal rules.
• Correct any inaccurate or complete any incomplete personal information that we process about you.
• Delete your personal information where there are no grounds for us continuing to process it.
• Restrict our processing of your personal information, for example, if you contest the accuracy of your personal information.
• Object to us processing your personal information where we rely on the public task or legitimate interests grounds for data processing.
• Request a copy in structured, commonly used and machine-readable format of any personal information you have provided to us on a consent basis and have this transferred to another organisation.
Witnesses and/ or applicants to the ICR can apply for Anonymity or a Restriction Order in accordance with section 19 of the 2005 Act and the Protocols and Orders published on the Inquiry’s website.
Please contact the Inquiry at the email address above if you wish to make any of the above requests. When you make a request, we may ask you for specific information to help us confirm your identity for security reasons.
Please note these rights are not absolute and we will explain clearly the reasons we cannot comply with a request to exercise these rights where appropriate, in conjunction with our DPO where necessary. You will not be subject to decisions that will have a significant or legal impact on you based solely on automated decision-making.
9. Third party links
The Inquiry’s website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share personal data about you.
We do not control these third party websites and are not responsible for their privacy practices.
When you leave our website, we encourage you to read the privacy policy of every website you visit to understand how they collect, hold and use your personal data.
10. Feedback and complaints
We welcome your feedback on how we process your personal data, and this can be sent to the Inquiry by e-mail at dpo@eljamelinquiry.scot, who will forward it on to our DPO, as necessary.
You have the right to make a complaint to the ICO, the UK regulator for data protection, about how we process your personal data.
The ICO’s contact details are as follows:
Telephone: 0303 123 1113
Website: https://ico.org.uk/concerns/
If you would like to receive this Notice in alternative format, for example, audio, large print or braille, please contact us. You also have the right to seek redress through the Courts.
11. Updates to this Policy
We may update this Policy at any time, and you should check our website occasionally to ensure you are aware of the most recent version.
Last updated: September 2025