Privacy Notice for the Independent COVID Review

The Covid Review Project Team has been tasked with the central collation of relevant documents from across Isle of Man Government Departments and Statutory Boards. Once collated, the project team will redact personal data and special category data from the documents where appropriate, before sharing them with the Chair of the Review.

We can only process personal data where the law allows us to.  In this case, we are processing personal data because the law requires it and we are processing that personal data as part of carrying out that task in the public interest. The Isle of Man’s data protection laws allow for this.

This lawful basis is set out in Article 6(1)(e) of the General Data Protection Regulation (GDPR)*: ‘Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

Departments and Statutory Boards are controllers of the data they hold. They are under a legal direction from the Council of Ministers to provide information and assistance to the Review. 

The Chief Secretary (now the Chief Executive Officer, Isle of Man Government) has issued a Direction Notice on behalf of the Council of Ministers under the Government Departments Act 1987 section 6(2) and paragraph 12 of Schedule 2 of the Statutory Boards Act 1987.  

This Direction Notice instructs Departments and Statutory Boards to supply information, provide assistance, and allow the inspection of documents by the Chair of the Review and her team for the purposes of the Review.

The Cabinet Office Covid Review Project Team will use the data to provide information and assistance to the Review. The Chair of the Review and her team will use the data shared with them for the purposes of conducting the Review. The Chair will prepare a final report for Tynwald, due by 31 December 2023.

The Covid Review Project Team will be collecting information from a number of Isle of Man Government Departments, Boards and Offices. The type of data collected will depend on the authority it is collected from. There will be a wide range of personal data collected, but the Review does not wish to see special category data (this is sensitive data such as a health record). 

The Cabinet Office and the Review Team have agreed that the information to be shared should be restricted to what is relevant for the purposes of the Review.

Working protocols will be in place to ensure that there is a clear process for redacting special category data and personal data, and the outcome of discussions about whether personal data is retained will be recorded.

For further information specific to each Department or Board in scope of the Review, please refer to the privacy notices of the applicable authority, as listed below.

• Department of Health and Social Care Privacy Notice
• Department of Infrastructure Privacy Notice
• Department of Home Affairs Privacy Notice
• Department of Environment, Food and Agriculture Privacy Notice
• Manx Care Privacy Notice
• Manx Utilities Privacy Notice
• Isle of Man Post Office Privacy Notice
• Department of Education Sport and Culture Privacy Notice
• Treasury Privacy Notice
• Financial Services Authority Privacy Notice
• Clerk of Tynwald’s Office Privacy Notice
• Department for Enterprise Privacy Notice
• Attorney General’s Chambers Privacy Notice
• Cabinet Office Privacy Notice
  
  

Information is currently held on Isle of Man Government servers. As part of the Review, an Electronic Document and Records Management System (EDRMS) has been procured to collate and share information with the Review. Appropriate controls and safeguards are in-place for the use of the EDRMS and the servers on which it operates are based within the EU.

There are two separate parts to the EDRMS; one side accessed by the Isle of Man Government to import and organise the documents and one side accessible only by the Review.

To ask if we hold personal information about you

You can ask to see what information we hold about you by submitting a ‘Subject Access Request’ to the Cabinet Office Data Protection Officer.

You can review your personal information and ensure it is accurate

Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.

Alternatively you can ask for the information we hold about you to be changed by making a request to the Cabinet Office Data Protection Officer.

To remove your personal information

In certain circumstances you can ask for your information to be deleted. Please note that as part of the Isle of Man Government statutory functions some information may need to be retained.

You can request this by contacting the Cabinet Office Data Protection Officer.

Questions or comments about the Privacy Notice

If you have any questions or comments on this Privacy Notice please contact the
Covid Review Project Team via the Cabinet Office Data Protection Officer:

Email address: DPO-CabOff@gov.im

Telephone: +44 1624 686779

DPO, Cabinet Office
Government Office
Buck's Road
Douglas
Isle of Man
IM1 3PN

The Isle of Man Information Commissioner is the independent supervisory body responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with Manx Data Protection Legislation.

The Information Commissioner can be contacted at:

Emai: ask@inforights.im

Phone: +44 1624 693260

First floor, Prospect House
Prospect Hill
Douglas
Isle of Man
IM1 1ET

A contact form is available on the Information Commissioner’s website.

The Cabinet Office will retain the data collated for one year after the completion of the Review. It will then be transferred to the Isle of Man Public Record Office for permanent preservation as part of the national archives collections, as required under section 3 of the Public Records Act 1999.

The Chair of the Independent Review has put in place data protection measures and a privacy notice to cover the team’s processing of personal data. Further information can be found on the Independent Review website.