Privacy Notice for the Independent COVID Review
This Privacy Notice has been created in relation to the information being supplied to the Independent Covid Review (‘the Review’). This notice is in addition to the existing Cabinet Office Privacy Notice and provides specific detail about the Review.
On 16 November 2021, Tynwald unanimously approved that an independent review be commissioned into the Isle of Man Government’s handling of the Coronavirus Pandemic, and conducted by an independent chair.
The Review will cover the period from 1 December 2019 to the 1 April 2022. Kate Brunner KC, a legally qualified person, has been appointed to chair the Review.
The Council of Ministers has given a legal direction to organisations within the Isle of Man Government to provide information and assistance to the Review.
The Covid Review Project Team has been tasked by the Cabinet Office to collect information from those organisations and provide them to the Review. This information will be used by the Chair of the Review and her team to prepare a final report for Tynwald which is due by 31 December 2023.
The Cabinet Office and Chair of the Review have made arrangements to keep information collected safe and secure in an electronic database. The data shared with the Review team will be restricted to what is necessary for the Chair to complete her report.
Personal information will be removed where appropriate and sensitive details such as personal health records (called special category data) will be removed.
The information collected will be kept for one year before it is transferred to the Public Record Office for permanent preservation.
Visit the Independent COVID Review website.
Why we are collecting personal data
The Covid Review Project Team has been tasked with the central collation of relevant documents from across Isle of Man Government Departments and Statutory Boards. Once collated, the project team will redact personal data and special category data from the documents where appropriate, before sharing them with the Chair of the Review.
What law we are using to collect and process personal data
We can only process personal data where the law allows us to. In this case, we are processing personal data because the law requires it and we are processing that personal data as part of carrying out that task in the public interest. The Isle of Man’s data protection laws allow for this.
This lawful basis is set out in Article 6(1)(e) of the General Data Protection Regulation (GDPR)*: ‘Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.
Departments and Statutory Boards are controllers of the data they hold. They are under a legal direction from the Council of Ministers to provide information and assistance to the Review.
The Chief Secretary (now the Chief Executive Officer, Isle of Man Government) has issued a Direction Notice on behalf of the Council of Ministers under the Government Departments Act 1987 section 6(2) and paragraph 12 of Schedule 2 of the Statutory Boards Act 1987.
This Direction Notice instructs Departments and Statutory Boards to supply information, provide assistance, and allow the inspection of documents by the Chair of the Review and her team for the purposes of the Review.
*The Isle of Man’s Data Protection Act 2018 permits the GDPR to be applied to the Island by the Data Protection (Application of the GDPR) Order 2018, which was approved by Tynwald.
How the information will be used
The Cabinet Office Covid Review Project Team will use the data to provide information and assistance to the Review. The Chair of the Review and her team will use the data shared with them for the purposes of conducting the Review. The Chair will prepare a final report for Tynwald, due by 31 December 2023.
What information will be gathered and where from
The Covid Review Project Team will be collecting information from a number of Isle of Man Government Departments, Boards and Offices. The type of data collected will depend on the authority it is collected from. There will be a wide range of personal data collected, but the Review does not wish to see special category data (this is sensitive data such as a health record).
The Cabinet Office and the Review Team have agreed that the information to be shared should be restricted to what is relevant for the purposes of the Review.
Working protocols will be in place to ensure that there is a clear process for redacting special category data and personal data, and the outcome of discussions about whether personal data is retained will be recorded.
For further information specific to each Department or Board in scope of the Review, please refer to the privacy notices of the applicable authority, as listed below.
- Department of Health and Social Care Privacy Notice
- Department of Infrastructure Privacy Notice
- Department of Home Affairs Privacy Notice
- Department of Environment, Food and Agriculture Privacy Notice
- Manx Care Privacy Notice
- Manx Utilities Privacy Notice
- Isle of Man Post Office Privacy Notice
- Department of Education Sport and Culture Privacy Notice
- Treasury Privacy Notice
- Financial Services Authority Privacy Notice
- Clerk of Tynwald’s Office Privacy Notice
- Department for Enterprise Privacy Notice
- Attorney General’s Chambers Privacy Notice
- Cabinet Office Privacy Notice
How we will keep your personal information secure
Information is currently held on Isle of Man Government servers. As part of the Review, an Electronic Document and Records Management System (EDRMS) has been procured to collate and share information with the Review. Appropriate controls and safeguards are in-place for the use of the EDRMS and the servers on which it operates are based within the EU.
There are two separate parts to the EDRMS; one side accessed by the Isle of Man Government to import and organise the documents and one side accessible only by the Review.
To ask if we hold personal information about you
You can ask to see what information we hold about you by submitting a ‘Subject Access Request’ to the Cabinet Office Data Protection Officer.
You can review your personal information and ensure it is accurate
Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.
Alternatively you can ask for the information we hold about you to be changed by making a request to the Cabinet Office Data Protection Officer.
To remove your personal information
In certain circumstances you can ask for your information to be deleted. Please note that as part of the Isle of Man Government statutory functions some information may need to be retained.
You can request this by contacting the Cabinet Office Data Protection Officer.
Questions or comments about the Privacy Notice
If you have any questions or comments on this Privacy Notice please contact the
Covid Review Project Team via the Cabinet Office Data Protection Officer:
Email address: DPO-CabOff@gov.im
Telephone: +44 1624 686779
DPO, Cabinet Office
Isle of Man
The Isle of Man Information Commissioner is the independent supervisory body responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation.
You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with Manx Data Protection Legislation.
The Information Commissioner can be contacted at:
Phone: +44 1624 693260
First floor, Prospect House
Isle of Man
A contact form is available on the Information Commissioner’s website.
How long we will keep the information for
The Cabinet Office will retain the data collated for one year after the completion of the Review. It will then be transferred to the Isle of Man Public Record Office for permanent preservation as part of the national archives collections, as required under section 3 of the Public Records Act 1999.
The Chair of the Independent Review has put in place data protection measures and a privacy notice to cover the team’s processing of personal data. Further information can be found on the Independent Review website.