I propose to take Questions Nos. 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137 and 138 together.
In accordance with section 43 of the Commission of Investigation Act 2004, the Mother and Baby Homes Commission of Investigation was required to deposit with my Department all the evidence received by, and all documents created by or for the Commission, prior to its dissolution on 28 February 2021. In advance of its dissolution, the Commission deposited a very large archive relating to in excess of 100,000 individuals which includes audio recordings and witness statements of individuals who provided evidence and engaged with the different elements of the infrastructure of the Commission including the Confidential Committee and the Investigation Commission.
The report of the Commission at pages 10 and 11 of the Chapter on the Confidential Committee provides statistical information on the engagement of individuals with different elements of the infrastructure of the Commission. The table below includes a summary of the data published in that chapter:-
|
Number of people
|
Detail
|
|
886
|
Who seemed to be within the Commission’s remit, contacted the Commission and were sent information about the Confidential Committee.
|
|
673
|
Completed the application form
|
|
19
|
Gave evidence to the Commission and not to the Confidential Committee
|
|
550
|
Met the Confidential Committee. (Some people who met the Confidential Committee also gave evidence to the Commission.)
|
|
104
|
Completed the application form but did not meet the Confidential Committee
|
|
304
|
Were resident as mothers
|
|
228
|
Were resident as babies/children
|
|
17
|
Were involved in other ways.
|
Unfortunately, the information requested by the Deputy is not immediately available and would require extensive work to extract it from the voluminous records received from the Commission.
The archive now in the possession of my Department is organised by reference to individuals. Seeking to provide the information requested would require the expenditure of a very significant amount of staff time and resources, searching by reference to each individual in the many archive databases, and searching hard copy records.
My Department is focusing at present on putting systems and resources in place to manage the archive, respond to Subject Access Requests (SARs), arrange for the transfer of appropriate content to the National Archives, and meet all the legal obligations and commitments made. The Department is making good progress in this regard, and is very keen to deal with the applications for information from the archive as quickly as possible.
A new Unit has been established to look after this hugely important and significant volume of work. This work has included ensuring that there is a range of expertise including data protection expertise within the Unit. In addition, the Department has engaged external data protection expertise to support the processing of requests from data subjects and to appropriately vindicate the rights of data subjects.
Officials in my Department who process SARs from individuals completed data protection training delivered by external consultants to ensure that they are appropriately equipped to respond to requests in respect of the archive. The training provided by external consultants is supplemented by in-house data protection expertise.
Access to the archive is restricted to officials who need to have access for the purposes of their work. Currently, 27 officials have access to the archive.
As of 30 April last my Department has received and is processing 158 SARs relating to the archive.
Given the sensitive nature of the personal data, my Department must validate the identity of every requester seeking their personal data. My Department engages with data subjects to request proof of identity, in the form of a scanned copy of a passport, driving license, or other photo ID. This is a reasonable measure for a data controller to take, to satisfy itself that the requestor is who they say they are, and that the personal data is being provided to the person it relates to.
My Department is seeking to provide individuals with a copy of their personal data within one month of the identity of the requestor being validated. The General Data Protection Regulation provides that the one month period may be extended by a further two months where necessary, taking into account the complexity of the request. The data controller is obliged to inform the data subject of any such extension within one month of the receipt of the request including the reasons for the delay. In accordance with GDPR requirements, in situations where my Department is unable to provide individuals with the data within this timeframe due to the complexity of the request, my Department informs individuals within one month of receipt of their request, explaining the reason for the delay, and my Department commits to delivery of the data within a further two months. My Department is responding to each data subject in accordance with its GDPR obligations and engages with each data subject in relation to the progress of their request.
