Privacy Policy

Criminal Cases Review Commission


This privacy notice sets out the standards that you can expect from the CCRC when we request or hold personal information (‘personal data’) about you; how you can get access to a copy of your personal data; and what you can do if you think the standards are not being met.

CCRC is the data controller for the personal information we hold. There are many ways you can contact us, including by phone, email and post.

Our postal address:

Criminal Cases Review Commission, 5 St Philip’s Place, Birmingham, B3 2PW

Tel: 0121 233 1473/ 0300 456 2669

This policy is written in accordance with the General Data Protection Regulation and the Data Protection Act 2018. CCRC is registered as a Data Controller with the Information Commissioner's Office under number Z4700510

You can contact our Data Protection Officer at or via our postal address.

Please mark the envelope ‘Data Protection Officer’.

This policy was last updated in February 2020.

About personal information

Personal data is information about you as an individual. It can be your name, address or telephone number. It can also include information about criminal proceedings.

We know how important it is to protect customers’ privacy and to comply with data protection laws. We will safeguard your personal data and will only disclose it where it is lawful to do so, or with your consent.

How we process personal information

We collect and retain personal data that is relevant to applications received by us that we investigate. This is in order to decide whether a case can be referred back to the court of appeal.

We will share this data with third parties where necessary (please see the section “Who the information may be shared with” below).

If you are an applicant, the personal data we collect about you are your full name, date of birth, address details as well as information about your conviction. We also collect some ethnicity information about you where you agree to give this to us as part of the application form. Ethnicity information is not linked to the application and will not be accessible by those dealing with your case. We use ethnicity information only in an anonymised form for statistical purposes in order to monitor how we perform.

We hold information about individuals who were connected to a case, i.e. witnesses or victims in a criminal case that we review. We do not collect or record the personal information about those who are not the applicant in a structured way (for example as part of a database). Information that we hold about witnesses, victims and others involved in a criminal case is generally contained in the records that we obtain from other organisations (for example the police).

The CCRC has legal powers to obtain any material or information we think we need to investigate a case. We often obtain case related information from the police, the courts and other organisations such as the NHS and social services.

Once we have started looking into a case we will decide what material we need. This data is often special category or sensitive data. Under the DPA2018 this is classed as Sensitive Processing. Like the other data we receive from third parties, this data is not held in a structured way (for example as part of a database) and is contained in the records we obtain from third parties (i.e. the NHS) and we meet the requirements for Sensitive Processing.

Purposes of processing and lawful basis of processing

Our purpose is to investigate possible miscarriages of justice in criminal cases according to our duties and powers set out in the Criminal Appeal Act 1995. The legal basis we rely on to process personal data is section 35(2)(b) of the Data Protection Act 2018 (DPA 2018), which allows us to process personal data when the processing is necessary for the performance of a task carried out for that purpose by a competent authority. The DPA 2018 lists the CCRC as a competent authority

Who the information may be shared with

We sometimes need to share the personal information we process with the individuals themselves, including those acting for them (such as a solicitor), and also with other organisations.

Where this is necessary, we will comply with all aspects of the applicable data protection legislation and not disclose any personal information where it would not be lawful to do so.

If you apply to the CCRC, we will use your personal data, including details about your conviction, in order to obtain information from others about the case that you have asked us to look at.

This may be those who have files about you and your case that we need in order to investigate your application. We may also make other enquiries as necessary and this could include checking, for example, matters relating to a previous witness or a victim.

Where this is required, we may therefore use their personal data to make enquiries. We always make sure that any personal data is used in a way that is permitted under the law. If you apply to the CCRC we will use the information you give us to help look into your case.

The organisations and individuals we may share your personal information with include, but are not limited to:

  • Trial courts, including Magistrates’ and Crown Courts
  • Appeal Courts
  • Investigating authorities, such as the police•Prosecuting authorities, such as the Crown Prosecution Service (CPS)
  • Social Services
  • GPs
  • Legal representatives who previously dealt with you.
  • Experts that we instruct to re-test evidence or to provide a fresh opinion about a matter

Retention period for information collected

Once the case has been closed (either referred for appeal, or closed without referral for appeal), the records obtained from other organisations are returned or destroyed after three months. We retain our electronic case file for five years.

Once the five years has elapsed the electronic case file is deleted but a record of the case number and minimal details for archive purposes are retained.

Access to personal information

You can find out what personal data we have about you by making a ‘subject access request’.

Our website has guidance about making a Subject Access Request at

You can make your request verbally or in writing. If you make your request verbally, we recommend that you follow it up in writing so that we can be confident that we provide you with the correct information.

If you have a restriction on your account with us, you may only be able to make your request in writing or via a legal representative.

Because we can only disclose personal information directly about the ‘data subject’, we may also need to confirm your identity.

You can call us or write to us by post or email asking for your personal data.

Criminal Cases Review Commission, 5 St Philip’s Place, Birmingham, B3 2PW

Tel: 0121 233 1473/ 0300 456 2669

There is no charge for subject access requests.

Your other rights

To exercise your other rights please contact the Data Protection Officer at the above postal address or by emailing

The DPA 2018 in part 3, Law Enforcement Processing, sets out the following rights of Data Subjects:

  • Right of access

This is commonly known as subject access request and is the right which allows you access to your personal data and supplementary information however it is subject to certain restrictions.

  • Right to rectification

You are entitled to have your personal data rectified if it is inaccurate or incomplete.

  • Right to erasure or restriction of processing

You have the right to request the deletion or removal of your personal data and/or the right to ‘block’ or restrict the processing of your personal data where there is no compelling reason for its continued processing.

  • Right not to be subject to automated decision-making

Automated decision making is a decision made by automated means without any human involvement. The CCRC does not undertake any automated decision making.

Making a complaint to the CCRC

If you wish to make a complaint about the way your personal data has been handled, please write to:

Data Protection Officer, Criminal Cases Review Commission, 5 St Philip’s Place, Birmingham, B3 2PW

Or email:

Making a complaint to the Information Commissioner

For independent advice about the Data Protection Act 2018, GDPR or to make a complaint about how the CCRC has handled your data you can contact the ICO:

Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Tel: 0303 123 1113