Guidance

Best Value Inspection of the West Midlands Fire and Rescue Authority: privacy notice

Published 19 September 2025

Applies to England

1. This notice explains how the Best Value Inspection of the West Midlands Fire and Rescue Authority (“BVI”) collects and uses personal information and informs you of the nature of the personal information that the BVI collects about you and how it is processed in line with the obligations under the UK GDPR and the Data Protection Act 2018.

2. The Lead Inspector of the BVI is Fenella Morris KC and reference to the BVI in this privacy notice includes a reference to the Lead Inspector.

3. 1. The scope of the BVI  can be found in the publicly available letter of appointment of the Lead Inspector and is set out in Annex 2. Relevant legislation and guidance can be found here and here.

4. Fenella Morris KC, as the Lead Inspector of the BVI, is a data controller responsible for the personal information processed for the purposes of the BVI, in accordance with its scope and the relevant legislation and guidance. Fenella Morris KC’s professional address is 39 Essex Chambers, 81 Chancery Lane, London WC2A 1DD.

5. If you have any questions about use of your personal data by the BVI, or want to exercise your rights set out in this Privacy Notice, please send an email to westmidlandsfrabvi@communities.gov.uk

How the BVI collects personal information

6. Most of the personal information which the BVI processes is provided directly by you for one or more of the following reasons:

6.1. You want to give evidence to the BVI;

6.2. You have been asked to provide evidence to the BVI, whether in the form of a written and/or oral statement and/or documents;

6.3. You have provided evidence to the BVI;

6.4. You have contacted the BVI by email, video-link, telephone and/or letter;

6.5. You wish to attend, or have attended, a meeting or interview with Fenella Morris KC or another member of the BVI Team in relation to the BVI;

6.6. You are representing your organisation in relation to the BVI.

7. The BVI may also receive information about you in other ways. For example, as part of its investigation the BVI has access to organisational records from West Midlands Fire Service (WMFS)/West Midlands Fire and Rescue Authority (WMFRA). Other individuals may also include information about you in their evidence to the BVI.

The personal information collected

8. The BVI is collecting personal information solely for the purposes of the inspection. The BVI will also collect and retain contact details. The records that the BVI holds include personal information, which may include sensitive personal information (known as ‘special category data’). Such information may include name, age or date of birth, gender, role, job title, role profile and/or job title, employment status, qualifications, performance and training records, details of experience, disciplinary records, details of complaints, concerns, grievances, exit interviews (including details of outcomes and any action taken or not taken), information about physical or mental health, injuries and/or medical treatment, racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, sex life or sexual orientation, criminal prosecution(s), conviction(s) and/or sentence(s), charges that did not lead to prosecution, actual or alleged criminal offences and/or incident reports that did not lead to charge.

9. The personal data collected by the BVI may relate to current WMFS / WMFRA staff, former WMFS / WMFRA staff, individuals who have made complaints, whistle-blown, submitted exit interviews, or raised grievances to WMFS / WMFRA, individuals who have been the subject of complaints, whistleblowing, exit interviews, or grievances made to WMFS / WMFRA, individuals who have been subject to disciplinary actions or investigations undertaken by WMFS / WMFRA, individuals who have contributed as witnesses or other parties to complaints, whistleblowing, exit interviews, or grievances made to WMFS / WMFRA and individuals who wish to participate in the BVI.

10. When you write to the BVI, the BVI will store your name, e-mail and/or postal address and any other personal information which you choose to provide to the BVI. If you meet in person, or by video-link, or speak on the telephone, the BVI stores and processes any notes and recording of the personal information which you provide to the BVI during the meeting or conversation.

11. The scope of the investigation as set out in the letter of appointment may, from time to time, be updated or amended and the scope of information the BVI will consider may be updated or amended and therefore may require further information to be processed. If so, this privacy notice will apply to any such information and the BVI will update this privacy notice accordingly.

The purposes of processing personal information

12. The BVI processes your personal information solely for the purposes of carrying out the objectives of the BVI, in accordance with its Terms of Reference and the relevant legislation and guidance. The BVI collects it in order to gather information relevant to the BVI. The BVI stores and analyses it in order that the BVI can produce a report, and, thereafter, in order to deal with any issues which might arise as a result of the BVI. Personal information is used by the BVI in a number of ways - for example, to gather evidence, to facilitate access to the BVI, and to communicate with you about the BVI. Your personal information will be used in accordance with the law, including any statutory requirements in connection with the BVI.

Data Sharing and Confidentiality

13. All contributions to the BVI will be treated in accordance with the Confidentiality, Privacy and Privilege Annex to this notice.

14. During the course of the BVI, your information may be shared by the BVI with the following main groups:

14.1. Individuals working on the BVI to include Counsel and civil servants assigned to the BVI;

14.2. Third party data processors (such as providers of IT infrastructure); and

14.3. The public via published reports.

Third Party Data Processing

15. Any information, including Personal Data, provided to the BVI, may be transferred to third-party contractors providing services to it, such as the operation of IT systems used, or to allow the secure storage of information, as well as allowing the BVI to review and analyse information. The contractors will act as data processors acting on behalf, and under the control, of the BVI. Where this is the case, these third-party data processors are subject to stringent contractual obligations in relation to ensuring the security and confidentiality of the information, including Personal Data, they hold on behalf of the BVI. This means that they cannot do anything with that Personal Data unless instructed to do so. These third-party processors cannot share any Personal Data with any organisation apart from the BVI and/or unless instructed to do so, except where required to do so by law or Court order.

Lawful bases for processing

16. For the majority of personal data we process, our legal basis for processing your personal data is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the BVI’s work to fulfil its Terms of Reference.

17. In relation to data protection requests from individuals: the legal basis for processing your personal data is that it is necessary to comply with a legal obligation placed on us as the data controller (Article 6(1)(c) UK GDPR).

18. Sensitive personal data (also known as special category data) is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The legal basis for processing any sensitive personal data, or data about criminal convictions, where we receive it, is that it is necessary for reasons of substantial public interest for the exercise of a function conferred on a person by an enactment, or the exercise of a function of a Minister of the Crown (para 6, schedule 1, Data Protection Act 2018). The function is the BVI’s work to fulfil its Terms of Reference.

Security of personal information

19. Personal information will be stored on the BVI’s own and/or third-party outsourced IT services, cloud-based storage and document storage providers on terms whereby it is security protected and, where held on third party services or storage, where the BVI has an appropriate processing agreement (or similar protections) in place. The arrangements with those third parties do not permit transfer outside of the UK and the EEA. Any hard copy information will be stored in Fenella Morris KC’s room at 39 Essex Chambers, or the rooms of the assistant inspectors (also at 39 Essex Chambers).

20. The BVI is committed to taking all reasonable and appropriate steps to protect the personal information that the BVI collects from you from improper use or disclosure, unauthorised access, unauthorised modification and unlawful destruction or accidental loss. The BVI has taken and shall take appropriate information security, technical, storage and organisational measures to such end, including measures to deal with any suspected data breach. All those third-party outsourced IT services, cloud-based storage and document storage providers who are associated with the processing of your information are obliged to respect the confidentiality of your personal information, as is the independent transcription service.

The period for which personal information will be stored

21. The BVI shall process your personal information throughout the course of the BVI. Thereafter, the BVI shall keep such information for such period as may be permitted or required by law (including data protection law) where the BVI considers it necessary to do so for the purpose of a legitimate interest. No later than 12 months after the BVI is concluded, Fenella Morris KC shall determine whether to retain the personal information for any longer period. The BVI shall consider the volume, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure, the purposes for which the BVI needs to process such information and whether the BVI can achieve them through other means.

22. At the end of such 12 months (or any longer period which the BVI may so determine to be necessary), the BVI shall take all necessary and appropriate steps to destroy your personal information or otherwise put it beyond use.

23. If personal information that you provide to the BVI is only useful for a short period (for example, any temporary contact details or other information which the BVI is able to determine does not need to be kept during the conduct of the BVI) the BVI may delete it before the time periods set out above.

What are your rights?

24. You have the right to request:

24.1. information about how your personal data is processed, and to request a copy of that personal data;

24.2. that any inaccuracies in your personal data are rectified without delay;

24.3. that any incomplete personal data are completed, including by means of a supplementary statement;

24.4. that your personal data are erased if there is no longer a justification for them to be processed.

25. You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

26. You have the right to object to the processing of your personal data.

27. Your rights may be subject to exemptions or limitations. Requests are dealt with on a case-by-case basis. If you wish to exercise any of these rights, please contact Fenella Morris KC. Data protection legislation provides for the circumstances in which she must agree to such requests. If she refuses, she shall explain the legal basis for refusal. She may keep a record of your communications, to help to resolve any issues which you raise.

Your right to lodge a complaint with the supervisory authority

28. If you have a concern about any aspect of these privacy practices, including the way in which your personal information has been handled, you can report it to the UK Information Commissioner’s Office (ICO). You can find details about how to do this on the ICO website at https://ico.org.uk/concerns, or by calling its helpline on 0303 123 1113.

Changes to this Privacy Notice

29. The Terms of Reference may, from time to time, be updated or amended and the scope of information the BVI will consider may be updated or amended and therefore may require further information to be processed. If so, this privacy notice will apply to any such information and Fenella Morris KC will update this privacy notice accordingly.

30. Fenella Morris KC may make changes to this Privacy Notice from time to time. To ensure that you are always aware of how she uses your personal information, she shall update this Privacy Notice where she needs to reflect any changes to the BVI’s use of your personal information. She may also make changes, as required, to comply with changes in applicable law or regulatory requirements. She shall notify you of any such changes by e-mail, or such other means of communication as may be requested by you.

September 2025

Annex 1 - Confidentiality, Privacy and Privilege

1. As the Best Value Inspection is being carried out pursuant to the powers in Part 1 of the Local Government Act 1999, the Lead inspector has powers to ask for information and documents relating to the investigation (see section 11 of the 1999 Act) and those holding information relevant to the investigation have a duty to co-operate.

2. Persons providing information to the Inspector for the purposes of the investigation are encouraged to do so in an open and “on the record” basis. This will help the inspection team to reach fully informed conclusions by enabling them to put information and concerns to other persons for their consideration and comment. Without that openness and transparency, the reliability of the information provided is difficult to assess and the inspection team’s ability to further investigate and consider any concerns raised in the context of the investigation may be hindered.

3. Should a person who wishes to provide information request to speak with the inspection team in confidence, they will proceed on a confidential basis but subject to the following limitations:

a. In the event that civil proceedings concerning any matter that was the subject of the Investigation are raised, the Inspector may be ordered by a court or tribunal to disclose documentation and information in relation to the investigation;

b. In the event that a person discloses information which raises a concern regarding the safety or wellbeing of an individual, the Lead Inspector may decide to disclose this information to the WMFS / WMFRA and/or a regulatory body for the purpose of ensuring health and safety;

c. In the event that a person discloses information which raises a concern regarding a potential criminal offence, the Inspector may decide to report the matter to the WMFS / WMFRA and/or to the police.

4. In the event that information is disclosed to the WMFS / WMFRA, a regulatory body or to the police, the Inspector will use reasonable efforts to avoid disclosing the identity of any person who has requested anonymity but this is not guaranteed. If it becomes necessary to disclose the identity of the person who has provided the information this will be discussed with that person in advance except where there is an immediate risk to health or safety.

5. In the event that a person discloses information which gives rise to a need to launch a disciplinary investigation, or the information is relevant to an ongoing disciplinary process against one or more employees of the WMFS / WMFRA, the Lead Inspector will seek the permission of the person who provided the information to disclose the information and their identity. The information provided will not be used without the person’s permission unless a court or tribunal orders disclosure. Please note that if permission is not given by the provider of the information to use the information and to disclose their identity for the purpose of disciplinary proceedings, it may hinder the ability of the WMFS / WMFRA to take disciplinary action.

Annex 2 – scope of the Best Value Inspection as set out in the letter of appointment

The Inspection will include:

1. All relevant governance concerns that have arisen in relation to the Authority from Autumn 2022 to the present;

2. The Authority’s current compliance with the accountability and assurance requirements under the National Framework;

3. The Authority’s likely future compliance with the accountability and assurance requirements under the National Framework;

4. In considering the Authority’s current and likely future compliance with the requirements of Part 1 of the 1999 Act in relation to its governance functions, the Lead Inspector should have regard to all relevant matters, whenever arising;

5. Compliance with the Seven Principles of Public Life, also known as the Nolan Principles, by elected members and senior officers of the Authority;

6. The Authority’s systems and processes to ensure such transparency of information relating to governance as would reasonably be expected of any public authority;

7. Any decisions taken by the Authority to ensure that a culture of fear – with particular respect to escalating with challenge – does not exist, and, where found to exist, the decisions taken by the Authority to address it. This should include assurances regarding the whistleblowing, grievance and disciplinary processes in place at the Authority and their use;

8. The Authority’s processes and practices for taking action against any member or officer of the Authority who may be found not to have met the standards required of that member or officer. This should include specific focus on bullying, harassment and discrimination;

9. The Authority’s employment decisions, including but not limited to its recruitment and promotion process (including due diligence processes for shortlisted candidates), salaries and expenses of employees. This should include the Authority’s processes and practices for recruitment into senior roles across the Authority and Service, including the issuing of contracts;

10. Any matters relating to procurement activities of both a recruitment and non-recruitment nature.

11. The Authority’s processes and practices for effectively assessing the validity of any complaints made about members of the Authority, including its senior officers. This should include the provision made by the Authority for the appropriate consideration of such complaints.