1. This is a privacy notice which explains how, for what purpose and for how long I will process or retain your personal data in accordance with the General Data Protection Regulation (‘GDPR’).
2. The GDPR is an EU Directive which governs how an individual’s personal data is used, and your rights in relation to that data.
3. I have been instructed by you or your litigation friend, through your solicitor or agent or directly via the direct access scheme. Consequently it might be necessary for me to process your personal data in order to provide certain legal services to you.
4. Below are some examples of the services I may provide which may require me to process and retain your personal data:
a) Advising on the merits of a potential claim;
b) Advising on the prospects / risk of litigation;
c) Advising on the value of your claim;
d) Representing you at a court hearing or at trial;
e) Advising generally on legal issues or evidence.
5. Processing means anything done to data such as: recording, organising, adapting, altering, copying, consulting, transmitting, combining, erasing or storing it.
6. The processing for the purposes listed above will take place in accordance with Article 6(1)(b) GDPR. The processing is necessary to perform a contract to which you are a party (Article 6(1)(b) GDPR). To give effect to that contract (i.e. to bring a claim) it is necessary for me to process your personal data for litigation purposes and to comply with my professional duties as a lawyer.
Recipients of your data
7. I may also be required to share your data with others, depending on the nature of your case. This may include:
a) Courts and other tribunals involved in the case;
b) Your solicitors, or agent through whom I have been instructed;
c) Other persons involved in the cases such as witnesses and experts;
d) Solicitors, barristers, or other legal representatives;
e) Ombudsman and regulatory authorities;
f) Education and examining bodies; and
g) Current, past or prospective employers.
Special categories of data
8. In some cases I will have been given your personal data that is within the ‘special categories’ of data described in GDPR Article 9(1). For example, personal data that reveals your race, ethnicity, sexual preferences, political or religious beliefs, trade union membership or health. There are also restrictions for processing information regarding criminal convictions.
9. This type of personal data will only be processed where it is necessary in order to represent you in your legal claim or advise you on the prospects of a legal claim.
10. I will retain your personal data for no longer than is necessary, and where it is possible, I will anonymise your data.
11. How long your personal data is kept will depend on a number of factors. Once the service I am providing comes to an end I will review the retention period. The Bar Code of Conduct requires me to keep records of my cases for at least 6 years once concluded and similarly HM Revenue and Customs requires me to retain records for 6 years.
12. Once your case has concluded and fees have been paid, I shall retain only the personal data necessary for the following purposes:
a) The legal and professional obligation to retain information relating to my cases;
b) For use in the defence of potential complaints, legal proceedings or fee disputes;
c) To check for any potential conflict of interests that may arise in the future when I am instructed on other cases;
d) To refer back to in future cases which raise similar legal, factual, or procedural issues.
13. The processing for the purposes listed in paragraph 12 (b) (c) (d) above, will take place in accordance with Article 6(1)(f) GDPR. That is, for the purposes of legitimate interests that are not outweighed by your interests or fundamental rights and freedoms.
14. The processing for the purposes listed in paragraph 12 (a) above, will take place in accordance with Article 6(1)(c) GDPR. That is, the processing is necessary for me to comply with a legal obligation.
15. Where processing of your personal data was based on your consent you have the right to withdraw that consent at any time. This does not affect the lawfulness of the processing based on consent before its withdrawal.
16. Withdrawal of your consent to process such data will most likely mean that I am no longer able to provide you with the legal services you seek.
17. You may request confirmation that your personal data is being processed by me and details about the personal data, the source, the processing, the purposes of the processing, the recipients and the retention period.
18. You may request a copy of your personal data that is being processed by me. You may also request rectification (i.e. correction) where there are inaccuracies in the personal data.
19. You have the right to object, on grounds relating to your particular situation, at any time, to the processing of your personal data in line with paragraph 12. Should you object, the processing will only continue where there are compelling legitimate grounds for the processing which override your fundamental rights, freedoms and interests.
20. Where the processing or retention of your data is necessary for the establishment, exercise or defence of legal claims, it will not be possible to object.
21. You have the right to request that your personal data is erased where any of the following apply:
a) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) You withdraw your consent where the basis of processing was based on consent and where there is no other ground for the processing;
c) Where your fundamental rights, freedoms and interests override the legitimate interests of processing in paragraph 14;
d) The personal data has been unlawfully processed; or
e) The personal data have to be erased to comply with a legal obligation.
22. You have the right to request that your personal data is restricted from processing, so that it is simply stored, for the following reasons: as an alternative to deletion; so that it can be corrected; for the establishment, exercise or defence of legal claims; to verify if a legitimate ground exists (paragraph 14).
23. Where it is necessary to correct your personal data, or you have requested the restriction or erasure of your personal data, I shall endeavour to contact the recipients of the personal data, unless this involves disproportionate effort.
24. I take appropriate physical and technical measures to safeguard your personal data to prevent it from being accidentally lost, used or accessed in an unauthorised way. The I.T. systems used by me at Clerksroom are ISO27001 compliant.
Complaints or Queries
25. If you have any questions regarding this privacy notice, or how I use your personal data please email me: email@example.com, or my clerks: mail@clerksroom telephone 01823 247 247.
26. I shall aim to respond as soon as possible, and within 30 days.
27. You have the right to complain to the Information Commissioner's Office (ICO) if you believe I have not handled your request in an appropriate manner. For information on contacting the ICO please go to: https://ico.org.uk/global/contact-us/