Privacy Notice

No.15 CHAMBERS

August 2018

This notice explains how members of No 15 Chambers (“Barristers”, “we”, “us”) process your personal data and contains information about some of your rights in relation to your personal data.

Most commonly, we process personal data in order to provide legal services. However, we may also process personal data for other purposes which are explained in more detail in this notice. The personal data we collect and process will vary depending on the reason we have contact with you and the means of communication.

The personal data we process about you can include sensitive personal data such as information about religion, sex, ethnicity, health and criminal convictions. This type of data is described in legal terms as “special categories of personal data”.

If you provide personal data to us concerning a third party, you may be responsible for providing the third party with certain information about us. in many cases it is not reasonably practicable for us to provide the third party directly with the information set out in this notice. Where appropriate, you should provide this information to any such person.

We may change this privacy notice from time to time and the most up to date version will always be on our website.

Please contact us if you require further information about how we collect and use your personal data.

WHO WE ARE

No15 Chambers is the trading name of Howard Lewis-Nunn who is an independent self-employed barrister.

In the vast majority of cases where Howard Lewis-Nunn is instructed to provide legal services he will be the data controller. Howard Lewis-Nunn is registered with the Information Commissioner as a data controller.

CONTACTING US

If you wish to contact Howard Lewis-Nunn regarding this privacy notice, data protection or you wish to exercise any data protection rights you can contact him:

By email admin@No15law.co.uk

By telephone 07889 693145

MAKING A COMPLAINT

If you have a complaint relating to data protection and No15 Chambers we would like the opportunity to address it. Please contact us as above.

You have the right to complain to the Information Commissioner’s Office at any time if you think we may be in breach of relevant data protection legislation.

THE INFORMATION WE COLLECT

The table below sets out some types of personal data we collect.

CATEGORY OF INFORMATION

Lay client/Instructing solicitor identity details

Lay client/Instructing solicitor contact details

Identification documents

Billing details

Case type

Case name/ Other party identity details

Case details (information concerning individuals and organisations connected to or involved with a particular case)

Technical and security information

EXAMPLES

Names; name of organisation, business, firm, date of birth, job title

Telephone, e mail, postal address

Passport, driving licence, identity card

Bank details

Employment, partnerships, contractual, data protection

Names, names of organisation or business, case number

Date of birth, gender, sex life, ethnicity, disability, entitlement to benefits, copies of passport, driving licence, utility bills, bank statements and similar documents, bank details, immigration status and work permits, information about criminal convictions, alleged criminal behaviour or sentences, trade union membership, other personal information contained in correspondence and documents which may be provided to us concerning parties involved with or connected to the case.

IP addresses

SOURCES OF INFORMATION

In addition to personal information provided by a data subject, we may also collect personal information from:

· Instructing Solicitors or other professional organisations

· Persons involved in a particular case such as potential witnesses or experts

· Parties to litigation and their representatives

· Courts, tribunals, arbitrators and mediators

· Publicly available sources including social media.

DO YOU NEED TO PROVIDE PERSONAL DATA? WHAT HAPPENS IF YOU DO NOT?

You do not have to provide us with personal data. However, if you do not we may not be able to provide legal services to you.

WHY WE PROCESS PERSONAL DATA AND THE LEGAL BASES FOR PROCESSING

Most commonly we process personal data in order to provide legal services. However, we may process personal data for other compatible purposes. Where we rely on consent as a legal basis for processing you have the right to withdraw consent at any time.

Purpose of processing

Deciding if we can accept instructions.

Legal basis for processing Personal data (article 6(1) GDPR)

Special category data (article 9(2) GDPR)

Criminal conviction data (schedule 1 DP Act 2018)

When you contact us about a case we need to check we are able to act. We need to consider details about the case to check it is within our expertise, to confirm availability and that we are able to be instructed by you.

(a) The data subject has given explicit consent to the processing;

(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(d) Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party.

(a) The data subject has given explicit consent to the processing;

(e) Processing relates to personal data which are manifestly made public by the data subject;

(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever the courts are acting in their judicial capacity;

(g) Processing is necessary for reasons of substantial public interest.

Consent

Legal Claims

Judicial Act

Personal data in the public domain

Regulatory requirements relating to unlawful acts and dishonesty etc.

Providing Legal Services

In order to provide legal services we need to consider information about the case in order to provide advice and advocacy. We may need to assess documents and information in order to understand if they are relevant or not. We may need to meet with experts, witnesses and other professional advisers in order to understand the impact they may have on the case.

(a) The data subject has given explicit consent to the processing of those personal data for one of more specified purposes, except where the law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(d) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

(a) The data subject has given explicit consent to the processing;

(a) Processing relates to personal data which are manifestly made public by the data subject;

(b) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

Processing is necessary for reasons of substantial public interest.

Consent

Legal Claims

Judicial Act

Personal data in the public domain

Regulatory requirements relating to unlawful acts and dishonesty etc.

Billing

In order to charge for our services we need to process information about the case so that we can raise fee notes and send them to the relevant people. If you delay in paying us we may need to take legal action.

(a) Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;

(b) Processing is necessary for compliance with a legal obligation to which the controller is subject;

(a) Processing relates to personal data which are manifestly made public by the data subject;

(b) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Consent

Legal Claims

Judicial Act

Personal data in the public domain

Regulatory requirements relating to unlawful acts and dishonesty etc.

Internal administration

In order to manage our practice we need to understand the type of work we have done in the past and predict the work likely to be available to us in the future. We also need to do the following:-

to keep records of payments made and expenses incurred;

to consider the distribution of work;

to ensure the security of our premises, property and information systems which may include monitoring communications.

We may also contact you to provide updates about our terms, contact details or working practices. This is to ensure you understand how we work.

(d) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

Processing is necessary for reasons of substantial public interest.

Legal Claims

Judicial Act

Personal data in the public domain

Regulatory requirements relating to unlawful acts and dishonesty etc.

Complaints handling and defending ourselves against legal claims

We need to keep records in order to protect ourselves against allegations that we have acted improperly

(d) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

(g) Processing is necessary for reasons of substantial public interest.

Consent

Legal Claims

Judicial Act

Personal data in the public domain

Regulatory requirements relating to unlawful acts and dishonesty etc

Marketing and business development

You can find out more in the marketing and business development section below

(a) The data subject has given explicit consent to the processing;

(d) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

(a) The data subject has given explicit consent to the processing;

N/A

HOW WE SHARE PERSONAL DATA

Information provided by our clients will largely be protected by legal professional privilege and/or we will be obliged to keep it confidential.

We may share personal data with the following categories of third parties where it shall be protected by a duty of confidentiality:

Third party processors such as document production services, IT suppliers, storage providers
Insurers, accountants, brokers or advisers, auditors, lawyers or risk managers instructed by us or on our behalf
Regulators and ombudsman
Current, past or prospective employers

We may also share personal data with the following categories of third parties in accordance with our instructions:

Persons connected with our lay client or persons whom we are instructed to represent such as experts, legal professionals, professional advisers, witnesses (including potential witnesses), friends and family
Courts, tribunals, mediators and arbitrators
Other parties and their representatives

In accordance with our professional obligations (as set out in the Bar Standards Board Handbook) we may also share personal data:

Where we are legally or professionally required to do so (e.g. with intelligence agencies, law enforcement agencies, regulators, courts or tribunals)
If it is necessary to do so to enforce our contractual rights

We may also share publicly available personal data for business development and marketing purposes.

TRANSFERRING PERSONAL DATA OUTSIDE OF THE EEA

Unless we are communicating with a data subject based outside of the EEA we rarely transfer personal data outside of the EEA.

Where we do transfer personal data outside of the EEA and where there is no adequacy decision by the European Commission in respect of that country we will put in place appropriate measures to ensure that your personal data is treated by those third parties in a way which is consistent with and respects the EU and UK laws on data protection. This may include encryption and binding contractual arrangements.

RETAINING PERSONAL DATA

We will retain personal data only for as long as is necessary. The retention period will vary depending on the type of data and purpose for which it was collected and processed. Further details of our data retention policy can be obtained from contacting Howard Lewis-Nunn as set out above.

DATA PROCESSED OTHER THAN FOR MARKETING PURPOSES

Personal data will be retained in our main database for a year after full payment has been made on the case or matter. After this period it will be archived and processing restricted to what is necessary and permitted for legal, regulatory, fraud and legitimate business purposes, including conflict checking. When your data is no longer needed for these purposes it will be securely destroyed.

DATA PROCESSED FOR MARKETING PURPOSES

Data processed for marketing purposes will not be kept for longer than is necessary. In deciding how long we need to retain your data we will consider the nature of our contact with you, the length of our relationship with you and your role and organisation. You can always opt out of marketing communications by contacting us.

MARKETING AND BUSINESS DEVELOPMENT

We may use contact details provided to us in the course of providing legal services to contact you directly. We may:

Send you articles, newsletters, notices, announcements and other communications concerning us or legal developments which we believe may be of interest to you
Invite you to seminars, events or other functions we believe may be of interest to you
For business development and market research purposes

You can always opt out of receiving direct marketing-related email communications or text messages by following the unsubscribe link.

YOUR RIGHTS

Under data protection laws you have certain rights in relation to your personal data. These rights are subject to the conditions and restrictions set out in the General Data Protection Regulation and the Data Protection Act 2018.

There is no fee to access your personal data or to exercise any other rights, but we may charge a reasonable fee if your request is repetitive, excessive or clearly unfounded. Alternatively, we may refuse to comply with your request in these circumstances.

If you wish to exercise any of the rights set out in this privacy notice, please contact us.

We may need to request specific information from you to help us to confirm your identity and ensure your right to access your personal data (or to exercise any of your rights). This is to ensure that your personal data is not disclosed to anyone who does not have the right to receive it.

We may also contact you to ask for further information in relation to your request to speed up our response.

Further information regarding your rights under the GDPR and the Data Protection Act 2018 can be found by visiting www.ico.org.uk

THE RIGHT OF ACCESS TO YOUR PERSONAL DATA

You have the right to receive confirmation as to whether or not personal data about you are being processed and, where that is the case, access to that personal data and certain information including:

The purpose of the processing
The categories of personal data concerned
The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
Where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period
Where the personal data were not collected from you any available information as to their source
The existence of automated decision-making, including profiling and meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

This right is subject to certain exemptions and it may not be available in all cases.

THE RIGHT TO RECTIFY YOUR PERSONAL DATA

You have the right to rectification of inaccurate personal data concerning you without undue delay. This includes the right to have incomplete personal data completed.

THE RIGHT TO ERASURE OF YOUR PERSONAL DATA

You may have the right to require us to erase our personal data without undue delay if:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
You withdraw your consent (if given) and there is no other legal ground for the processing
You object to further processing and there are no overriding legitimate grounds for the processing
The personal data have been unlawfully processed
The personal data have to be erased to comply with a legal obligation to which we are subject

THE RIGHT TO OBJECT TO PROCESSING OF YOUR PERSONAL DATA

You have the right to object to the processing of your personal data and, if you do, we may be prevented from further processing your personal data unless certain conditions are met. This may affect our ability to continue to provide legal services to you.

THE RIGHT TO RESTRICT PROCESSING OF YOUR PERSONAL DATA

In certain circumstances you may have the right to restrict further processing of your personal data and, if you do, we may only further process your personal data for storage, with your consent, for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or a Member State.

THE RIGHT TO DATA PORTABILITY

Where you have provided personal data to us and where that information is processed by automated means pursuant to a contract, you may have the right to have that information provided to you in a machine-readable format. This is so that you are able to re-use your personal data across different services.