I am registered with the Information Commissioner’s Office (ICO) as a Data Controller for the personal data that I hold and process as a barrister for the purposes of the General Data Protection Regulation, the Data Protection Act 2018 and regulations made pursuant to it (“data protection law”). My registered address is 4 New Square, Lincoln’s Inn, London WC2A 3RJ and my registration number is Z9417835.
4 New Square
All barristers at 4 New Square are independent practitioners who share the costs of administration and accommodation, but not income, profit or liabilities for the work they do. Each is a separate data controller and is personally responsible for complying with data protection law.
The administration of our practices is carried out by 4 New Square Limited. 4 New Square Limited is also a data controller and is responsible for its own compliance with data protection law. 4 New Square Limited does not provide legal advice or services.
Personal data means any information relating to an identified or identifiable natural person. It includes, but is not limited to, names, addresses, email addresses, phone numbers and other information (“personal data”).
Under data protection law certain types of personal data are categorised as “Special Categories of Personal Data”. This is data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation (“special category data”).
Data protection law also makes special provision for data relating to criminal convictions and offences (“criminal convictions and offences data”).
All personal data collected about you will be recorded, used and protected by me in accordance with data protection law. I process personal data for one or more of the following purposes:
- to enable me and/or my clerks to respond to enquiries as to possible instructions and to agree the terms upon which I am to be instructed;
- to enable me to provide, and/or you or third parties to obtain, legal services, advice and representation;
- to enable me to determine disputes referred to me as an arbitrator or expert;
- to enable me to act as mediator in resolving disputes;
- to comply with regulatory and legal obligations including, but not limited to, obligations under the Bar Standards Handbook, the Proceeds of Crime Act 2002, the Terrorism Act 2006 and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 or under any similar or equivalent legislation that may be in force from time to time;
- for conflict-checking;
- for keeping anti-money laundering records;
- for record keeping and accounting purposes;
- to assist in training pupils and mini-pupils, work experience students and other persons shadowing me or attending my chambers on educational visits;
- to obtain professional indemnity insurance and to comply with my obligations under contracts of professional indemnity insurance;
- for marketing purposes (this will usually be personal data which is in the public domain);
- to maintain client relationships;
- to administer my professional practice;
- for completing my financial accounts and tax returns;
- to investigate and address any concerns you may have;
- to ensure network and information security;
- to prevent fraud;
- for use in relation to actual or potential complaints, legal proceedings or fee disputes; and
- as otherwise required or permitted by law.
Where you and I have a contractual agreement that provides that personal data must be provided, you are obliged to provide the personal data and failure to do so will result in me being unable to provide legal services, advice or representation.
Lawful Basis for Processing
The lawful basis or bases upon which your personal data will be processed will include one or more of the following lawful bases:
- your consent where freely given;
- performance of a contract, including undertaking my instructions in a given matter;
- to comply with a legal obligation;
- to protect the vital interests of you or of another person;
- to perform a task carried out in the public interest or in the exercise of official authority vested in me; and/or
- for the legitimate interests of you (as data subject), me (as data controller) or a third party, except where such interests are overridden by the interests, rights or freedoms of you as the data subject; the legitimate interests include the purposes set out at paragraph 8 above.
The lawful basis or bases upon which I process your special category data is one or more of the following lawful bases:
- your consent where freely given;
- the processing relates to special category data which you manifestly make public;
- the processing is necessary for the purpose of establishing, exercising or defending legal rights.
The lawful basis or bases upon which I process criminal conviction and offence data is that the processing:
- is necessary for, or in connection with, any legal proceedings (including prospective legal proceedings);
- is necessary for the purposes of obtaining legal advice; or
- is otherwise necessary for the purpose of establishing, exercising or defending legal rights.
I do not use automated decision-making in the processing of your personal data.
Types of Personal Data
Recipients of personal data
I may share your personal data with:
- courts and other tribunals including arbitral tribunals;
- barristers, solicitors and other legal professionals;
- other parties in the matter to which my instructions relate;
- lay and professional clients;
- third party funders and prospective third party funders;
- witnesses and potential witnesses, including expert witnesses;
- co-arbitrators, the Tribunal Secretary and the appointing/administering arbitral institution (when acting as an arbitrator with co-arbitrators and/or with a Tribunal Secretary and/or when there is an appointing/administering arbitral institution);
- 4 New Square Limited, clerks, chambers’ staff and administrators, and members of chambers serving on committees or otherwise participating in the management of chambers;
- pupils, mini-pupils, work experience students and other persons shadowing me or attending my chambers on educational visits;
- external service providers;
- IT support staff;
- in the event of complaints, the head of chambers and members of chambers and staff who deal with complaints or assist in the process of dealing with complaints;
- my regulatory or legal advisors in the event of a dispute or other legal matter;
- ombudsmen and regulatory authorities (including, but not limited to the Legal Ombudsman, the Bar Standards Board, the Financial Conduct Authority and the Information Commissioner’s Office) (it is possible that such ombudsmen and/or regulatory authorities will lawfully disclose your personal data without your or my agreement);
- current, past or prospective employers;
- education and examining bodies;
- professional advisers, including accountant, and trade bodies;
- professional indemnity insurers;
- the general public in relation to the publication of legal judgments and other decisions of courts and tribunals; and
- third parties:
- where I ask you and you consent to the sharing;
- if carrying out a legal or regulatory duty;
- if it is necessary to do so to enforce contractual rights;
- to lawfully assist the police or security services with the prevention and detection of crime or terrorist activity;
- where such disclosure is necessary to protect the safety or security of any persons; and/or
- otherwise as permitted under applicable law.
Transfers to third countries and international organisations
I transfer personal data to countries worldwide, including countries which have no adequacy decision of the EU Commission (“third countries”). This policy is of general application and so I cannot state whether it will be necessary to transfer personal data to a third country or not in particular cases. There are a variety of circumstances in which I will do so. For example, in some cases I may transfer personal data to a third country when communicating with a client, professional adviser or witness (including expert witness) who is located in a third country. Or I may do so when I need to work on a case while in a third country. Or when I take a mobile device (such as a mobile phone, tablet or and laptop) to a third country. Or if the matter on which I am instructed involves courts or tribunals in third countries. Transfers of personal data to third countries may be made:
- for the purpose of performing the contract with my client and/or the contract concluded in your interests;
- because the transfer is necessary for the establishment, exercise or defence of legal claims;
- to protect the vital interests of you or a third party; and/or
- by publication of a judgment of a court or decision of a tribunal on my chambers’ website so that personal data in that judgment or decision is available in third countries.
Any mobile device that I use, such as a mobile phone, tablet and laptop, is password or pattern protected and, where possible, encrypted to protect all content, including any personal data as well as confidential and privileged information. If I work on a laptop which cannot be encrypted, I will save work on a password protected memory stick.
In relation to personal data which I process when providing legal services as a barrister my normal retention period is 20 years from the date on which I receive final payment in relation to a particular set of instructions (or, if there are two or more related sets of instructions, the date when I receive the last payment in relation to any of those related set of instructions), after which, if personal data held by me has not been destroyed or properly disposed of at an earlier date, I shall review the personal data I hold. I retain your personal data while you remain a client unless you ask me to delete it. I will delete or anonymise your information at your request unless:
- there is or may be an unresolved issue, such as a claim or dispute;
- I am legally required not to do so; or
- there are overriding legitimate business interests, including but not limited to fraud prevention and protecting clients’ safety and security.
For the avoidance of doubt my data retention policy is not a term of any contract with you or any other person.
The reasons for the period of 20 years are:
- the date of the last payment of fees is readily ascertainable;
- under section 14A of the Limitation Act 1980 claims by clients or others could be made directly against me for up to 15 years after the work was done and/or loss was allegedly suffered as a result of my work;
- claims could be made by way of contribution under the Civil Liability (Contribution) Act 1978 up to 2 years after judgment or settlement of a claim against someone else and so beyond the 15 year period in section 14A of the Limitation Act 1980;
- complaints to the Bar Standards Board are subject to a tie limit, but that can be waived; the BSB is consulting on removing any time limit, meaning that a complaint could potentially be made at any time;
- I have a legitimate interest in being able to defend claims;
- with the passage of time my need to rely on records which include personal data will increase.
The normal retention period is subject to extension when, at the expiry of that period, a claim has been made or threatened against me, in which case I will retain data relating to such claim until it is resolved or abandoned (including any appeal).
In relation to personal data which I process when acting as arbitrator or in relation to my appointment or potential appointment as arbitrator, my normal retention periods are:
- 6 years for personal data which I need to retain for the purposes of accounting records and/or tax returns;
- otherwise 1 year after the final award and/or the final determination of any appeal or other legal proceedings in relation to the arbitration and/or the settlement of the dispute which forms the subject of the arbitration.
The reasons for these periods are (i) the need to maintain accounting records and/or tax returns and (ii) to enable me to respond to any questions or claims in relation to the arbitration.
In relation to personal data which I process when acting as mediator or in relation to my appointment or potential appointment as mediator, my normal retention periods are:
- 6 years for personal data which I need to retain for the purposes of accounting records and/or tax returns;
- otherwise 1 year after the mediation or final session of the mediation.
The reasons for these periods are (i) the need to maintain accounting records and/or tax returns and (ii) to enable me to respond to any questions or claims about the mediation
The normal retention periods set out above are subject to the following exceptions:
- I may retain records of a client’s name and that of other parties involved in an instruction or arbitration or mediation with a short description of the nature of the instruction or arbitration or mediation in order to check for conflicts of interests until I retire from practice as a lawyer or from any form of judicial appointment (including part time appointments) or appointment as an arbitrator;
- personal data which I am required to obtain for the purposes of data protection law and/or in order to show compliance with data protection law, which I will retain as long as necessary;
- where I am required by any legislation to retain personal data, I will do so for the period or periods required by such legislation;
- personal data contained in records relating to any complaint will be retained for a period of 6 years from the determination of the complaint or such other period as is specified in the Bar Standards Board Handbook (or equivalent document from time to time).
The General Data Protection Regulation gives you specific rights regarding your personal data. For example, you have to be informed about the information I hold and what I use it for, you can ask for a copy of the personal information I hold about you, you can ask me to correct any inaccuracies with the personal data I hold, you can ask me to stop sending you direct mail, or emails, or in some circumstances ask us to stop processing your details. Finally, if I do something irregular or improper with your personal data you can seek compensation for any distress you are caused or loss you have incurred. You can find out more information from the ICO’s website http://ico.org.uk/for_the_public/personal_information and this is the organisation that you can complain to if you are unhappy with how I dealt with you.
In particular, you may have the right to make a request to:
- access to your personal data;
- correct or update your personal data;
- restrict the processing of your personal data; or
- object to the processing of your personal data.
If you provide consent for me to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal. This will also not affect the lawfulness of the continued processing of your personal data under another applicable lawful basis listed under the heading “Lawful Basis for Processing” above
The rights referred to in this section are potentially subject to legislative exemptions, including in particular:
- exemptions set out in paragraph 5 of Schedule 2 to the Data Protection Act 2018 which provides that certain provisions in the GDPR do not apply where:
- disclosure is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent me from making the disclosure;
- disclosure is necessary:
- for, or in connection with, any legal proceedings (including prospective legal proceedings);
- for the purposes of obtaining legal advice; or
- otherwise for the purpose of establishing, exercising or defending legal rights
to the extent that the application of those provisions would prevent me from making the disclosure;
- exemptions set out in paragraph 19 of Schedule 2 to the Data Protection Act 2018 which provides that certain provisions in the GDPR do not apply to personal data that consists of:
- information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings; or
- information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
- improve your experience of using the website;
- improve the range of services; and/or
- recognise and count the number of visitors and to see how visitors move around our website when they are using it.