Processing of (personal) data by the entity in charge of the online application process
Doughty Street Chambers - Privacy Notice General Data Protection Regulation(“GDPR”) Doughty Street Chambers (“DSC”) is concerned about protecting and respecting your privacy. The purpose of this Notice is to: Reassure you that DSC fully respects your privacy and the information relating to you, otherwise known as your Personal Data, which is provided to us Describe the personal data that DSC collect about you, how it is used and shared, and your rights in relation to it This Notice does not apply to personal data processed or used by individual barristers practising here. Each barrister at DSC has their own Privacy Notice which applies to his or her handling of your personal data. Your barrister’s Privacy Notice is available on request. Who we are? DSC is a set of barristers’ chambers. All barristers practising from this set of chambers are self-employed individuals. Members and employees of DSC are based at 54 Doughty Street, London, WC1N 2LS (and adjacent offices) and can be contacted via the DSC website at doughtystreet.co.uk or by telephone +44 020 7404 1313. A number of individuals who are classed as “door tenants” of DSC also use our clerking and administrative services. Door tenants are not members of DSC but the courtesy of displaying his/her name at the entrance to DSC has been extended to them. DSC is registered with the Information Commissioner’s Office (ICO) as a Data Controller for the Personal Data that it holds and processes and its registration number is Z6873822. What does DSC do with your information? Information collected The vast majority of the information that we hold about you is provided to us by yourself when you seek to use our services or you are employed by us or work with in various capacities. We will tell you why we need the information and how we will use it. Personal data is any information that can be used to identify an individual, and it can range from the most basic of details such as contact information through to more complex data. Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by both the UK - General Data Protection Regulation (the GDPR) and the Data Protection Act 2018. DSC collects, uses and is responsible for personal information about you. When DSC does this it is the ‘controller’ of this information for the purposes of the GDPR and the Data Protection Act 2018. However, not all personal data is considered equal. There are two different categories: 'personal data' and 'special categories of personal data'. We collect and process both personal data and special categories of personal data as defined in the GDPR. This includes: • Personal and family information, including names, dates of birth, and personal contact details; • Financial details such as financial status and bank details; • Records of goods and services relevant to Chambers; • Records of education, training and employment; Sensitive and special data including: • Information about physical and mental health, including any relevant Covid-19 Test and Trace information; • Racial or ethnic origin; • Political opinions; • Religious, philosophical or other beliefs; • Trade union membership; • Sex life or sexual orientation; • Genetic and biometric information of natural persons; • Social service records; and • Other personal information relevant to the provision of legal services, including information relevant to the specific instructions given in a case. If you need to contact DSC about your information or the processing carried out you can use the contact details at the end of this document. How Do DSC Collect Information? In most circumstances you will provide us with personal data when you get in touch with us whether this is to assist your barrister in the provision of legal services or when you are employed by us or are a member of chambers or provide services to us. DSC may also obtain information from third parties, parties involved in legal proceedings, such as witnesses, courts, tribunal. In addition, we may obtain information from other employees, contractors and referees and individual members of chambers. Information may also be supplied by suppliers of goods and services, government departments, and public records including the media. Personal data can also be obtained from CCTV cameras at DSC’s premises. DSC complies with its obligations under the GDPR: • by collecting and retaining only data necessary to pursue Chamber’s legitimate business interests; • by ensuring that appropriate technical measures are in place to protect personal data; • by keeping personal data up to date; • by storing and destroying data securely. How DSC uses your personal information DSC may use your personal information for the following purposes: i. to promote and market the services of the Barristers; ii. Direct your enquiries to the appropriate barrister member; iii. to train barristers; iv. to recruit staff and pupils; v. to assess applications for and provide: tenancy, pupillage, mini-pupillage and work-shadowing opportunities; vi. to fulfil equality and diversity and other regulatory requirements; vii. to procure goods and services; viii. to manage matters relating to employment, including payroll and pensions; ix. to respond to requests for references; x. Communicate with you about services, news, updates and events; xi. to publish legal judgments and decisions of courts and tribunals; xii. to respond to potential complaints or make complaints; xiii. to carry out anti-money laundering and terrorist financing checks; xiv. Investigate or address legal proceedings relating to your use of our services or as otherwise allowed by applicable law; xv. Make statutory returns as required by law; xvi. Maintain the safety, security and integrity of our services xvii. To comply with COVID-19 Test and Trace regulations; xviii. as otherwise required or permitted by law. DSC does not use automated decision-making in the processing of your personal data. The legal basis for processing your personal information DSC relies on the following as the lawful bases to collect and use your personal information: If you have consented to the processing of your personal information, then DSC may process your information for the purposes set out above to the extent to which you have consented to us doing so. At all times you retain the right to withdraw your consent. Where we have relied upon your consent and you opt to withdraw it this does not invalidate our lawful basis for processing data historically. Performance of a contract with the data subject or to take steps to enter into a contract; Compliance with a legal obligation. DSC is required to process information to comply with various legal obligations including record keeping, administration and regulatory activities. As an employer we also have additional employment related legal obligations. We may collect and use your personal information for the purposes of the following legitimate interests of ourselves or a third party. We will rely on the legitimate interest of DSC when processing information for the purposes set out above to include the management, administration and operation of Chambers, for all business development and marketing purposes, to conduct all employment functions and obligations, to comply with all regulatory functions required by professional regulators. Special category processing If we are processing special categories of data such as medical records, we are entitled by law to do so where it is necessary for the purposes of employment law and to support individuals with a particular disability or medical condition. We may also obtain your consent to process this type of data. If we are processing any special category of data such as any Covid-19 related data, including Test and Trace information, we are entitled by law to do where the collecting the data is likely to be in the interests of the individual, the organisation, and the public health, in the efforts to tackle COVID-19. Criminal data processing On occasion, DSC may process data relating to criminal offences where it is necessary for the purpose of, or in connection with, any legal proceedings; obtaining legal advice; or establishing, exercising or defending legal rights. We may also request your specific consent to process this type of data. Marketing and promotion In relation to personal information collected for marketing purposes, the personal information consists of: • names, contact details, and name of organisation; • the nature of your interest in DSC's marketing; • your attendance at DSC events. This will be processed so that you can be provided with information about DSC [and the Barristers/Mediators/Arbitrators] and to invite you to events. You may contact DSC using the contact details at the end of this document if you no longer wish to receive such invitations or information. Whether information has to be provided by you, and why If you apply to DSC for a position or are seeking a reference or are a member of staff your personal information has to be provided to DSC, so that your application/reference can be properly assessed/your employment records, pay and pensions can be administered and to enable DSC to comply with its regulatory obligations, and to keep accounting records. If you are offering or providing DSC with goods or services your information may be processed in relation to such offers or contracts. Who will Chambers share your personal information with? It may be necessary to share your information with the following: i. Delivery partners; ii. Our business partners; iii. Any other party where we ask you and you consent to the sharing; iv. Our legal advisors in the event of a dispute or other legal matter; v. Law enforcement officials, government authorities or other third parties to meet our legal obligations; vi. IT Support services; vii. Professional advisers and consultants engaged in the course of running of Chambers; viii. Regulatory bodies including the Bar Standards Board and the Legal Ombudsman; ix. Recruitment agencies; x. Other barristers chambers; xi. Prosecution authorities; xii. Courts and tribunals; xiii. Members of DSC including Barristers and trainee Barristers; xiv. Advisers and other parties involved in any matter you discuss with us, or engage a member of DSC to act on, such as professional clients, lay clients and professional clients; xv. Next of kin for employees and members; xvi. The intended recipient, where you have asked chambers to provide a reference; xvii. The general public in relation to the publication of legal judgments and decisions of courts and tribunals; and xviii. Any Public Health Authority in relation to any Covid-19 Test and Trace information. Where such sharing takes place, DSC will take all reasonable steps to ensure that your personal data is processed in compliance with the GDPR. A list of third-party and sub- processors may be requested from DSC at any time. DSC may be required to provide your information to regulators, such as the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without DSC’s consent or your consent, which includes privileged information. DSC may also be required to disclose your information to the police or intelligence services, where required or permitted by law. Transfer of your information outside the UK (UK) This privacy notice is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the UK in any particular case or for a reference. However, if you reside outside the UK or your case or the role for which you require a reference involves persons or organisations or courts and tribunals outside the UK then it may be necessary to transfer some of your information to that country outside of the UK for that purpose. If you are in a country outside the UK or if the instructions you provide come from outside the UK then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions. Storage DSC will retain your personal data while you remain a client, member, pupil or employee unless you ask us to delete it. Our Data Retention and Disposal Policy details how long we hold data for and how we dispose of it when it no longer needs to be held. We will delete or anonymise your information at your request unless: 1. There is an unresolved issue, such as claim or dispute; 2. We are legally required to retain the data to meet out legal, statutory and regulatory obligations; 3. There are overriding legitimate business interests, including but not limited to fraud prevention and protecting clients' safety and security. Your personal data is stored on secure servers in the UK. DSC will take reasonable technical and organisational precautions to prevent unauthorised access, disclosure, modification, or unauthorised destruction of your personal data. Consent As explained above, DSC may rely on your explicit consent to process your information including special category personal information. You have the right to withdraw this consent at any time, but this will not affect the lawfulness of any processing activity carried out prior to you withdrawing your consent. However, where DSC also relies on other bases for processing your information, you may not be able to prevent processing of your information. If there is an issue with the processing of your information, please contact DSC using the contact details below. Your Rights Under the GDPR, you have a number of rights that you can exercise in certain circumstances. These are free of charge. In summary, you may have the right to: i. Ask for access to your personal information and other supplementary information; Ask for correction of mistakes in your information or to complete missing information DSC holds on you; ii. Ask for your personal information to be erased;; iii. Receive a copy of the personal information you have provided to DSC or have this information sent to a third party. This will be provided to you or the third party in a structured, commonly used and machine-readable format, e.g. a Word file; iv. Object at any time to processing of your personal information for direct marketing; v. Object in certain other situations to the continued processing of your personal information; vi. Restrict the processing of your personal information in certain circumstances. If you want more information about your rights under the GDPR please see the Guidance from the Information Commissioners Office on Individual's Rights under the GDPR. If you want to exercise any of these rights, please: • Use the contact details at the end of this document; • Provide other information that DSC may need to ask you for so that you can be identified; • Provide a contact address so that you can be contacted to request further information to verify your identity; • Provide proof of your identity and address; • State the right or rights that you wish to exercise. DSC will respond to you within one month from when it receives your request. Marketing Emails Please note that if you wish to unsubscribe from any marketing emails that you have signed up for, you can do so by contacting DSC’s Data Protection Officer whose contact details are set out below. It may take 14 days for this to become effective. How to make a complaint? The GDPR also gives you the right to lodge a complaint with the Information Commissioner’s Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF. Future Processing DSC does not intend to process your personal information except for the reasons stated within this Privacy Notice. If this changes, this Privacy Notice will be amended and the amended notice placed on DSC’s website. Changes to this Privacy Notice This Privacy Notice was published on 25th May 2018 and last updated on the 22 October 2021. DSC continually reviews its privacy practices and may change this policy from time to time. When it does, an amended Privacy Notice will be placed on DSC’s website. Contact Details If you have any questions about this Privacy Notice or the information DSC holds about you, please contact DSC using the contact details below. The best way to contact DSC is to write to Julie Ahadi, Chambers’ DPO, Doughty Street Chambers, 54 Doughty Street, London WC1N 2LS or by email at j.ahadi@doughtystreet.co.uk. Cookies and usage analytics DSC’s website uses cookies to better the user’s experience while visiting the website. A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Where applicable this website uses a cookie control system allowing you, on your first visit to the website, to allow or disallow the use of cookies on your computer/device. This complies with recent legislation requirements for websites to obtain explicit consent from users before leaving behind or reading files such as cookies on a user’s computer/device. Traffic log cookies are used to identify which pages are being used. This helps those responsible for the upkeep and maintenance of the website to analyse personal data about webpage traffic and improve the website in order to tailor it to user needs. This information is only used for statistical analysis purposes and is then removed from the system. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not be able to use the full functionality of this website. By using the website, you consent to the processing of personal data about you in the manner and for the purposes set out above. We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device's IP address (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy by clicking on this link (https://www.hotjar.com/legal/policies/privacy). You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link (https://www.hotjar.com/legal/compliance/opt-out).