1. This is a privacy notice that describes how, why and for how long I will use your personal data in accordance with the UK GDPR, as defined by section 3(10) as supplemented by section 205(4) of the Data Protection Act 2018 (as amended)(‘DPA 2018’), the DPA 2018 and the General Data Protection Regulation 2016 (‘GDPR’).
  2. I, Melissa Stock, have been instructed by you either directly, or through your solicitor or agent, or via a not-for-profit organisation. 
  3. The UK GDPR/GDPR and DPA 2018 govern how personal data is used, and your rights in relation to that data. For the purposes of the UK GDPR/GDPR and the DPA 2018, I am the ‘Data Controller’. This means that I make decisions in how I use your personal data and I am responsible for keeping it safe. This policy explains how I use your personal data, when I share your personal data, how long I keep your data, and your rights.
  4. Other than my clients, I may also hold personal data about you if you are: another party, a solicitor, a barrister, a witness (expert or otherwise), a member of the judiciary, a court staff member, or an individual ancillary to actual or potential proceedings in which I am instructed.
  5. It is necessary for me to ‘process’ your personal data in order for me to provide you, or another, with legal services, for example to:
    • Advise on the prospects of litigation;
    • Advise on the value of your claim;
    • Provide representation in court; 
    • Advise, review or comment on legal issues or evidence.
  6. ‘Processing’ means anything done to data such as: recording, organising, adapting, altering, copying, consulting, transmitting (for example emailing), combining, erasing or storing it.

    7. Special Categories of Personal Data

  7. In some cases I will have been given your personal data that is within the ‘special categories’ of data. For example, personal data that reveals your race, ethnicity, sexual preferences, political or religious beliefs, trade union membership or health. There are also restrictions for processing information regarding criminal convictions.
  8. This type of personal data will only be processed by me where it is necessary to establish, exercise or defend legal claims, or where you have given your explicit consent. 

    9. THE LAWFUL BASIS FOR PROCESSING YOUR DATA

  9. The processing for the purposes listed above will take place in accordance with either Article 6(1)(b) UK GDPR/GDPR (‘contract’) or Article 6(1)(a) UK GDPR/GDPR (‘consent’), depending on how you instructed me, or under Article 6(1)(f) UK GDPR/GDPR (‘legitimate interest’). I may also need to process your personal data under Article 6(1)(c) UK GDPR/GDPR to comply with the law (‘legal obligation’).

    10. Contract

  10. If you have instructed me on a direct access basis to assist you in bringing or defending a claim, or provide legal advice, then the processing is necessary to perform a contract to which you are a party. To give effect to that contract it is necessary for me to process your personal data.

    11. Consent

  11. If I am assisting you on a pro bono basis, it will be necessary for me to seek your consent to be able to represent you. In this scenario, I will send you a consent form.

    12. Legitimate interest

  12. There will be circumstances where it is necessary for me to process personal data on the basis of a legitimate interest. These are:
    • For my legitimate business purposes as a barrister in order to provide legal services to you as my client;
    • For my legitimate business purposes as a barrister in order to provide legal services to my client, where your personal data has been provided to me, or on whose behalf I have collected your personal data;
    • Where it is necessary to deal with complaints or potential legal or regulatory action;
    • For administrative purposes such as accounting, fee collection and network security;
    • To provide training to others in the legal profession if the information is already in the public domain, (or if you have provided me with your consent).

    13. Legal Obligation

  13. I may also be required to retain your personal data to comply with my professional requirements, such as for HM Revenue and Customs (‘HMRC’), the Bar Council and Bar Mutual Insurance and other regulatory bodies or authorities.

    14. SHARING YOUR PERSONAL DATA

  14. Some of the information you provide me will be protected by legal professional privilege and I am obliged to keep such information confidential, unless or until the information becomes public during the course of legal proceedings, or otherwise. 
  15. Nevertheless, I may be required to share your data with others, depending on the nature of the legal services that I am providing. This may include:
    • Courts and other tribunals;
    • Your solicitors, or agent representing you, through whom I have been instructed;
    • Potential witnesses, experts and other persons involved in the case;
    • Solicitors, barristers, or other legal representatives;
    • IT professionals;
    • Ombudsman and regulatory authorities;
    • Other Third Parties, if I am legally obliged.
  16. I may also be required to share descriptions of my cases, which may contain some of your personal data, to education and examining bodies, and current, past or prospective employers.
  17. Other than those listed above, I will not share your personal data unless I have your consent. I do not give your personal data to other companies for the purposes of direct marketing, advertising or the like.

    18. THE TRANSFER OF YOUR PERSONAL DATA OUTSIDE EUROPE

  18. I am based in the United Kingdom but it may at times be necessary for me to transfer your personal data outside of the European Economic Area (‘EEA’), for example to store information on a secure server. Any transfers will be conducted via established privacy-safe mechanisms: to a country given an ‘Adequacy’ decision by the European Commission, or under standard contractual clauses.
  19. If you have instructed me from outside of the EEA it will be necessary to correspond with you, which will mean that I may be transferring personal data back to the source of the instruction. It may also be necessary for me to transfer your data outside of the EEA depending upon the nature of the case, such as where individuals, experts, organisations or tribunals involved are located outside the EEA.
  20. In these circumstances I shall discuss with you the data transfer mechanism that shall be used depending upon your location and the nature of the legal services that I shall be providing.

    21. RETENTION OF YOUR PERSONAL DATA

  21. I will keep your personal data for no longer than is necessary, and where it is possible, I will anonymise or pseudonymise your data (i.e. keep it in a form that does not identify you). 
  22. How long your personal data is kept will depend on a number of factors. The retention period will be reviewed when the service I am providing you with is complete. I am obliged by the Bar Code of Conduct to retain records of my cases, and by HMRC to retain records for 7 years.
  23. Once your case has concluded and fees have been paid, I shall retain only the personal data necessary for the following purposes: 
    • The legal and professional obligation to retain information relating to my cases (for HMRC, professional insurance, etc);
    • To check for any potential conflict of interests that may arise in the future when I am instructed on other cases;
    • For use in the defence of potential complaints, legal proceedings or fee disputes;
    • To refer back to in future cases which raise similar legal, factual, or procedural issues.
  24. I do not retain trial or hearing bundles in paper form; electronic bundles will be kept for 7 years.

    25. YOUR DATA RIGHTS

    Withdrawing Consent

  25. Where processing of your personal data was based on your consent you have the right to withdraw that consent at any time. This does not affect the lawfulness of the processing based on consent before its withdrawal.
  26. Withdrawal of your consent to process such data will most likely mean that I am no longer able to provide you with the legal services you seek.

    27. Right of Access

  27. You may request confirmation that your personal data is being processed by me and details about the personal data, the source, the processing, the purposes of the processing, the recipients and the retention period.
  28. You may request a copy of your personal data that is being processed by me. You may also request rectification (i.e. correction) where there are inaccuracies in the personal data.

    29. Right to object

  29. You have the right to object, on grounds relating to your particular situation, at any time, to the processing of your personal data. Should you object, the processing will only continue where there are compelling legitimate grounds for the processing which override your fundamental rights, freedoms and interests. 
  30. Where the processing or retention of your data is necessary for the establishment, exercise or defence of legal claims, it will not be possible to object. 

    31. Right to erasure

  31. You have the right to request that your personal data is erased where any of the following apply:
    • The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
    • You withdraw your consent where the basis of processing was based on consent and where there is no other ground for the processing;
    • Where your fundamental rights, freedoms and interests override the legitimate interests of processing your personal data;
    • The personal data has been unlawfully processed; or
    • The personal data have to be erased to comply with a legal obligation.

    32. Right to restriction

  32. You have the right to request that your personal data is restricted from processing, so that it is simply stored, for the following reasons: as an alternative to deletion; so that it can be corrected; for the establishment, exercise or defence of legal claims; to verify if a legitimate ground exists.
  33. Where it is necessary to correct your personal data, or you have requested the restriction or erasure of your personal data, I shall endeavour to contact the recipients of the personal data, unless this involves disproportionate effort. 

    34. SECURITY

  34. I take appropriate physical and technical procedures to safeguard your personal data to prevent it from being accidentally lost, used or accessed in an unauthorised way. All devices that I use for professional purposes are password protected, encrypted, apply current updated software and are kept in physically secure environments. 

    35. Complaints or Queries

  35. If you have any questions regarding this privacy notice, or how I use your personal data please email me at clerks@millenniumchambers.com. It will be necessary to verify your identity with the provision of a copy of your passport, and a recent utility bill.
  36. I shall aim to respond as soon as possible, and within 30 days.
  37. You have the right to complain to the Information Commissioner’s Office (‘ICO’) if you believe I have not handled your request in an appropriate manner. For information on contacting the ICO please go to: https://ico.org.uk/global/contact-us/
  38. This privacy policy may be updated from time to time. Where significant changes are made, you shall be informed via email. Subject access requests will be dealt with in accordance with the Subject Access Request Policy of Millennium Chambers.

If you have any legal problems in your life…We are here to Help

INSTRUCT A BARRISTER