Privacy Notice

This privacy notice sets out details about personal information collected, stored and otherwise processed about you. It also tells you who Chambers and counsel share this information with, the security mechanisms in place to protect your information and whom to contact if you need further information.

Devereux Chambers Services Limited is the “Data Controller for the purposes of the GDPR and the Data Protection Act,” responsible for deciding how we hold and use personal information relating to our members and staff, visitors to our website and guests registering for and attending Devereux events.

Individual Members of Chambers are Data Controllers in their own right and are responsible for deciding how data relating to their professional and lay clients is held and used. Contractual agreements are in place between Members of Chambers and Devereux Chambers Services Limited covering the processing of data for which barristers are the Data Controllers.

We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to those who use our services and our website, including professional clients and lay clients of individual members of chambers, guests who register for or attend Devereux events, applicants for employment, tenancy, pupillage, mini-pupillage and work shadowing placements, as well as those visiting Chambers or making enquiries.

This policy is non-contractual, regularly reviewed and may be amended by us from time to time. You should read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

The information is provided in a layered format, please follow the links below for full details.

Contents

1. Purpose for processing, legal basis, data sharing & retention periods
   • Professional clients, lay clients & potential clients
   • Applicants for tenancy, pupillage, mini-pupillage, work shadowing & employment
   • Website users & event attendees
   • Other parties involved in a matter
   • Marketing
   • Visitors & enquiries
2. Consent
3. Data sharing
4. Transferring information outside of the EU
5. Data retention
6. Your rights in connection with personal information
7. Right to withdraw consent
8. Contact details
9. Changes to this privacy notice

Purpose for processing, legal basis, data sharing & retention periods

Professional clients, lay clients & potential clients

The Member of Chambers to whom the enquiry/instructions relate is the Data Controller for information provided in relation to the provision of legal services, whether legal advice, legal proceedings or prospective legal proceedings.

Devereux Chambers is a data processor, on behalf of the barrister only. Data sharing agreements are in place between Devereux Chambers and the Members of Devereux Chambers for this purpose.

Types of data we may process

1. personal details
2. family details
3. lifestyle and social circumstances
4. goods and services
5. financial details
6. education, training & employment details
7. physical or mental health details
8. racial or ethnic origin
9. political opinions
10. religious, philosophical or other beliefs
11. trade union membership
12. sex life or sexual orientation
13. genetic information
14. biometric information for the purpose of uniquely identifying a natural person
15. criminal proceedings, outcomes and sentences, or related security measures
16.  other personal information relevant to instructions to provide legal services, including information specific to the instructions in question.

The same categories of information may also be obtained from third parties, including other legal professionals or experts, members of the public, your family and friends, witnesses, courts and other tribunals, investigators, the police, government departments, regulators, public records and registers.

Personal information may be used for the following purposes:

1. to provide legal services to clients, including the provision of legal advice and representation in courts, tribunals, arbitrations, and mediations
2. to keep accounting records and carry out office administration
3. to take or defend legal or regulatory proceedings or to exercise a lien
4. to respond to potential complaints or make complaints
5. to check for potential conflicts of interest in relation to future potential cases
6. to promote and market their services
7. to carry out anti-money laundering and terrorist financing checks
8. to train other barristers and when providing work-shadowing opportunities
9. to respond to requests for references
10. when procuring goods and services
11. to publish legal judgments and decisions of courts and tribunals
12. as required or permitted by law.

Where counsel has been instructed by you, or on your behalf on a case or we have been asked to provide a reference, your personal information has to be provided to enable the provision of advice or representation, to comply with professional obligations, and to keep accounting records.

Legal basis for processing  

The following lawful bases on which personal information is collected are relied upon:

• If you have consented to the processing of your personal information, then we may process your information for the purposes set out above to the extent to which you have consented.
• As a client, processing is necessary for the performance of a contract for legal services or in order to take steps at your request prior to entering into a contract.
• Your explicit consent is relied upon to process your information in categories (g) to (o) above. You provided this consent when you agreed that counsel would provide legal services.
• In relation to information which is in categories (g) to (o) above (these being categories which are considered to include particularly sensitive information and which include information about criminal convictions or proceedings) we rely on your consent for any processing for the purposes set out in purposes (2), (4), (6), (7) and (9) above. Your consent to carry out processing of this data is required for these purposes. However, if you do not consent to processing for purposes (iv) and (ix) (responding to potential complaints and providing a reference) we will be unable to accept instructions. This is because we require to retain all the material about your case until there is no prospect of a complaint, and to provide a complete and informed reference.
• In relation to information in categories (g) to (o) above (these being categories which are considered to be particularly sensitive information and include information about criminal convictions or proceedings), we are entitled by law to process the information where the processing is necessary for legal proceedings, legal advice, or otherwise for establishing, exercising or defending legal rights.
• In relation to information which is not in categories (g) to (o) above, counsel rely on their legitimate interest and/or the legitimate interests of a third party in carrying out the processing for the Purposes set out above.
• In certain circumstances processing may be necessary in order to comply with a legal obligation (including carrying out anti-money laundering or terrorist financing checks).
• The processing is necessary to publish judgments or other decisions of courts or tribunals.

As a client, some of the information you provide will be protected by legal professional privilege unless and until the information becomes public in the course of any proceedings or otherwise. Barristers have an obligation to keep your information confidential, except where it otherwise becomes public or is disclosed as part of the case or proceedings.

It may be necessary to share your information with the following:

• data processors, such as Chambers staff, IT support staff, email providers, case management software providers and data storage providers
• other legal professionals
• experts and other witnesses
• prosecution authorities
• courts and tribunals
• trainee barristers and those undertaking work shadowing opportunities
• lay clients
• family and associates of the person whose personal information counsel is processing
• in the event of complaints, the Head of Chambers, other members of Chambers who deal with complaints, the Bar Standards Board, and the Legal Ombudsman
• other regulatory authorities
• current, past or prospective employers
• education and examining bodies
• business associates, professional advisers and trade bodies, e.g. the Bar Council
• the intended recipient, where you have asked counsel to provide a reference.
• the general public in relation to the publication of legal judgments and decisions of courts and tribunals

There may be a requirement to provide your information to regulators, including the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without my consent or yours, which includes privileged information.

There may also be a requirement to disclose your information to the police or intelligence services, where required or permitted by law. 

Sources of information

The personal information obtained may include information provided by:

• other legal professionals
• experts and other witnesses
• prosecution authorities
• courts and tribunals
• trainee barristers
• lay clients
• family and associates of the person whose personal information counsel is processing
• in the event of complaints, the Head of Chambers, other members of Chambers who deal with complaints, the Bar Standards Board, and the Legal Ombudsman
• other regulatory authorities
• current, past or prospective employers
• education and examining bodies
• business associates, professional advisers and trade bodies, e.g. the Bar Council
• the intended recipient, where you have asked us to provide a reference.
• the general public in relation to the publication of legal judgments and decisions of courts and tribunals
• data processors, such as Chambers staff, IT support staff, email providers, data storage providers, case management software providers
• public sources, such as the press, public registers and law reports.

How long will we store your personal data?

All of your information will normally be stored:

• until at least 1 year after the expiry of any relevant limitation period (which will usually be 6 years, but may be 12 years, or longer where the case includes information relating to a minor), from the date of the last item of work carried out, the date of the last payment received or the date on which all outstanding payments are written off, whichever is the latest. This is because it may be needed for potential legal proceedings/to respond to a complaint. At this point any further retention will be reviewed and the data will be marked for deletion or marked for retention for a further period. The latter retention period is likely to occur only where the information is needed for legal proceedings, regulatory matters or active complaints. Deletion will be carried out (without further notice to you) as soon as reasonably practicable after the data is marked for deletion.
• some of your information which is need to carry out conflict checks will be stored indefinitely. However, this is likely to be limited to your name and contact details/the name of the case. This will not include any sensitive personal data.
• Information related to anti-money laundering checks will be retained until five years after the completion of the transaction or the end of the business relationship, whichever is the later;
• Names and contact details held for marketing purposes will be stored indefinitely (with consent being reviewed regularly) or until we are informed that the individual has ceased to be a potential client.

Applicants for tenancy, pupillage, mini-pupillage, work shadowing & employment

Types of data we may process

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Education, training and employment details
• Recruitment information (references and other information included in a CV or cover letter or as part of the application process)
• Equal opportunities information.  This is not mandatory and is not made available to anyone outside of the recruitment team (including members of the interview panel and HR) save in an anonymised format so as not to identify you

We may collect your personal details, details of your application and details of your experience and qualifications from the recruitment agency you applied via.

With the exception of the equal opportunities information, you are obliged to provide this personal data to us as it is necessary for us to explore potentially entering into a contract with you.  If you fail to provide it we may be unable to process your application and, if appropriate, offer you employment.  The equal opportunities form is not mandatory and there are no consequences if you fail to provide it.

The purposes of processing

• For recruitment purposes i.e. to ensure you are suitable for the role being advertised and so we can contact you about this role;
• To comply with legal obligations including right to work checks;
• To seek professional advice advice/defend claims arising from the recruitment process;
• In relation to the equal opportunities form, to monitor equality in recruitment practices.

Legal basis for processing 

We process your personal data on the basis of consent and/or because it is necessary for our legitimate interests, namely to ensure that you are qualified and suitable for the role you are applying for and to ensure we have a record of the recruitment process for the defence of legal claims. We process details of your right to work in line with our legal requirements to do so.

Sharing your data

Your data will be shared internally by the management team, the interviewing staff and members of chambers, as appropriate.

Website users & event attendees

Types of data we may process

When you access our website, or respond to an invitation to a Devereux event we may collect the following personal data:

• Data you input into online forms. For example, if you are signing up to legal updates, you will be asked for your name, employer details and email address. 
• If you contact us, we may keep a record of that correspondence.
• We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
• Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access.

We also collect technical data via Google analytics, however, these reports do not contain any personal data.  

Any personal data which is recorded automatically when you access our website (as set out above) is processed to assist us in monitoring and improving content and for security reasons.  You are, therefore, obligated to provide this when accessing the website.  

The purposes of processing

• To register you as a new contact and provide services to you as requested
• To be able to contact you in relation to the service and effectively manage our relationship with you;
• To enable us to ensure efficiency and security of our systems (e.g. prevention of unauthorised access) and make improvements where necessary, including for user experience of the website;
• To make business decisions about the provision of services and our website
• For marketing purposes

Where you have signed up to events or legal updates your data is also processed for marketing purposes (please see marketing below).

Legal basis for processing

We process this data as it is necessary for our legitimate interests, namely to keep records of user experiences, provide the information you have requested, improve our services, ensure our services remain accurate and up to date, study how our website is used and popular content, for marketing strategies/communications and to maintain and grow our business.

We also process data as required by law, including, to comply with legal obligations such as security obligations in data protection legislation (such as prevention of unauthorised access).

We do not rely solely on consent to process your data, however, where you have signed up for services we may also process your data on the basis of your consent.

Sharing your data

Your data will be shared internally with our IT and Marketing departments.  It may also be provided to members of Chambers to the extent necessary for their role and to make decisions about the business, however, this will usually be in an anonymised format (e.g. statistics).

Our website contains links to other web sites and Devereux Chambers is not responsible for the privacy practices or the content of such sites.

Cookies

When you access our website, cookies will be created.

A cookie is a small file which asks permission to be placed on your computer's hard drive.  Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.

We use traffic log cookies to identify which pages are being used.  This helps us analyse data about web page traffic and improve our website in order to tailor it to user needs.  We only use this information for statistical analysis purposes and then remove the data from the system.

Cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not.  A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies.  Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer.  This may prevent you from taking full advantage of the website.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.  By using this website, you consent to the processing of data about you in the manner and for the purposes set out above.

The traffic logging cookies used by this site are part of the Google Analytics system.

Google Analytics uses a number of first-party cookies, all prefixed __utm:

• __utma: contains a unique and anonymous identifying ID, which allows us to ensure that subsequent visits to our website are recorded as belonging to the same (unique) visitor. This cookie expires after two years.
• __utmb: used to establish and continue a unique user session. Each time you request another page from the website the cookie is updated to expire after 30minutes.
• __utmc: works with __utmb to determine when to create a new session for a website visitor. This is a session cookie and expires when you exit the browser.
• __utmz: tracks how you found us and is used to calculate traffic and navigation within the website. It is updated with every new page view and expires after 6 months.
• You may also sometimes find a __utmv cookie which relates to custom reporting segments, a feature which we occasionally use on Google Analytics.

Full details of the cookies which Google Analytics uses can be found in Cookies & Google Analytics in documentation for Google's Analytics tracking code. You can also read Google's Privacy Policy for Google Analytics. To opt out of our use of Google Analytics you may wish to consider using the Google Analytics Opt-out Browser Add-on.

Other parties involved in a matter

The types of data we hold

Other parties to a matter may include legal or lay representatives, other parties to the claim/dispute/advice, judges, judicial staff, ACAS representatives, shareholders, beneficiaries, medical experts, third party witnesses etc.

We may be informed by you or by a third party (including but not limited to a party to a transaction/claim or a court/Tribunal) of your name and contact details if you are involved in a particular matter we are instructed on.

In these instances, the likely data we will hold on you will be your name, the organisation you work for and your contact details.  It may also include information that you have given us or the client and your opinion on matters, for example those captured in pleadings, legal bundles, correspondence and documents relating to the matter we are instructed on, witness statements or medical reports.

You are not obliged by us to provide your personal data, however, you may be subject to regulatory or legal requirements to do so.  Failure to provide us with your personal data may impact the effective management of the matter in question.

The purposes of processing

The personal data is processed to ensure we are able to contact relevant parties on a matter and, in some cases comply with professional requirements (i.e. to speak with legal representatives where we are aware they are instructed).

It may also be processed to provide further information relevant to the matter in question (e.g. witness account of events etc.).   

Legal basis for processing

We process this on the basis of our legitimate interests (to comply with professional requirements).  

We may also process this data on the basis of consent (if you have provided these details to us yourself) and where required by law (e.g. pursuant to a court order). 

Sharing your data

Your data will be shared internally to the extent necessary to make decisions about the business

Marketing

Types of data we hold

We may process your personal data including your name, employer, job title and email address for marketing purposes.

In most cases we will have received this data from you directly when you have signed up for services or events, however, we may also obtain data from publicly available sources (such as your employer’s website). 

You are not obliged to provide this information. However, if you do not do so we may not be able to provide the services requested (for example, to receive legal updates, we would need a valid email address).  

You may opt out of marketing communications by emailing marketing@devchambers.co.uk. Alternatively, each of our marketing communications contain an ‘opt out’ hyperlink so that you can opt out easily at any time.

Purposes for processing

We may process this personal data to send you marketing updates by email (and in some cases by post) such as legal news, new services and event invitations that we believe may be of interest to you or that you have expressly requested.

If you have opted out of marketing updates, we may retain your personal data as a record of those who have opted out to ensure that we do not contact you further for these purposes.

Legal basis for processing

We process this data on the basis of consent and legitimate interests, namely to maintain and grow our business.

Sharing of data

We will always treat your personal data securely and with respect, and do not share this with other organisations save where you have expressly asked us to do so. 

Your personal data is shared internally with Members of Chambers and clerks, and our Marketing and IT teams. 

Where you sign up to attend events ordinarily a badge stating your name, job title and organisation (and/or a sign in sheet stating the same) will be on display at the event which others attending the same event may have sight of.    

Visitors & enquiries

We may process your personal data including your name and contact details where you attend a meeting in Chambers, if you have contacted us (e.g. for information) or where we have obtained your information from a public source or third party and wish to request information.  If we receive any communication from you then we will also process any data contained within your request.

An example may be where you are a prospective employer and contact us for a reference or, similarly, where we seek a reference for someone we intend to employ.  Another example may be where we contact you to see if you would be interested in hosting a joint event or where we seek to use your business service, vice versa, or where you market to us.

This covers a variety of requests and, in most cases, we do not envisage you being obliged to provide your personal data.  If you are requesting information from us, not providing this data may mean we are unable to respond.

Purposes for processing

The purposes of us processing your personal data are:

• to allow us to respond to your request or to seek information
• to allow us to manage health and safety issues and to respond to a security incident or other emergency.

Legal basis for processing

We process this data on the basis of our legitimate interests.  These are likely to include assessing job applicants’ suitability for roles and maintaining and growing our business and network.

Sharing of data

Your data will be shared internally with those parties relevant to the information request.  If your request requires this, it may be shared with other external parties.

Consent

We may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will tell you what information we propose to process and the reason. It is not a condition of your contract with us that you agree to any request for consent from us.

You have the right to withdraw this consent at any time, but this will not affect the lawfulness of any processing activity carried out prior to you withdrawing your consent. However, where other bases for processing your information are relied upon, you may not be able to prevent processing of your data.

Data sharing  

We may have to share your data with third parties, including third-party service providers.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We will not transfer your personal information outside the EU without your explicit consent.

We will not sell your data.

Sharing personal information with third parties

We will share your personal information with third parties where required by law, where it is necessary to administer the contractual relationship with you or where we have another legitimate interest in doing so.

All of our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We may share your personal information with other third parties, for example, with a regulator or otherwise to comply with the law. This may include providing your information to the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without Chambers’ consent or your consent, which includes privileged information.

Chambers may also be required to disclose your information to the police or intelligence services, where required or permitted by law. 

Transferring information outside of the EU

This privacy notice is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the EEA in any particular case or for a reference. However, if you reside outside the EEA or your case or the role for which you require a reference involves persons or organisations or courts and tribunals outside the EEA then it may be necessary to transfer some of your information to that country outside of the EEA for that purpose. If you are in a country outside the EEA or if the instructions you provide come from outside the EEA then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions.

Some countries and organisations outside the EEA have been assessed by the European Commission and their information protection laws and procedures found to show adequate protection. The list can be found here. Most do not. If your information has to be transferred outside the EEA, then it may not have the same protections and you may not have the same rights as you would within the EEA.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention  

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from the Chambers Director.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a member or pupil of chambers we will retain and securely destroy your personal information in accordance with our data retention policy and applicable laws and regulations.

Chambers will normally store your information as follows:

• For at least one year after the expiry of any relevant limitation period. This is because it may be needed for potential legal proceedings or to respond to a complaint. At this point any further retention will be reviewed and the information will be marked for deletion or marked for retention for a further period. The latter retention period is likely to occur only where the information is needed for legal proceedings, regulatory matters or active complaints. Deletion will be carried out as soon as reasonably practicable after the information is marked for deletion.
• Equality and diversity data may be retained in pseudonymised form for the purpose of research and statistics and complying with regulatory obligations in relation to the reporting of equality and diversity data. 
• Personal information held for recruitment purposes or in relation to pupillage or mini-pupillage will be stored for a period of two years from the initial application.

Your rights in connection with personal information

The personal information we hold about you should be accurate and current. Tell us if your relevant personal information changes.

Under certain circumstances you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please notify the Chambers Director in writing at dataprotection@devchambers.co.uk

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent  

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please notify the Chambers Director dataprotection@devchambers.co.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Contact details

If you have any questions about this privacy notice or how we handle your personal information, please contact the Chambers Director dataprotection@devchambers.co.uk.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Changes to this privacy notice

We may update this privacy notice at any time.