Privacy Notice - General Data Protection Regulation (“GDPR”)

Please read the following information carefully. This privacy notice contains information about the information collected, stored and otherwise processed about you and the reasons for the processing. It also tells you who I share this information with, the security mechanisms I have put in place to protect your data and how to contact me in the event you need further information.

Who am I?

I am STEPHEN RYAN. I collect, use and am responsible for personal information about you. When I do this I am the ‘controller’ of this information for the purposes of the GDPR and the Data Protection Act 2018.

If you need to contact me about your data or the processing carried out you can use the contact details at the end of this document.

What do I do with your information?

Information collected

When carrying out the provision of legal services or providing a reference I collect some or all of the following personal information that you provide:

  1. personal details
  2. family details
  3. lifestyle and social circumstances
  4. goods and services
  5. financial details
  6. education, training and employment details 
  7. physical or mental health details
  8. racial or ethnic origin
  9. political opinions
  10. religious, philosophical or other beliefs 
  11. trade union membership
  12. sex life or sexual orientation
  13. genetic data
  14. biometric data for the purpose of uniquely identifying a natural person 
  15. criminal proceedings, outcomes and sentences, and related security measures
  16. other personal data relevant to instructions to provide legal services, including data specific to the instructions in question.

Information collected from other sources.

The same categories of information may also be obtained from third parties, such as other legal professionals or experts, members of the public, your family and friends, witnesses, courts and other tribunals, investigators, government departments, regulators, public records and registers.

How I use your personal information: Purposes

I may use your personal information for the following purposes:

  1. to provide legal services to my clients, including the provision of legal advice and representation in courts, tribunals, arbitrations, and mediations 
  2. to keep accounting records and carry out office administration
  3. to take or defend legal or regulatory proceedings or to exercise a lien 
  4. to respond to potential complaints or make complaints 
  5. to check for potential conflicts of interest in relation to future potential cases 
  6. to promote and market my services 
  7. to carry out anti-money laundering and terrorist financing checks
  8. to train other barristers and when providing work-shadowing opportunities
  9. to respond to requests for references
  10. when procuring goods and services
  11. as required or permitted by law.

Whether information has to be provided by you, and why

If I have been instructed by you or on your behalf on a case or if you have asked for a reference, your personal information has to be provided, to enable me to provide you with advice or representation or the reference, and to enable me to comply with my professional obligations, and to keep accounting records.

The legal basis for processing your personal information

I rely on the following as the lawful bases on which I collect and use your personal information:

Who will I share your personal information with?

If you are a client, some of the information you provide will be protected by legal professional privilege unless and until the information becomes public in the course of any proceedings or otherwise. As a barrister I have an obligation to keep your information confidential, except where it otherwise becomes public or is disclosed as part of the case or proceedings, or otherwise compelled by law.

It may be necessary to share your information with the following:

I may be required to provide your information to regulators, such as the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without my consent or yours, which includes privileged information.

I may also be required to disclose your information to the police or intelligence services, where required or permitted by law.

Sources of information

The personal information I obtain may include information which has been obtained from:

Transfer of your information outside the European Economic Area (EEA)

This privacy notice is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the EEA in any particular case or for a reference. However, if you reside outside the EEA or your case or the role for which you require a reference involves persons or organisations or courts and tribunals outside the EEA then it may be necessary to transfer some of your data to that country outside of the EEA for that purpose. If you are in a country outside the EEA or if the instructions you provide come from outside the EEA then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions.

Some countries and organisations outside the EEA have been assessed by the European Commission and their data protection laws and procedures found to show adequate protection. Most do not. If your information has to be transferred outside the EEA, then it may not have the same protections and you may not have the same rights as you would within the EEA.

I may transfer your personal information to the following which are located outside the European Economic Area (EEA):

If I decide to publish a judgment or other decision of a Court or Tribunal containing your information then this will be published to the world.

I will not otherwise transfer personal information outside the EEA except as necessary for providing legal services or for any legal proceedings.

If you would like any further information please use the contact details at the end of this document.

How long will I store your personal information?

I will retain limited personal data indefinitely for the purposes of carrying out conflict checks. This data will be limited to names and addresses.

Subject to that stated immediately above, I will retain personal data (whichever is the latest):

  1. so long as any sum due to ME in respect of the services provided by me (“the Services”) remains unpaid; AND
  2. during the period of 15 years and 4 months after which: – 
    1. I provided the last of any of the Services; OR
    2. any litigation in relation to which the Services were provided by me was finally compromised; OR
    3. any litigation in relation to which the Services were provided by me was finally determined; AND
    4. no complaint has been received in relation to the provision of the Services.

I retain data whilst fees remain unpaid for the purposes of collecting those fees. The period of 15 years and 4 months reflects (a) the overriding limitation period pursuant to s.14B of the Limitation Act 1980 and (b) the period for service of a Claim Form pursuant to the Civil Procedure Rules.

At this point any further retention will be reviewed and the information will be marked for deletion or marked for retention for a further period.

Equality and diversity data may be retained indefinitely in pseudonymised form for the purpose of research and statistics and complying with regulatory obligations in relation to the reporting of equality and diversity data.

Names and contact details held for marketing purposes will be stored indefinitely or until Chambers becomes aware or is informed that the individual has ceased to be a potential client.

Personal information held for recruitment purposes or in relation to pupillage or mini-pupillage will be stored for 6 years and 4 months after the end of your pupillage or minipupillage or the date of any reference (which ever is the latest) for the purposes of research and statistics and complying with regulatory obligations in relation to the reporting of equality and diversity data and for legal purposes. The period of 6 years and 4 months reflects (a) the limitation period pursuant to the Limitation Act 1980 and (b) the period for service of a Claim Form pursuant to the Civil Procedure Rules.

Deletion will be carried out as soon as reasonably practicable after the information is marked for deletion.

Consent

As explained above, I am relying on your explicit consent to process your information in categories (g) to (o) above. You provided this consent when you agreed that I would provide legal services/you asked me to provide a reference.

You have the right to withdraw this consent at any time, but this will not affect the lawfulness of any processing activity I have carried out prior to you withdrawing your consent. However, where I also rely on other bases for processing your information, you may not be able to prevent processing of your data. For example, if you have asked me to work for you and I have spent time on your case, you may owe me money which I will be entitled to claim.

If there is an issue with the processing of your information, please contact my clerks using the contact details below.

Your rights

Under the GDPR, you have a number of rights that you can exercise in certain circumstances. These are free of charge. In summary, you may have the right to:

If you want more information about your rights under the GDPR please see the Guidance from the Information Commissioners Office on Individual’s rights under the GDPR.

If you want to exercise any of these rights, please:

I will respond to you within one month from when I receive your request.

How to make a complaint?

The GDPR also gives you the right to lodge a complaint with the Information Commissioners’ Office if you are in the UK, or with the supervisory authority of the Member State where you work, normally live or where the alleged infringement of data protection laws occurred. The Information Commissioner’s Office can be contacted at http://ico.org.uk/concerns/.

Future processing

I do not intend to process your personal information except for the reasons stated within this privacy notice. If this changes, this privacy notice will be amended and placed on my Chambers’ website.

Changes to this privacy notice

This privacy notice was published on 26 September 2022 and last updated on 26 September 2022.

I continually review my privacy practices and may change this policy from time to time. When I do it will be placed on the website

Contact details

If you have any questions about this privacy notice or the information I hold about you, please contact my clerks