Privacy notice: Edward Cumming QC

General Information Protection Regulation (“GDPR”)

Privacy Notice of Edward Cumming QC

  1. Please read the following information carefully. This privacy notice contains information about the information which may be collected, stored, and otherwise processed about you and the reasons for the processing. It also tells you with whom I may share this information, the security mechanisms that I have put in place to protect your data, and how you may contact me in the event you need further information. You should read this privacy notice in conjunction with my Chambers’ privacy notice which you will find at xxiv.co.uk/privacy/

Who Am I?

  1. I Edward Cumming QC collect, use, retain, and process personal data which may include personal information about you. When I do this I am the ‘controller’ of this information for the purposes of the GDPR and the Data Protection Act 2018. I process personal information about my lay and professional clients, about witnesses and experts, and anyone else for the purposes of actual or potential legal proceedings or the provision of legal advice.
  2. If you need to contact me about your information or the processing carried out please use the contact details at the end of this document.

What do I do with your information?

Information collected

  1. When providing legal services or when providing a reference I may collect, store, use, retain, or process some or all of the following personal information that you might provide to me, namely:
  • personal details including name, address, telephone numbers and email addresses;
  • family details;
  • lifestyle and social circumstances;
  • goods and services;
  • financial details;
  • education, training and employment details;
  • physical or mental health details;
  • racial or ethnic origin;
  • religious, philosophical or other beliefs;
  • political opinions;
  • sex life or sexual orientation;
  • criminal proceedings, outcomes and sentences, or related security measures;
  • other personal information relevant to instructions to provide legal services, including information specific to the instructions in question;
  • your communications with me including communications by email, WhatsApp, Twitter, post, fax or any other form of communication.

Paragraphs g,h,i,j,k, and l are classified as sensitive information.

Information collected from other sources

  1. The same categories of information may also be obtained or collected from third parties, such as other legal professionals, experts, members of the public, your family and friends, witnesses, courts and other tribunals, investigators, government departments, regulators, public records and registers.

How I may use your personal information: purposes

  1. I may use your personal information for the following purposes:
    • to provide legal services to my clients including but not limited to providing legal advice and representation in courts, tribunal, arbitrations and mediations;
    • to comply with any legal or professional obligation including my professional obligations contained in the Bar Handbook;
    • to carry out my obligations under any contract to provide legal services;
    • to check for potential conflicts of interest in relation to future potential cases;
    • to respond to potential or actual complaints or to make complaints;
    • to take or defend legal, arbitral or regulatory proceedings;
    • to correspond with you;
    • to notify you of any changes to my services;
    • to keep accounting and business records and carry out office administration;
    • to train pupil barristers or other barristers;
    • to recruit staff and pupil barristers;
    • to assess applications for tenancy, pupillage, mini-pupillage and work-shadowing opportunities
    • to promote and market my services;
    • to make any professional application such as for tenancy, appointment as Queen’s Counsel or Senior Counsel or Treasury Counsel, or appointment as a judge;
    • to make an application for appointment to any professional panel;
    • to make, or respond to, requests for references;
    • to publish legal judgments or decisions or courts and tribunals;
    • to write legal articles, commentaries or case summaries;
    • to fulfil equality and diversity and other regulatory requirements;
    • to carry out anti-money laundering and terrorist financing checks;
    • as otherwise required or permitted by law.

Whether information has to be provided by you, and why

  1. If I have been instructed by you or on your behalf on a case or matter, or if you have asked for a reference, or made an enquiry about my services as a barrister, your personal information has to be provided in order to enable me to provide you with a fee estimate, client care letter, legal advice or representation or a reference, and to enable me to comply with (a) my professional obligations as a barrister; (b) any duties that I may have to any court or tribunal involved or connected with you case or matter; (c) to keep my accounting and business records; (d) to fulfil my business record keeping obligations to Her Majesty’s Revenue and Customs; and (e) to enable me to carry out the purposes set out above.

The legal basis for processing your personal information

  1. I rely on the following as the lawful bases to collect and process your personal information:
    • If you have consented to the processing of your personal information, then I may process your information for the purposes set out above to the extent to which you have consented to me doing so. However I may still process your personal data without your consent if:
      • processing is necessary for the performance of a contract entered into between you and me or to take steps to enter into a contract;
      • processing is necessary for compliance with a legal obligation;
      • processing is necessary to protect your vital interests or those of another person;
      • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in me;
      • processing is necessary for the purposes of legitimate interests pursued by me or a third party, except where such interests are overridden by your interests, rights or freedoms;
    • If you are a client, processing is necessary for the performance of a contract for legal services or in order to take steps at your request prior to entering into a contract;
    • In relation to information of the type mentioned in Paragraphs 4 (g) to (l) above (these being categories which are considered to be particularly sensitive information and include information about criminal convictions or proceedings), I am entitled by law to process the information where the processing is necessary for legal proceedings, legal advice, or otherwise for establishing, exercising or defending legal rights.
    • In relation to information of the type mentioned in Paragraph 4 (g) to (l) above (these being categories which are considered to include particularly sensitive information and which include information about criminal convictions or proceedings) I may rely on your consent for any processing for the purposes set out in Paragraph 6(e), (i), (j), (m) and (p) above. I may need your consent to carry out processing of this data for these purposes. However, if you do not consent to processing for the purposes Paragraphs 6(e) or 6(p) (responding to potential complaints and providing a reference) I will be unable to take your case or to provide a reference. This is because I need to be able to retain all the material about your case until there is no prospect of a complaint and to provide an informed and complete reference.
    • In relation to information which is not of the type mentioned in Paragraph 4 (g) to (l) above, I rely on my legitimate interest and/or the legitimate interests of a third party in carrying out the processing for the Purposes set out above and the grounds in Article 6 of the GDPR where processing can take place without your consent.
    • The processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on me or you.
    • In certain circumstances processing may be necessary in order that I can comply with a legal obligation to which I am subject (including carrying out anti-money laundering or terrorist financing checks).
    • The processing is necessary to publish judgments or other decisions of courts or tribunals.
  1. If you withdraw your consent, as stated above, I may still process your data if that processing falls into one or more of the above categories set out above. If you object to processing performed under Article 6(1)(e) or 6(1)(f) of GDPR, I will stop processing your personal data unless I:
    • demonstrate a compelling legitimate ground for processing the personal data that overrides the data subject’s interests; or
    • need to process the personal data to establish, exercise, or defend legal claims.
  2. I may need to share the personal information I process with the persons or organisations listed below. If you are a client, some of the information you provide in confidence will be protected by legal professional privilege or a duty of confidentiality unless and until the information becomes public in the course of any proceedings or otherwise loses its confidentiality. As a barrister I have an obligation to keep your information confidential, except where the information otherwise becomes or is public or is disclosed as part of the case or proceedings.

Who will I share your personal information with?

  1. It may be necessary to share your information with the following:
    • legal professionals;
    • experts and other witnesses;
    • prosecution authorities;
    • courts and tribunals;
    • Chambers’ staff;
    • pupil barristers;
    • lay and professional clients of members of Chambers;
    • family and associates of the person whose personal information I am processing;
    • in the event of complaints, the Head of Chambers and members of Chambers who deal with complaints, the Bar Standards Board and the Legal Ombudsman;
    • other regulatory authorities;
    • current, past or prospective employers or employees;
    • education and examining bodies;
    • business associates, professional advisers and trade bodies, e.g. the Bar Council;
    • the intended recipient, where you have asked me to provide a reference;
    • the general public in relation to the publication of legal judgments and decisions of courts and tribunals;
    • information processors, such as my Chambers’ staff, IT support staff, email providers, information storage providers including the providers of cloud computing services;
    • in the case of recruitment of barristers to or from other chambers, your current, past and prospective chambers;
    • police or intelligence services, where required or permitted by law.
  2. I may also be required to provide your information to regulators, such as the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without my consent or your consent, which includes privileged information.

Sources of information

  1. The personal information I obtain may include information obtained from:
    • legal professionals;
    • experts and other witnesses;
    • prosecution authorities;
    • courts and tribunals;
    • Chambers’ staff;
    • pupil barristers;
    • lay and professional clients of members of Chambers;
    • family and associates of the person whose personal information I am processing;
    • in the event of complaints, the Head of Chambers, other members of Chambers who deal with complaints, the Bar Standards Board, and the Legal Ombudsman;
    • other regulatory authorities;
    • current, past or prospective employers or employees;
    • education and examining bodies;
    • business associates, professional advisers and trade bodies, e.g. the Bar Council;
    • the intended recipient, where you have asked me to provide a reference;
    • the general public in relation to the publication of legal judgments and decisions of courts and tribunals;
    • data processors, such as IT support staff, email providers, data storage providers;
    • in the case of recruitment of barristers to or from other chambers, your current, past and prospective chambers;
    • public sources, such as the press, public registers and law reports
    • cloud data storage services based in the USA who have agreed to comply with the EU-U.S. Privacy Shield, in order to enable me to store your information and/or backup copies of your information so that I may access or process your information when I need to;
    • cloud data storage services based in Switzerland, in order to enable me to store your information and/or backup copies of your information so that I may access or process your information when I need to.

Transfer of your information outside the European Economic Area (EEA)

  1. This privacy notice is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the EEA in any particular case or for a reference. However, if you reside outside the EEA or your case or the role for which you require a reference involves persons or organisations or courts and tribunals outside the EEA then it may be necessary to transfer some of your information to that country outside of the EEA for that purpose. If you are in a country outside the EEA or if the instructions you provide come from outside the EEA then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions.
  2. Some countries and organisations outside the EEA have been assessed by the European Commission and their information protection laws and procedures found to show adequate protection. The list can be found here. Most do not. If your information has to be transferred outside the EEA, then it may not have the same protections and you may not have the same rights as you would within the EEA.
  3. If I decide to publish a judgment or other decision of a Court or Tribunal containing your information then it may be published to the world.
  4. I will not transfer personal information outside the EEA, except with your consent or as necessary for the conduct, exercise or defence of any legal proceedings, or the giving or receiving of legal advice.

How long will I store your personal information?

  1. I will normally store all your information:
    • until at least 1 year after the expiry of any applicable limitation period (which could be a foreign limitation period), from the date of the last item of work was carried out, the date of the last payment received or the date on which all outstanding payments are written off, whichever is the latest. This is because the information may be needed for potential legal proceedings or to deal with any compliant or potential complaint or to comply with any professional obligation that I have under the Bar Standards Board Handbook;
    • after this point, any further retention will be reviewed and the information will either be marked for deletion, destruction or retention for a further period. The latter retention period is likely to occur only where the information is needed for potential legal proceedings, regulatory matters or active complaints. Deletion or destruction will be carried out as soon as reasonably practicable after the information is marked for deletion or destruction;
    • In respect of cases under the public access scheme registered barristers are recommended by Bar Standard Board Guidance to retain copies of client information including personal data and sensitive personal data, information and documents you supply whether in hard copy or in electronic form for a minimum period of 7 years under the current provisions of the regulatory code of conduct set out in the Bar Handbook;
    • I will store some of your information and personal data which I need to carry out conflict checks for the rest of my career. However, this is likely to be limited to your name, contact details, the name of the case, and correspondence which I may have had with you.
    • Names and contact details held for marketing purposes will be stored indefinitely or until I become aware or am informed that the individual has ceased to be a potential client.
    • Equality and diversity data may be retained indefinitely in pseudonymised form for the purpose of research and statistics and complying with regulatory obligations in relation to the reporting of equality and diversity data.

Consent

  1. As explained above, in certain instances I am rely on your explicit consent to process your information of the type mentioned in Paragraph 4(g) to (l) above. You provided this consent when you agreed that I would provide legal services or you asked me to provide a reference.
  2. You have the right to withdraw this consent at any time, but this will not affect the lawfulness of any processing activity I have carried out prior to you withdrawing your consent. However, where I also rely on other bases for processing your information, you may not be able to prevent processing of your data. If there is an issue with the processing of your information, please contact me using the contact details below.

Your Rights

  1. Under the GDPR, you have a number of rights that you can exercise in certain circumstances. These are free of charge. In summary, you may have the right to:
    • Ask for access to your personal information and other supplementary information;
    • Ask for correction of mistakes in your information or to complete missing information that I hold on you;
    • Ask for your personal information to be erased, in certain circumstances;
    • Receive a copy of the personal information you have provided to me or have this information sent to a third party. This will be provided to you or the third party in a structured, commonly used and machine-readable format, e.g. a Word file;
    • Object at any time to processing of your personal information for direct marketing;
    • Object in certain other situations to the continued processing of your personal information;
    • Restrict the processing of your personal information in certain circumstances.
  2. If you want more information about your rights under the GDPR please see the Guidance from the Information Commissioners Office on Individual’s rights under the GDPR.
  3. If you want to exercise any of these rights, please:
    • use the contact details at the end of this document;
    • provide a contact address so that you can be contacted to request further information to verify your identity;
    • provide proof of your identity and address;
    • state the right or rights that you wish to exercise.
    • I may need to ask you to provide other information so that you can be identified.
  4. I will respond to you within one month from when I receive your request.

Marketing Emails

  1. If you wish to unsubscribe from any marketing emails that you have signed up for, you can do so by sending an email to privacy@xxiv.co.uk asking to be unsubscribed from the marketing email(s). It may take up to 7 days for this to become effective.

How to make a complaint?

  1. The GDPR also gives you the right to lodge a complaint with the Information Commissioners’ Office if you are in the UK, or with the supervisory authority of the Member State where you work, normally live or where the alleged infringement of information protection laws occurred. The Information Commissioner’s Office can be contacted at http://ico.org.uk/concerns/.

Future Processing

  1. I do not intend to process your personal information except for the reasons stated within this privacy notice. If this changes, this privacy notice will be amended and placed on my Chambers’ website at xxiv.co.uk .

Changes to this privacy notice

  1. This privacy notice was published on 25 May 2018 and last updated on 25 May 2018.
  2. I will review my privacy practices and may change this policy from time to time. When I do so, an amended privacy notice will be placed on my Chambers’ website.

Contact Details

  1. If you have any questions about this privacy notice or the information I hold about you, please contact me as follows:
  • write to me at XXIV Old Buildings, Lincoln’s Inn, London, WC2A 3UP; or
  • email me at: edward.cumming@xxiv.co.uk; or
  • telephone me at +44 20 7691 2424.