DATA PROTECTION POLICY

AFFINITY FAMILY LAW

This policy is issued to and available to all clients of Affinity Family Law, and to other potential clients, and other appropriate and relevant persons and bodies.

Index of sections

  1. Policy Aim
  2. Scope
  3. Data Protection principles
  4. Processes and Procedures
  5. Use of Personal Data
  6. Special Categories of Personal Data
  7. Transfers and sharing of Personal Data
  8. Data Subject Rights
  9. Retention of Personal Data
  10. Responsibility for the processing of personal data
  11. Enquiries and Complaints
  12. Monitoring and review

1. Policy Aim

Affinity Family Law is a law firm and provides Legal Advice and assistance to its clients. It is regulated by the Law Society of Scotland. We are committed to ensuring that your privacy is protected and this policy sets out how we use your personal data and provide you with information on your rights in relation to that data.

Any personal data about you which is provided to us by you or by a third party shall only be used by us in accordance with this policy and data protection law.

Affinity Family Law is committed to good data protection practice in the culture of our staff and organisation, specifically ensuring that we comply with the GDPR data protection principles when processing any personal data, and that we meet our legal obligations as laid down in data protection law (including the GDPR and all relevant EU and UK data protection legislation).

2. Scope

This policy applies to all personal data processed by Affinity Family Law and is part of our overall approach to compliance with data protection law. All Affinity Family Law staff and workers are obliged and expected to comply with this policy. Where we use the word “clients” this includes any third parties whose personal information we hold control and process lawfully and in terms of this policy document.

3. Data protection principles

Affinity Family Law complies with the following data protection principles and undertakes to ensure that when it processes personal data:

  • it is processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)
  • it is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’)
  • it is all adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
  • it is accurate and where necessary kept up to date and that reasonable steps will be taken to ensure that personal data that is inaccurate having regard to the purposes for which they are processed are erased or rectified without delay (‘accuracy’)
  • it is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’)
  • it is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)

4. Process and procedures

Index

  1. What we need
  2. Why we need your personal information – contractual purposes
  3. Why we need your personal information – legal obligations
  4. How we protect your personal information
  5. How long we keep your personal information
  6. Your rights

Affinity Family Law does and will do the following:

  • only collect and process personal data that is necessary for the purpose or purposes that we have identified in advance;
  • ensure that the legal basis for processing clients’ and other data subjects’ relevant data is identified in advance;
  • ensure that, as far as possible, the personal data we hold is accurate;
  • only process client data for as long as is it required for lawful purposes and then we will securely dispose of, or delete, client data;
  • provide data subjects with information on why we are asking for that data and what we intend to do with it;
  • not do anything with data that data subjects would not expect given the content of this policy, fair processing or privacy notice;
  • ensure that appropriate technical and organisational measures are in place to ensure the security of personal data;
  • ensure that all paper and physical items containing personal data, including letters, envelopes, draft documents, prints of emails and other communications, deeds, certificates, policies, account documents, financial documents and others used in the processing of legal work under client instruction is retained in dedicated files which are stored and used within our offices, and once material is no longer needed, whether by it having been scanned into our accounting management system and/or on completion of the work associated with the material, it is securely and confidentially shredded by a professional shredding company who remove and shred the material from our offices under contract;
  • ensure that staff and workers/agents who handle personal data are aware of their responsibilities under this policy and other relevant data protection and information security policies, and are adequately trained and supervised. Any employee worker or agent who breaches this policy may be subject to disciplinary proceedings. Affinity Family Law will issue suitable privacy notices to potential clients, clients, employees and all 3rd parties who are the subject of lawful notice of collection and/or retention of personal data by us. See immediately below for the generic style of Privacy Notice (PN) applied, under explanation that individual PNs are bespoke to the receiver according to their personal circumstances status, rights and requirements under GDPR.

What we need

Affinity Family Law operates as a sole trader and is run and owned by Isabella McKerrow, solicitor. Isabella McKerrow, trading as Affinity Family Law will be a "controller" of the personal information that you provide to us:

  1. when you instruct us to act on your behalf;
  2. in this form; and/or
  3. through this website www.affinityfamilylaw.co.uk
unless otherwise stated in this privacy notice.

When you become a client of Affinity Family Law, we will collect, store and use the personal information that you provide to us in your instructions and during the course of our mutual solicitor/client relationship. We may ask you for additional personal information during the course of our solicitor/client relationship, which shall be collected, stored and used in accordance with this privacy notice.

When you become our client we may also collect, store and use additional personal information relating to you. We obtain this information from other persons and/or agencies which we will list here:

  • We will inform you by further notice when we obtain this information.

Why we need your personal information– contractual purposes

We need to collect our clients' personal information so that we can perform our service agreement with you/carry out your instructions as client to us as solicitors. We will use our clients' personal information to:

  • provide our clients with legal advice, including by communicating with you by email, letter and/or telephone, and by other electronic or personal means;
  • represent our clients as their solicitors in connection with the relevant case, transaction or other legal business;
  • respond to and communicate with clients regarding their questions, comments, support needs or complaints, concerns or allegations in relation to, we will use clients’ personal information to investigate any complaint, take disciplinary action, communicate with our regulatory authority or law enforcement or other statutory bodies; and
  • carry out clients’ active and particular instructions.

NOTE: If clients do not provide us with all the personal information that we need to collect then this may affect our ability to provide them with Legal Advice and/or represent them as solicitors.

Why we need your personal information – legal obligations

We are under a legal obligation to process certain personal information relating to our clients for the purposes of complying with our obligations under:

  • requirements of the Law Society of Scotland for solicitors
    www.lawscot.org.uk – Affinity Family Law is regulated by the Law Society of Scotland and Scottish Legal Complaints Commission under the Solicitors (Scotland) Act 1980 and other legislation;
  • Anti-Money Laundering statutes, laws and regulations to which we as individual solicitors and a firm of solicitors registered with and regulated by the Law Society of Scotland and otherwise under said legislation etc. are subject; and
  • any other applicable legal requirements including tax legislation.

How we protect your personal information

Your personal information is stored in paper form in our office filing cabinet and electronically on our secure office 365 cloud storage system and electronically on our secure accounting case management system based system and is accessed by our staff and workers for the purposes set out above.

The following paragraph does NOT currently apply (under explanation that our serves and offices that hold/store clients’ personal data electronically and on paper are in Scotland only):

Where we are required to transfer your personal information out with the EU, we will provide you with information regarding the safeguards that we have put in place with the recipient country to protect your personal information.

How long we keep your personal information

We will review and possibly delete your personal information following a period of at least 5 years after you have ceased to be our client. This is to meet the regulatory requirements and obligations of Affinity family law’s solicitors, to meet the needs of clients whose data may be required for additional legal work or instructions which can only adequately be carried out with reference to said data and data history; and to protect clients who may be the subject of litigation, diligence, regulatory action or investigation after completion of the legal work carried out by Affinity Family Law.

We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods for different types of work, and clients can request a copy by contacting Isabella McKerrow telephone 0141 639 9892 and/or write to Isabella McKerrow Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE and we will attempt to resolve any issues you have.

Your rights

You can exercise any of the following rights by writing to us at Isabella McKerrow Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE

Your rights in relation to your personal information are:

  • you have a right to request access to the personal information that we hold about you by making a "subject access request";
  • if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
  • you have a right to request that we restrict the processing of your personal information for specific purposes; and
  • if you wish us to delete your personal information, you may request that we do so.

Any requests received by Affinity Family Law will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk.

5. Use of personal data

Affinity Family Law processes personal data in the course of the provision of legal services. We may collect and use (‘process’) the following personal data in relation to individuals as necessary for the provision of legal advice.

  • Name
  • date of birth
  • Contact details
  • National Insurance number
  • Photographic images
  • Passport number and copies of passport
  • Other identification documentation and images – driving licence, bus pass, utility material, council tax material, national tax material.
  • Bank account details and other financial information
  • property and asset ownership
  • employment and business information
  • CCTV footage
  • Information with biographical significance about an individual.
  • The personal data we hold about clients is processed by us to enable us to provide those clients with the services they have engaged us to provide in terms of their contract with us.

    We would also like to use some personal data to send updates and information to clients about our other services. We would like to contact clients by post, telephone, text/messaging and email.

    Clients have a right at any time to stop us contacting you about our other services in this way. If this is the case for you, please contact: Isabella McKerrow Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE. isabella@affinityfamilyla.co.uk

    Clients’ data will be stored securely in our electronic office 365 cloud based system and on paper in our secure filing cabinets. And data will where necessary be shared with other companies offering us services to help us carry out client instruction – all under a data sharing agreement consistent with GDPR requirements.

    6. Special categories of personal data

    In order to provide the contractual services to clients, we do not routinely require to collect some data which is classified under data protection law as ‘special categories of personal data’, unless for the specific (and likely to be unusual and isolated) purpose of carrying out instructions in a litigation case or similar situation, or by specific request or instruction by clients.

    Special categories of personal data include the following personal data revealing:

  • racial or ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic data, or biometric data for the purpose of uniquely identifying a natural person
  • an individual’s health
  • a natural person's sex life or sexual orientation
  • criminal convictions and offences
  • Affinity Family Law only processes such special category data as is necessary to provide its clients with legal advice and/or representation.

    We will only collect and process this type of personal data in the following circumstances:

  • where clients have given explicit consent
  • where it is necessary for carrying out our obligations under employment, social security or social protection law
  • where it is necessary to protect clients’ vital interests or the vital interests or another person where they are incapable of giving consent (for example, in emergency situations)
  • where a client is a member or former member or person in regular contact with us
  • where clients have manifestly made that personal data public
  • in connection with a legal claim or where the courts have ordered us to do so
  • 7. Transfers and sharing of personal data

    The personal data held by us will be stored and processed within the United Kingdom.

    Affinity Family Law will not transfer any personal data to a country outside the EU or an international organisation without ensuring the level of protection provided by data protection law is not undermined.

    In order to deliver our services to clients, we may share your information with appropriate third parties, in particular (depending on the nature and requirements of clients’ instruction to and contract with Affinity Family Law):

    • Scottish Courts and Tribunals Service
    • other firms of solicitors, professionals and other specialisms involved in the case/transaction
    • independent experts
    • Registers of Scotland
    • Searching companies such as Millar & Bryce, First Scottish Searching, and others
    • Glasgow Solicitors Property Centre
    • The Office of the Public Guardian Scotland
    • Insurance companies who provide Bonds of Caution and other indemnity policies including title and conveyancing indemnity.
    • Local authorities for conveyancing and civil litigation purposes.
    • HMRC
    • Revenue Scotland.
    • private companies with whom we have a data Processing/Sharing Agreement

    Clearly not all data or information will be shared with all processors, and your Privacy Notice will list those data processors used for each client’s work.

    We may also occasionally share clients’ data with other organisations, such as law enforcement or other agencies where required by law, and/or where in our opinion, such action is reasonably necessary to comply with legal process; to respond to any legal claim or actions; or to protect our rights, our service user’s rights or the general public.

    8. Data subject rights

    Affinity Family Law will ensure that we have procedures in place to allow data subjects to exercise the following data subject rights under the GDPR:

    Subject access: the right to request information about how personal data is being processed, including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

    • the purpose of the processing
    • the categories of personal data
    • the recipients to whom data has been disclosed or which will be disclosed
    • the retention period
    • the right to lodge a complaint with the Information Commissioner’s Office (ICO)
    • the source of the information if not collected direct from the subject
    • the existence of any automated decision making

    Rectification: the right to allow you to rectify inaccurate personal data concerning you without undue delay.

    Erasure: the right to have data erased in certain circumstances, and to have confirmation of erasure, but only where:

    • the data is no longer necessary in relation to the purpose for which it was collected
    • where consent is withdrawn
    • where there is no legal basis for the processing, or
    • there is a legal obligation to delete data.

    Restriction of processing: the right to ask for certain processing to be restricted in the following circumstances:

    • if clients contest the accuracy of their personal data
    • if our processing is unlawful and clients do not want it to be erased
    • if we no longer need the data for the purpose of the processing but it is required by clients for the establishment, exercise or defence of legal claims, or
    • if clients have objected to the processing, pending verification of that objection

    Data portability: clients have the right to receive a copy of the personal data they have provided to us and certain information generated by us, if our processing is carried by automated means, which will allow clients to transfer it to another data controller. This only applies in relation to the data being processed by consent or under a contract to provide clients with a service.

    Object to processing: clients have the right to object to processing carried out under the legitimate interests processing condition unless we can demonstrate compelling legitimate grounds for the processing which override clients’ interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

    Clients have an absolute right to object to any direct marketing that we are sending to them and there are no exemptions to this which would allow us to refuse to comply.

    Object to automated decision making: if we are making decisions about clients based on automated processing which have a legal or similar effect on them, then in some circumstances clients have the right to object to this decision being made solely on the basis of automated processing. This includes any profiling of clients that we carry out.

    Clients cannot exercise this right in the following circumstances when the processing is:

    • necessary for entering into, or the performance of, a contract
    • authorised by law, or
    • based on explicit consent

    Affinity Family Law is committed to facilitating and complying with any request from a data subject who wishes to exercise their rights under data protection law in a transparent manner and without undue delay.

    Should you wish to exercise any of the rights noted above, please contact, Isabella McKerrow, Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE, isabella@affinityfamilyla.co.uk

    9. Retention of personal data

    We will keep clients’ personal data for as long as they are using our services. Once they cease using our services, the personal data will be securely destroyed if it is no longer required for the purpose for which it was obtained or used. For the avoidance of doubt, the period we retain your data will be affected by one or more of the following considerations:

    • Our expectation that clients will instruct us again in future in circumstances in which we need to have their data already on hand.
    • Any statutory period of prescription or limitation of action by or against clients as a party to a case or transaction (including as an executor of a deceased person’s estate and/or as trustee of a trust), and/or against Affinity Family Law as their solicitor.
    • Any period until a Law Society of Scotland regulated inspection of Austin Lafferty under the Solicitors (Scotland) Act 1980 and related legislation.
    • Any period during which Scottish Legal Complaints Commission are investigating and/or adjudicating a complaint against us by a client or third party.
    • Any period over and during which HMRC and/or Revenue Scotland and/or Police Scotland may carry out investigation of the client and/or Isabella McKerrow trading as Affinity Family Law.
    • The long negative prescription period of 20 years.

    Please see our Data Retention Policy for further information.

    10. Responsibility for the processing of personal data

    Isabella McKerrow (trading as Affinity Family Law) is registered as a data controller with the ICO.(Registration Number: Z2416391).

    If you have any concerns or wish to exercise any of your rights under the GDPR, then you can contact the designated individual with responsibility for data protection Isabella McKerrow in the following ways:isabella@affinityfamilyla.co.uk or telephone 0141 639 9892 or write to Isabella McKerrow Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE.

    11. Enquiries and complaints

    Affinity Family Law is committed to ensuring that clients and others’ personal data is processed lawfully, fairly and securely. If you have any questions or concerns about this notice or the way in which we process your data, please contact Isabella McKerrow isabella@affinityfamilyla.co.uk or telephone 0141 639 9892 or write to Isabella McKerrow Affinity Family Law Solicitors, 0/2 60 Thornwood Avenue, Glasgow G11 7PE and she will attempt to resolve any issues you have. If you remain unsatisfied, you can contact the ICO at: Information Commissioner's Office WycliffeHouse,WaterLane’Wilmslow,Cheshire,SK9 5AF, Tel: 0303 123 1113,www.ico.org.uk

    12. Monitoring and review

    This policy was last updated on 24 May 2018 and shall be regularly monitored, reviewed and updated by Isabella McKerrow at least every two years. When we update this notice, a revised version will be published on our website and, where possible, we will provide you with a copy of same.