Prepared and Approved by:

Scarlett Milligan
Approved on: 06.04.18
Policy became operational on: 06.04.18
Next Review date: 07.01.19

Data Controller

Scarlett Milligan is the Data Controller under the General Data Protection Regulation, which means that she determines for what purposes personal information is held, or will be used for. She is also responsible for notifying the Information Commissioner of the data she holds or is likely to hold, and the general purposes that this data will be used for, and of any data breaches.

She is registered with the Information Commissioner’s Office as a Data Controller. Her registration number is: ZA244301

Overview

In addition to this overarching Data Protection Policies, Scarlett holds the following policies, which are available on request:

• Data Retention and Disposal Policy
• Data Breach Checklist
• Subject Access Request Policy
• Mobile Working Policy
• IT Register
• Training Register
• Near Miss Register
• Third Party Data Sharing Register
• Data Sharing Agreements

Barrister Data Protection Policy

06.04.18

Introduction

Scarlett Milligan needs to gather and use certain information about individuals.

These can include clients, customers, suppliers, business contacts, employees and other people her practice has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled, stored to meet the practice’s data protection standards – and to comply with the law.

Why this Policy Exists

This data protection policy exists to ensure that Scarlett Milligan:

• Complies with Data Protection law and follows good practice
• Protects the rights of staff, clients, customers and partners
• Is open about how she stores and processes individual’s data
• Protects herself from the risks of a data breach.

Data Protection Law

The General Data Protection Regulation describes how organisations must collect, handle, and store personal information.

These rules apply regardless of whether data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The General Data Protection Regulation is underpinned by six important principles. They say that personal data must be:

• processed lawfully, fairly, and transparently
• collected for specific, explicit, and legitimate purposes
• adequate, relevant, and limited to what is necessary for processing
• accurate and, where necessary, kept up to date.
• kept in a form such that the Data Subject can be identified only as long as is necessary for processing
• processed in a manner that ensures appropriate security of the personal data

This policy will be updated as necessary to reflect best practice in data management, security, and control and to ensure compliance with any changes or amendments made to the General Data Protection Regulation.

People, Risks and Responsibilities

Policy Scope

People
This policy applies to:

• All employees of Scarlett Milligan, including management, trainees, volunteers, work experience students, support staff.
• All contractors, suppliers and other people working on behalf of Scarlett Milligan (including her clerks)
• Any pupils or mini-pupils who shadow or otherwise accompany Scarlett Milligan. In the event that a data subject would like their personal information to be withheld from pupils or mini-pupils, they should state this in their instructions to counsel.

It applies to all data her practice holds relating to identifiable individuals. This can include but is not limited to:

• Names of individuals
• Postal addresses
• Email addresses
• Telephone
• Financial data
• Business names; and
• Any other personal sensitive information relating to individuals.

Responsibilities

Everyone who works for Scarlett Milligan has responsibility for ensuring data is collected, stored and handled appropriately.

This policy will be updated as necessary to reflect best practice in data management, security, and control and to ensure compliance with any changes or amendments made to the General Data Protection Regulation.

General Data Protection Policy Information

Scarlett Milligan will, through appropriate management and strict application of criteria and controls:

• Observe fully conditions regarding the fair collection and use of information
• Meet her legal obligations to specify the purposes for which information is used
• Collect and process appropriate information, and only to the extent that it is needed to fulfil Scarlett Milligan’s operational needs or to comply with any legal requirements
• Ensure the quality of information used
• Ensure appropriate retention and disposal of information
•  Ensure that the rights of people about whom information is held, can be fully exercised under the GDPR. These include:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erase
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

• Take appropriate technical and organisational security measures to safeguard personal information
• Ensure that personal information is not transferred outside the EEA without suitable safeguards
• Treat people justly and fairly whatever their age, religion, disability, gender, sexual orientation or ethnicity when dealing with requests for information
• Set out clear procedures for responding to requests for information

Data Storage

Information and records relating to service users will be stored securely and will only be accessible to authorised staff and data processors.

Information will be stored for only as long as it is needed or otherwise required by statute and will be disposed of appropriately.

Scarlett Milligan will ensure all personal and company data is non-recoverable from any computer system previously used within the organisation, which has been passed on/sold to a third party.

Data Access and Accuracy

All individuals/data subjects have the right to access the information Scarlett Milligan holds about them, except where specific exemptions apply to a legal professional. Scarlett Milligan will also take reasonable steps ensure that this information is kept up to date.

In addition, Scarlett Milligan will ensure that:

• Everyone processing personal information understands that they are contractually responsible for following good data protection practice
• Everyone processing personal information is appropriately trained to do so
• Everyone processing personal information is appropriately supervised
• Anybody interested in making enquiries about handling personal information knows what to do
• She deals promptly and courteously with any enquiries about handling personal information
• She describes clearly how she handles personal information
• She will regularly review and audit the ways she holds, manages and uses personal information
• She regularly assesses and evaluates her methods and performance in relation to handling personal information
• All staff are aware that a breach of the rules and procedures identified in this policy may lead to disciplinary action being taken against them

Disclosure

Scarlett Milligan may share data with other agencies such as government departments and other relevant parties.

The Individual/data subject will be made aware in most circumstances how and with whom their information will be shared. There are circumstances where the law allows Scarlett Milligan to disclose data (including sensitive data) without the data subject’s consent.

These are:

• Carrying out a legal duty or as authorised by the Secretary of State
• Protecting vital interests of an individual/data subject or other person
• The individual/data subject has already made the information public
• Conducting any legal proceedings, obtaining legal advice or defending any legal rights
• Monitoring for equal opportunities purposes – i.e. race, disability or religion
• Providing a confidential service where the individual/data subject’s consent cannot be obtained or where it is reasonable to proceed without consent: e.g. where she would wish to avoid forcing stressed or ill individuals’/data subjects to provide consent signatures.

Data Protection Training

Scarlett Milligan will ensure that she and all employees are appropriately trained in Data Protection and particularly the policies of Scarlett Milligan and Temple Garden Chambers annually.

If new members of staff commence work with Scarlett Milligan, they will be provided with data protection training within the first month of employment.

Scarlett Milligan keeps a register of all training provided to staff.

Non-Conformance

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

In case of any queries or questions in relation to this policy please contact Scarlett Milligan either via e-mail or telephone:

smilligan@tgchambers.com
020 7583 1315