Drummond Miller LLP understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our clients and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
This Notice explains how we use your personal data; how it is collected, how it is held and how it is processed. It also explains your rights under the law relating to your personal data.
What we need
Drummond Miller LLP will be a "controller" of the personal information that you provide to us when you instruct us to act on your behalf.
When you become a client of Drummond Miller LLP, we will collect, store and use the personal information that you provide to us in your instructions and during the course of our solicitor / client relationship. We may ask you for additional personal information during the course of our client / solicitor relationship, which shall be collected, stored and used in accordance with this privacy notice.
We may also collect, store and use the following personal information relating to you when you become our client from relevant third parties such as your family and friends, witnesses, Unions, courts and other tribunals, GPs, hospitals, investigators, statutory bodies such as the Home Office or the Department of Work and Pensions, COPFS, public records and registers, regulators or your former solicitors:
- personal details
- family details
- lifestyle and social circumstances
- goods and services
- financial details
- education, training and employment details
- physical or mental health details
- racial or ethnic origin
- political opinions
- religious, philosophical or other beliefs
- trade union membership
- sex life or sexual orientation
- genetic data
- biometric data for the purpose of uniquely identifying a natural person
- criminal proceedings, outcomes and sentences, and related security measures
- state benefits received
- other personal data, including medical history, treatment and, records relevant to instructions to provide legal services, including data specific to the instructions in question.
Why we need your personal information – contractual purposes
We need to collect our clients' personal information so that we can provide our legal services to you. We will use our clients' personal information to:
provide you with legal advice, including by communicating with you by email, letter and/or telephone, etc;
represent you as your solicitors in connection with the legal issue in respect of which you have sought our advice, whether such representation be in correspondence, by phone, in person or in court;
check for potential conflicts of interest; and
respond to and communicate with clients regarding your questions, comments, support needs or complaints, concerns or allegations in relation to or any other matter as a consequence of working on your behalf
- If you do not provide us with all of the personal information that we need to collect then this may affect our ability to provide you with legal advice and / or represent you as your solicitors.
Why we need your personal information – legitimate purposes
We may also process our clients' personal information in pursuit of our legitimate interests to: promote our services by sending clients communications with information for upcoming events and legal updates; personalise and tailor our services to you; and invite our clients as guests to our events;
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing, please contact us at: Data Protection Officer, Drummond Miller LLP, Glenorchy House, 20 Union Street, Edinburgh, EH1 3LR. If we comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a client.
Why we need your personal information – legal obligations
We are under a legal obligation to process certain personal information relating to our clients for the purposes of complying with our obligations under:
the Law Society of Scotland’s rules for solicitors;
the anti-money-laundering and terrorist-financing regulations;
the Legal Aid regulations; and
Who we share your personal information with
Your personal data may be shared with any party with whom you have consented that it be shared.
We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include, for example, the Law Society of Scotland, HMRC, DWP, Scottish Legal Aid Board and the Scottish Legal Complaints Commission, law enforcement officials.
We may also share personal data with our professional advisors, such as Advocates and Auditors, for the purposes of taking advice.
Drummond Miller LLP employs third party suppliers to provide services, including, for example, payroll, court document creation, case management software, expert medico-legal and other opinion, and sheriff officers to serve court writs or documents. These suppliers may process personal data on our behalf as "processors" and are subject to written contractual conditions to only process that personal data under our instructions and protect it.
In the event that we do share personal data with external third parties, we will only share such personal data strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal data in accordance with those purposes.
How we protect your personal information
Your personal information is stored in paper files and/or on our password- and fire-wall-protected electronic filing system and our servers based in the UK, and is accessed by our staff for the purposes set out above.
We do not transfer personal data outside of the UK except (1) where it is necessary to do so to carry out instructed legal work (in which instance we may, when travelling abroad, carry data in hard copy form or on an encrypted electronic devices or access remotely personal data which is stored in the EU); or (2) where, for the purposes of data security and business continuity, we have elected to use a reputable cloud-based data storage services stored within the EU or in countries which have been the subject of an adequacy decision by the EU Commission under Art 45(3) of GDPR.
Where any personal data is transferred outside of the UK, we have satisfied ourselves that such transferred data is protected and safeguarded as required by GDPR.
We may be required to transfer your personal information outwith the EU for the purposes of, for example, instructing medico-legal reports from foreign expert witnesses or seeking legal advice from foreign lawyers.
Where your personal information is transferred outwith the EU, we will provide you with information regarding the safeguards that we have put in place with the recipient country to protect your personal information.
How long we keep your personal information
We do not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected except that we are required to keep our clients' personal data for period(s) prescribed by the Law Society of Scotland (our regulatory body) and any Statutory Regulatory body such as HMRC or the Home Office. We will review and possibly delete your personal information following a period of at least 8 years after you have ceased to be our client.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods depending on the matter involved.
You can exercise any of the following rights by writing to us at Data Protection Officer, Drummond Miller LLP, Glenorchy House, 20 Union Street, Edinburgh, EH1 3LR.
Your rights in relation to your personal information are:
you have a right to request access to the personal information that we hold about you by making a "subject access request";
if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
you have a right to request that we restrict the processing of your personal information for specific purposes; and
if you wish us to delete your personal information, you may request that we do so. We may not do so if there is an unresolved claim or dispute; we are legally required to refrain from doing so; or there are overriding legitimate business interests for so refraining.
Any requests received by Drummond Miller LLP will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk
Changes to this Privacy Notice
We may change this Privacy notice from time to time. This may be necessary, for example, if the law changes or if we change our business in a way that affects personal data protection. Any changes will be made available to you on request or on our website – www.drummondmiller.co.uk.