Privacy notice for counsel and experts

In the course of our activities, we may obtain a range of personal data about you. This data may be received from you, or it may be received from a third party such as another professional advisor, witness, opponent, court, counter party or obtained from a public source.

The types of personal data that we hold might include:

• Contact details
• Biographical information about your job, background
• An assessment as to whether you (or your employees who worked on the matter) would be recommended for engagement on future matters on which we are instructed. This assessment will be based on the professional view of the lawyer(s) that dealt with you taking account of relevant information  including as to whether you:
  • Demonstrated the appropriate level of technical ability to the matter on which you were instructed; and
  • Met the required level of service delivery by delivering your service promptly, to budget and in a manner appropriate to our and our clients’ requirements.
• Images captured by CCTV cameras at our offices
• Marketing information (e.g. which of our services are relevant/potentially relevant to you, details of your visits to our website, attendance at events)

We may also generate personal data about you in connection with our work with you or in connection with marketing activity. Our marketing systems record information such as your contact details, your responses to event invitations and interactions with us and with marketing emails (eg, what events you attended, which marketing emails you have opened or what links you have accessed). They also record your preferences such as your preferred location for attending events at our offices, and of the sectors and services that you are interested in.

The basis upon which we process your personal data and consequences to you of not providing it, depend upon the type of personal data involved, our relationship with you, and the purpose for which the data is needed.

To the extent that we have a contract with you (or one is in prospect) on behalf of our client, the primary legal basis for processing your personal data is that the processing is necessary for the performance of our contract with you, or in order to take steps at your request prior to entering into a contract

In addition, processing of your personal data may be necessary for compliance with our legal and professional obligations to our clients and to third parties. This includes for example, our professional and contractual duties to our clients, the courts and our obligations to regulators. 

Further, processing may be necessary in pursuit of our legitimate interests. We have legitimate interests:

• In ensuring we are able to instruct appropriate experts and counsel to deliver to our clients’ legal advice which is in their best interests.
• In complying with our ISO standards which require us to determine and apply criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers.
• In complying with our obligations to our insurers.
• In maintaining the security of the systems, premises, equipment and information to prevent cyber or physical incidents.
• In the case of processing your data for marketing purposes, in providing information to you about our services which are or may be of interest to you and building our relationship with you.

We will use your details to provide you with information about our work, activities and matters such as invitations to events and seminars that we think you will find of interest. From time to time we may invite you to events that we run jointly with other organisations. If you register for such an event then we may share your contact details with that organisation.

We do not otherwise share your data for marketing purposes.

When you access the Mills & Reeve website, further relevant privacy information and details of the data we collect and process is set out in our website privacy notice and our cookies policy. We may use the information we collect about your interactions with our website to tailor our marketing communications to those areas that we consider are most likely to interest you (“profiling”).

You may opt out of all or manage these marketing communications by signing up for a My M&R account and updating your preferences there.

Certain personal data is subject to additional safeguards under data protection legislation. Such information includes details of

• Your racial or ethnic origin.
• Your political opinions.
• Your religious beliefs or other beliefs of a similar nature.
• Whether you are a member of a trade union.
• Your physical or mental health or condition.
• Your sexual life.
• The commission or alleged commission by you of any offence.
• Any proceedings for any offence committed or alleged to have been committed by you, the disposal of such proceedings or the sentence of any court in such proceedings.

It may be necessary for us to process some sensitive personal data in order to comply with legal or regulatory obligations (including making reasonable adjustments for clients with disabilities), or if we need to do so in order to seek confidential legal advice, or establish or defend legal claims.

Otherwise, we will only process your sensitive personal data with your explicit consent. If you voluntarily send us your sensitive personal data, we shall treat that as your explicit consent for us to hold that data, which otherwise shall only be processed in accordance with this notice. Where such data is processed by us on the basis of your explicit consent, you may withdraw your consent at any time: this will not affect the lawfulness of any processing based on your consent before you withdrew it.

If you decide not to supply personal data that we have requested and as a result we are unable to comply with our professional, legal or regulatory obligations, then we may be unable to instruct you on behalf of our client.

Your personal data may be seen or used by our partners and staff (whether lawyers or support staff) in the course of their duties or others lawfully working with us in the ordinary course of our business (for example, former staff or partners working with us on a consultancy basis).

In order to operate our contract with you and/or our client and to comply with our duties to our clients (and where appropriate, the court) we may pass such information to others as appropriate to the details of the particular matter on which you are instructed. Examples of recipients of your personal data might include our clients, prospective clients, opposing lawyers/opposing parties, other witnesses, expert witnesses, professional advisors, arbitrators, judges and court staff.

We may also outsource some of our support services or engage consultants, professional advisors, auditors and others to support us in delivering or evaluating our services (for example secretarial, marketing, courier, translation or IT services). In these cases relevant personal data would be provided to and processed by the provider of such services, in accordance with the terms of our contract with them and to the extent appropriate for the performance of that contract.

We might need to share or transfer your data confidentially with relevant parties and/or their professional advisers if there is a merger, acquisition, change of control, joint venture or other similar arrangement involving Mills & Reeve LLP.

Exceptionally we might need to share your personal information in order to obtain necessary confidential legal advice or to comply with our insurance, legal or regulatory obligations. For example, we may have to provide some or all of the information to our insurers, legal advisors, public authorities such as HMRC, or to a court/tribunal.

In the course of carrying out the activities referred to above we may transfer your data to other countries, which may not have the same legal protections for your data as the UK.

Where data is being transferred outside of the UK and/or European Economic Area, we will take steps to ensure that your data is adequately protected in accordance with UK legal requirements and the EU GDPR (as applicable).

Otherwise for example we may transfer your data if it is necessary for performance of our contractual duties to you, or because we have other legal obligations to transfer the data, or it is necessary for important reasons of public interest. If you require further detail about the protections in connection with any particular relevant transfer, matter or jurisdiction please ask us.

We expect to retain your personal data in accordance with our data retention policies. This policy is reviewed periodically and the periods for storage specified in it may alter depending on the requirements of law and regulation, best practice and insurance. Where your personal data relates to legal work that you have undertaken on behalf of our client, we will retain your data for the appropriate retention period for client matters. 

We may be obliged to suspend any planned destruction or deletion under our retention policy where legal or regulatory proceedings require it or where proceedings are underway such as require the data to be retained until those proceedings have finished.

We will retain information on you to fulfill our ISO standards in relation to evaluation, selection, monitoring of performance and re-evaluation of external providers. This will be retained until you cease to practise.

You have the right to request copies of the personal data we hold about you. If you wish to obtain a copy of your personal data, you may contact us by post at Data Governance Manager, Mills & Reeve LLP, 78-84 Colmore Row, Birmingham B3 2AB, or by emailing [email protected].

You also have the right to ask for inaccuracies in your data to be corrected, and in certain circumstances for us to stop processing your data or for your data to be erased. Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you have any questions about this privacy notice, please use the following contact point: [email protected].

If you believe that we have not complied with any of our obligations under data protection laws in the UK, please let us know. You have the right to lodge a complaint with the Information Commissioner’s Office.