GDPR for law firms

Orlagh Kelly of Briefed (providers of GDPR training to the Bar Council), a barrister, trainer and consultant specialising in GDPR, explains how these regulations have affected law firms and what you should be doing about GDPR compliance. (Updated 23 September 2024)

 

The General Data Protection Regulation rules continue to have an enormous impact on how law firms collect and use data.

Back in January 2021, the UK formally adopted the GPDR into domestic law. It is now referred to as the UK-GDPR.

This means that any law firm receiving data from the EEA (European Economic Area), including any EEA data centres, can continue its data transfer relationship without having to implement any additional safeguards. Even though the UK now has an 'adequacy decision' covering the EEA, your firm's privacy notice should still reflect the existence of any international data transfers by your firm.

Meanwhile, it is becoming clearer where the big risks lie for law firms. ‘Sensitive’ data needs to be protected with particular care. All law firms have employment records and those who practise employment law will have sensitive data in their case files: medical records and information that relates to ethnic and religious backgrounds, political affiliations and sexual orientation. Financial information such as bank account details – a particular target for hackers and fraudsters – is the other obvious risk.

Against this background the ICO has recognised the need for high standards of data protection within the legal sector, and in early 2024 gave the go-ahead for the first regulator-approved, legal sector-specific GDPR certification - LOCS:23. As the only government-backed standard for data protection in this space, LOCS:23 is expected to become the 'gold standard' for data protection compliance in the years to come.

The standard will also provide much needed clarity for law firms, providing a clear roadmap for managing and responding to data breaches, subject access requests and risk assessment.

As ever, there are practical steps you can take to help ensure compliance with the key requirements of GDPR.

"If you can show that you are taking reasonable steps to comply, you are unlikely to face the hair-raising penalties (up to 4% of annual worldwide turnover) that GDPR allows for."
Paul Smith, senior risk management consultant, Travelers

Your use of personal data

Your first step should be to review your firm's use of personal data. What personal data do you hold and where does it come from? How and why do you use it? Is it shared with anyone else (such as any provider of 'cloud' IT services that you use)?

For most law firms, understanding what personal data you hold should be relatively straightforward, and much the same as under the pre-GDPR data protection rules. But GDPR has extended the definition of 'personally identifiable information (PII)' to potentially include other data that you might be collecting, such as the IP addresses of visitors to your website.

Review the types of data you hold. Aim for data minimisation and storage minimisation. Do you really need all of that data, or could you achieve the same business objectives with less data? Are you holding any data longer than you need to?

At the same time, you should introduce a system for assessing the privacy impact of any new data processing activities (or significant changes to existing practice) that you introduce. A data protection impact assessment (DPIA) is a useful way of doing this.

A DPIA is legally required if there is a high risk to individuals. For example, you might need a DPIA before introducing new systems for processing sensitive client information, or monitoring employees' internet activity or using CCTV.

"Consent must be freely given and unconditional. For example, asking employees for consent to process their personal data as part and parcel of their contract of employment is not acceptable, as they may feel under pressure to agree."
Olivia Sinfield, partner, Osborne Clarke

Lawful processing and consent

Under GDPR, you can only process personal data if you can identify a lawful basis for doing so. For example, legitimate reasons include processing the personal data involved in pursuing or defending a legal claim.

In terms of marketing your law firm, processing personal data can generally be justified on the basis of pursuing the firm's 'legitimate interests'.

Separate regulations continue to apply for electronic marketing (currently, these are the UK’s Privacy and Electronic Communications Regulations (PECR), although the EU is expecting to update the law in this area to bring it in line with GDPR).

You are allowed to email a current or previous client, or the business email address of a limited company (and any person using that email address), provided that any mailshots include an option to opt out.

Emailing private individuals is a different matter – and this includes sole traders and some partnerships. You need their consent before you email them, or you must be able to demonstrate you meet the ‘soft opt-in’ requirements of PECR. For example, you are allowed to email people whose details you have obtained through the course of negotiations for sale (eg an enquiry), but there are parameters you need to meet. The Information Commissioner’s Office has produced a 57-page guide to explain the details.

For those situations covered by GDPR (rather than PECR), you need to ask for consent using simple, clear language that explains what the individual is allowing. You must ask for consent separately from any other terms and conditions the individual is agreeing to. And you must keep clear records of consent – which can be withdrawn by the individual at any time.

Consent must be actively given – pre-ticked consent boxes are explicitly ruled out. You'll need to think carefully about how you can encourage people to give consent, by stressing the benefits. Asking individuals to choose between two (equally prominent) options – consent or no consent – tends to lead to a higher level of opting-in than a single opt-in choice that can be ignored.

You can continue relying on existing consents, but only if they meet the GDPR requirements. For example, consents that were obtained using a pre-ticked box will no longer be valid. You should check how consents have been obtained by any mailing lists you use.

As before GDPR, you must make it easy for individuals to withdraw their consent – for example, by including an 'unsubscribe' option on marketing emails. It must be as easy to withdraw consent as it was to give consent in the first place. You should also aim to 'refresh' existing consents periodically (every two years is a guideline).

"Consent has to be separate from other terms and conditions and so shouldn't be a precondition of your service. But you may choose to incentivise consent – for example, by offering a free guide to people who join your mailing list."
Paul Smith, senior risk management consultant, Travelers

Individuals' rights

Individuals' rights have been extended under GDPR. You need to make sure that you have procedures and systems that allow you to respect these rights. This may include upgrading the capabilities of your IT systems to give you better control over the data you hold.

• Individuals must be informed about how their data is being used – typically, through an appropriate privacy notice.
• Individuals are entitled to know that their data is being processed, and to see a copy. Unlike the previous system, you can no longer normally charge a fee for subject access requests. Information must be provided as soon as possible, usually within a month at most. You need to be able to verify the identity of the individual, and to supply information in a commonly-used electronic format.
• If the information you hold is inaccurate, you can be asked to correct it. If you have shared the information with third parties, you should also notify them of any corrections.
• In some circumstances, individuals have a 'right to be forgotten', meaning that you erase their data and can no longer process it. For example, if the data is no longer needed for its original purpose, or when an individual withdraws consent. There are some exceptions, including retaining data that you need for making or defending legal claims.
• In some circumstances, individuals can restrict or object to processing of their personal data. This includes the right to withdraw any consent they have given. There are also various safeguards relating to profiling and automated decision-making.

Data breaches

If there is a data breach that is likely to harm individuals, you must report it. This is likely to be the case for any incident involving personal information that isn't already publicly available.

Typical incidents involve clients' (or employees') personal information being accidentally disclosed, or accessed by someone who isn't authorised. Incidents can also include problems where information is accidentally or maliciously destroyed or altered, or becomes unavailable (eg because of a systems failure) – for example, if this means that you cannot properly defend a client.

You must report the breach to the Information Commissioner's Office (ICO), within 72 hours (where feasible) of becoming aware of it. While you may not yet know all the details, you will need to let them know what has happened. If possible, this should include explaining what individuals and what data has been put at risk.

You need to outline what the likely consequences of the breach are. You also need to explain what you have done, and what else you plan to do, to deal with the problem and to help reduce the risk to the individuals involved.

Data breaches that involve a 'high' risk to individuals must also be reported to the individuals concerned, as soon as possible. For law firms, data breaches are likely to be high risk. For example, you would need to let clients know if unencrypted confidential information had been exposed, or tell employees if a data breach meant that they were at risk of identity theft.

"Showing you had clear data protection policies and controls in place, along with training for all employees, can help to reduce the risk and severity of any fine."
James Boyle, partner, Mishcon de Reya

 

GDPR top ten

1. Appoint an individual to take responsibility for GDPR compliance and organise any specialist advice you need.
2. Invest in law-firm-specific training on GDPR and data breach risks – throughout the firm.
3. Carry out a data audit to establish what personal data you hold and how you use it.
4. Review whether you could reduce the amount of personal data you hold or how long you store it for.
5. Introduce a system of carrying out a privacy impact assessment before introducing new personal data processing.
6. Upgrade your consent process to ensure individuals genuinely opt in; review existing consents and mailing lists.
7. Make sure you can respond to individual requests to see, correct or delete their data.
8. Review and if necessary upgrade the firm's data security measures.
9. Be ready to notify ICO of any data breach promptly.
10. Before sharing personal data with barristers or IT providers, check their GDPR compliance and put in place the right data-sharing agreement.

 

Why do law firms choose Travelers?

It’s because Travelers has unmatched expertise and longevity in the legal sector, with a dedicated team of experts in underwriting, claims and risk management.
 

See also:

 

• Cyber security for law firms FAQs
• Staying in contact with referrers, clients and prospects
• SRA Accounts Rules compliance for law firms FAQs