Within the University, your data is shared with only those University staff and students who need to be able to access it for the purpose of running our pro bono services and advising you on your case.
Before we agree to take on your case we may need to share your information (including special category personal information, for example relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership) with the law firms and barristers chambers that assist with our cases in order to try and find a volunteer lawyer to supervise your case. We will inform you in advance where we need to convey information about you to a third party and will only share information about you where we have obtained your prior consent either verbally or in writing. Your information may also be shared with third parties:
- Where you have explicitly requested or consented to the personal information being shared with a named third party;
- Where disclosure of personal data is required by law and where such disclosure is not protected by professional legal privilege and does not first require consent to be obtained;
- As part of audit or quality checks on our practice carried out by external firms or organisations. They may wish to audit/quality check your file and related papers for this purpose. It is a specific requirement imposed by us that these external firms or organisations fully maintain confidentiality in relation to any files and papers which are audited/quality checked by them;
- Where it is required by our regulators the Solicitors Regulation Authority or the Bar Standards Board; and/or
- Under the Proceeds of Crime Act 2002 which imposes a duty on lawyers to report certain information to the authorities, where, for example, it seems that some assets in your case were derived from a crime. If we have to make a report we may not be able to tell you that we have done so.
If we need to obtain any information about you from a third party for the purpose of assisting you we will only do so once you have provided us with your consent.
We ensure we have appropriate data sharing agreements in place before sharing your personal data with any other data controllers.
Your personal data is shared as is necessary, on a considered and confidential basis, with several external organisations which assist with processing your information. These organisations act on our behalf in accordance with our instructions and do not process your data for any purpose over and above what we have asked them to do. We make sure we have appropriate contracts in place with them. Sometimes your personal data is processed by these organisations outside the European Economic Area (for example, because they use a cloud-based system with servers based outside the EEA), and if so, we make sure that appropriate safeguards are in place to ensure the confidentiality and security of your personal data.
We do not share your data with external organisations for marketing their products or services. We do not sell your personal data to third parties under any circumstances, or permit third parties to sell on the data we have shared with them.