…Data Protection Act requirements for advocates

Home Advocates EH1 1RF Public law Infolaw Jurisdiction IT issues Miscellany


Contents of this section:

  1. Free software, legal and otherwise
  2. Data Protection for advocates (now separate page)
  3. Macs at the bar (now separate page)

2. Data Protection for advocates

The Data Protection Act 1998 substantially came into force on 1 March 2000. Since then, every advocate using a computer for work, even if only typing opinions or pleadings, has been regulated by the Act as a data controller and has been obliged to register as such. In practice, it is notorious that very few have done so.

The purpose of this page, accordingly, is to provide a simple introduction to registration requirements. For a fuller guide to the structure of the Act, see Derek O'Carroll's guide on the information law page. The English Bar Council have published, for the English Bar, useful explanations of the background and the practical consequences here and here.

1. So what does this cost?

Notification on the Data Protection Register is ú35 per year, tax-deductible and no VAT, and can be done online, using the standard form for advocates and barristers, here.

2. Do I need to notify when all I do on my laptop is word process pleadings?

Yes. If no client, and no opponent, is a living natural person it is possible you may not be processing personal data; otherwise there is no escape. When you draft a reparation summons, for example, you are storing personal data about the pursuer in terms of section 1 of the Act, and as this is hardly domestic or recreational none of the exemptions cover you: see the European Court decision in Lindqvist, 6 November 2003.

3. Do rights of subject access apply to personal data held by advocates?

This is highly unlikely, as the Act, per schedule 7 paragraph 10, provides "Personal data are exempt from the subject information provisions if the data consist of information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality as between client and professional legal adviser, could be maintained in legal proceedings."

4. Do I need to do anything to safeguard personal data held by me, for example against laptop theft or unauthorised access?

Yes. The seventh data protection principle provides "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data ". On notification, you are asked about this. As a bare minimum you need password protection on your laptop. Mac users: see this note .

5. And what if I don't use a computer for work at all?

The Act does apply to some paper records, but —given how advocates work with them— in reality these provisions are unlikely to apply (this was also the view of the English Bar Council, above).

6. OK, but in reality practically nobody registers or complies, nobody has yet complained, and the Faculty hasn't given or associated itself with any advice on registration. Does it matter?

Answer this one for yourself.

return to top

Home Home Advocates Advocates EH1 1RF EH1 1RF Public law Public law Infolaw Infolaw Jurisdiction Jurisdiction Miscellany Miscellany
Creative Commons License

Except as here noted,
the contents of this site may be used or reproduced under a
Creative Commons Attribution-ShareAlike Licence