Privacy Notice

This section is for our service users and contractors

Our privacy notice takes the form of FAQs (below) to make it easy for you to find the information you need.

We are committed to ensuring that our data processing activities are fully compliant with the data protection laws and the changes introduced by the General Data Protection Regulation (‘the GDPR’).

We are the ‘Data Controller’, which decides how we process your personal information and for what reasons.

Our Privacy Notice explains what we will do with your personal information while we have it in our possession and how we keep it safe.

We were set up by the Legal Profession and Legal Aid (Scotland) Act 2007 (“the 2007 Act”). We act as the first point of contact for all legal complaints about Scottish legal practitioners, including solicitors, advocates and commercial attorneys. 

Our aim is to enable complaints to be resolved quickly and effectively.     

We are the single gateway for complaints. We investigate and resolve complaints about inadequate professional service. We refer conduct complaints to the appropriate professional bodies, i.e. the Law Society of Scotland, the Faculty of Advocates and the Association of Commercial Attorneys. They then deal with any disciplinary matters.  We also have oversight of complaint handling across the legal profession and have a role in promoting and advising on good complaint handling.

We monitor, prepare and publish reports on trends in practice about how complaints are dealt with by the legal profession.  We also prepare and share statistical information about complaints, in an anonymised way, to inform the legal profession and our service users about complaints.

The SLCC’s Consumer Panel is a statutory Committee made up of representatives from various consumer organisations. 

The Consumer Panel has an advisory role and does not have any statutory decision-making responsibilities on complaints.  For the Panel to assist us in taking into account the interests of consumers , we may need to share statistical and anonymised information about complaints with the Panel.

If you have any questions about how we use your personal information, or you would like more information, you can contact our Data Protection Officer

We may contact you by post, email or telephone when we are dealing with a complaint. 

We might also contact you when we are carrying out research, trend analysis or compiling statistics and reports about legal complaints. 

We provide training opportunities in relation to complaint handling. We may contact you to offer such services if we identify this might be needed. 

If you are a contractor, we will contact you about the service you provide. We contact stakeholders to seek their views, or provide information on our work.

If you want us to contact you in a particular way or you do not want us to contact you after we've dealt with a complaint, please let us know.

Personal information relates to a living individual who can be identified from that information.  Identification can be by the information alone or along with any other information we hold.

Before we can process personal information about you, we must ensure that our use of your personal information is lawful.

The GDPR sets out a number of conditions to make sure that we can process your personal information lawfully. The conditions are:

  1. Consent, i.e. you agree to us using your personal information.
  2. Performance of a contract, e.g. to provide services or goods.
  3. Legal obligation, e.g. we are required by law to deal with legal complaints, to monitor trends, prepare and publish reports and to share information with certain specified organisations.
  4. Vital interests, e.g.to protect someone’s health/life.
  5. Performance of a public task or official authority, e.g. public functions or powers set out in law. 
  6. Legitimate interest, i.e. where processing is necessary and information will be used in a way which would reasonably be expected. 

You will find detailed information about the work that we do and the legal basis that we rely upon to use your personal information in our Your data and the SLCC video and information.

Complaints must be made in writing.  Our forms ask you for personal information. This includes your name and contact details, together with information about your complaint and who you are complaining about.  This information will be held on our computerised filing system.

If you are a practitioner or a firm complained about, we are likely to receive personal information about you directly from the complainer.  We may ask you for personal information, or ask your firm’s Client Relations Manager for information about the complaint (as the person responsible for dealing with a complaint involving the firm).  This information will be held on our computerised file.

We are also likely to record personal information about you, such as your name and contact details and information about the complaint and who you are complaining about, when we speak to you on the telephone.  This information may be recorded by us, even before a formal complaint has been made to us.  We do this so we know where to send a complaint form to (if you haven’t had one already), or if you want more information about the complaints process.  It is helpful for us to record some information about you, in case you phone us again and so we can file your complaint form appropriately on receipt. 

We also receive personal information from individuals who provide goods and services to us, for the purposes of performance of a contract.  We have separate contracts which set out how we use this personal information.

Sometimes you might need to provide us with information which is particularly sensitive, e.g. medical information.  We have additional checks and balances in place to make sure we deal very carefully with this type of information, to make sure it is kept as secure as possible. 

‘Special Category’ personal information relates to:

  • health
  • ethnic origin
  • political opinions
  • religious and philosophical beliefs
  • trade union membership
  • biometric data
  • sexual orientation

There are also specific safeguards in place about how we are to manage criminal offence and convictions information.  As we are likely to need to process this data for the investigation of a complaint about a criminal case, we will make sure that we are aware of our duties regarding the security of that information.

If you are under the age of 16, we have to take extra care with the personal information you provide to us.  We have a separate Privacy Notice (see Under 16s’ Privacy Notice) which explains how we deal with your personal information.

You can visit our website without giving away any personal information.  We use Google Analytics and Cookies to improve our service user experience and analyse how our website is used.  You can choose whether or not these cookies are used.

Google Analytics will anonymise part of your IP address before storing it.  The IP address will still give us an approximate location for you.  Otherwise, most of the information collected is anonymous traffic data, including browser information, device information and language.  We do not collect additional information such as your age, gender, bank details etc and do not use information on this from elsewhere in Google Analytics.  The information we do collect is used to provide an overview of the visitors to our website, where they’ve come to the website from and how they use it.  We do not use the information for any additional purpose.

We will use the email address you’ve entered in the online complaint form to send you confirmation emails. 

A full list of the cookies we use is on our website.

When we assess the eligibility of a complaint, investigate and/or determine service complaints, we do not need your consent to use your personal information as we have a legal obligation to carry out this work. The 2007 Act sets out how we should deal with complaints.

We might also have a legitimate interest to use your personal information in circumstances where we do not have a legal obligation, but where your personal information is used in ways that you would reasonably expect but has a minimum impact on your privacy rights.

Where we receive information from you in performance of a contract, we do not require consent from you to use your personal information.

In all other circumstances, we will require your consent before we can process your personal information.

We must provide you with specific information if we need to obtain your consent.  Where we ask you for consent to process personal information, it is important that consent is given freely.  Consent must be specific, informed and unambiguous.  

This also includes the right to withdraw your consent at any time, should you wish to do so.  If you want more information about when we might need your consent or about your right to withdraw consent, please contact our Data Protection Officer.

If you choose not to give us information which we ask you for, it might not be possible for us to deal with matters – this may mean we cannot process your complaint, or that we cannot work with you as a contractor.  Feel free to talk to our Data Protection Officer about this if you are worried or have any questions.

If your personal information changes (for example your name, address and contact details) please contact our enquiries team to tell us about the changes as soon as possible.  We'll update the records that we hold about you.

We make sure we:

  • keep personal information up to date,
  • store and destroy it safely,
  • only collect or keep information we need,
  • protect personal information from loss, misuse, unauthorised access and disclosure, and
  • ensure we use appropriate technical measures to keep information safe.

We ask that complaints are submitted on a complaint form which can be filled in online, emailed or posted to us.  When we receive the complaint form, we will create a file on our computer system which holds your personal information.  

Contractor information will be held securely in electronic or paper form, with access limited to those staff who need it (who the service is being provided to, finance, etc.)

When you call us with an enquiry, we will ask you for your name and contact details, which we may record in our computerised case management system.  If your enquiry relates to making a complaint, we might also ask you for additional information about you and/or the name of the individual(s) or firm being complained about. 

When we deal with a complaint, we will usually disclose the complainer's name, contact details and the identity of any person acting on the complainer's behalf, if applicable, to other persons or bodies who may be involved in the investigation of the complaint. This could include the practitioner, firm or professional body. 

We will also usually disclose information provided to us about the complaint to other persons or bodies who may be involved in the investigation.  This information may contain the identity of other individuals who were involved in the matter being complained about. 

Personal information about any individual who is not involved in the complaint will not be disclosed or will be anonymised, where possible.

We may use your personal information to compile statistics, carry out research and analysis as part of our general oversight function.  We will not publish your personal information unless we have sought your consent to do so.

We may be share any of the information you provide to us where we are required to do so by law or to assist in the investigation of any alleged criminal offence.

The information we receive about a complaint will be kept in our computerised files for the purpose of investigating and deciding the complaint. Investigations can take a long time to complete, so it is not possible to say exactly how long we might keep your information for. 

We have a Retention and Destruction Policy, which explains how long we keep information for, once a complaint has been closed.

Personal information provided by our contractors will be retained by us in accordance with the terms of the contract and in accordance with our retention policy.

We operate in the UK and all of our computers are held in the UK.  In order to allow us to carry out our legal obligations or duties set out in this Notice, we may need to send your information to businesses outside the UK.

If you complete an online complaint form, the emails sent will be operated through Mandrill.  Mandrill processes data outside the EU, but is certified under the Privacy Shield scheme.  We have a data processor agreement with Mandrill.

If you sign up to our email newsletter, the data you provide us will be sent to Mailchimp.  Mailchimp processes data outside the EU, but is certified under the Privacy Shield scheme.  We have a data processor agreement with Mailchimp.

If you agree to Google Analytics tracking, the data may be processed outside the EU.  Google may process data outside the EU, but is certified under the Privacy Shield scheme.  We have a data processor agreement with Google.

If you are involved in a complaint, your personal information will be accessed by our staff. This is so that they can assess whether the complaint should be investigated by us and/or by the Law Society of Scotland, the Faculty of Advocates or the Association of Commercial Attorneys. 

As part of the eligibility, investigation or determination processes, we might need to share information about you and the complaint with external Reporters, who are contractors employed by us, to prepare reports on complaints.  Our Board Members are also involved in the complaints process, so your personal information and information about the complaint will also be shared with them.

We also use Mediation as a way of resolving complaints. For this, we need to share information with external Mediators who are contracted by us for this process.

If we decide that a complaint has a conduct element to it, we will pass the information we have received about the complaint to the Law Society of Scotland, the Faculty of Advocates or the Association of Commercial Attorneys to carry out the investigation.

For all complaints received, we will notify the relevant professional body of the decision we have made on those complaints, i.e. if it has been accepted for investigation or rejected.  We email copies of the completed complaint form and the decision.

Where we issue a notice that the complaint is premature or where we issue an Eligibility Decision Report or a Determination you have a right of appeal against the decision to the Court of Session. In these circumstances we may share your personal information with our legal advisers for the purposes of opposing the appeal.

We are also legally required to share information about service complaints that have been upheld with the Scottish Legal Aid Board (“SLAB”).  Your name and information about the complaint will be sent to “SLAB” as part of this legal obligation.

If required, we might need to share information to assist in any investigation into alleged criminal or illegal conduct.

We regularly review the personal information we hold, so we know and can provide details of our data processing activities.  We have identified why we have personal information, whose information it is, what information we process, and when and where the processing occurs.  Now we have this information, we can make sure that we keep it safe.

We have various policies in place regarding the security of information, and what steps we need to take if there is an information security breach.  Our Business Continuity Plan explains the steps that we will take in the event of a serious situation, which could result in personal information being lost, destroyed or inaccessible, e.g. in a fire, flood or a computer hacking situation.

The nature of our business is one which requires a culture of confidentiality.  The 2007 Act requires us to keep information about complaints (including personal information) confidential, unless the law requires us to share information or where we need to do so in order to carry out our role. 

We have a regularly reviewed Risk Register, which helps us analyse the risks presented by our processing. We use this to assess what steps we need to take to keep information safe,

Our building and storage facilities are appropriately secured, e.g. controlled entry, locked doors, locked cabinets etc. Our employees are regularly trained on data security, how to avoid data breaches and their confidentiality obligations.

Our computer systems are safeguarded with firewalls and antivirus software, we have regular backups of data. We use appropriate passwords and encryption of devices, such as USB sticks. 

We will retain your personal information for the purposes of the employment relationship.

Your personal information will be stored in line with our Records Management policy and our Retention and Destruction Schedule.

We respect your privacy rights.  Where we hold personal information about you, either in connection with a complaint or otherwise, in certain circumstances, you have rights about how we hold that information.  Your rights include the right to:

  • request information about or restrict processing of your personal information.
  • request correction of inaccurate or incomplete personal information.
  • have your personal information erased (this is known as ‘the right to be forgotten’).
  • request access to your personal information.
  • request that your personal information is moved, copied or transferred(this is known as ‘the right of data portability’).
  • withdraw consent previously provided.

If you wish to know more about how to exercise your rights, or you wish to make a request about the personal information which we hold, please contact our Data Protection Officer.  You can also find more information on the ICO’s website.

You are entitled to ask us for a copy of the personal information that we hold about you.  To do this, you can email or write to us.  We will usually respond within 1 month, but if the request is complex or there is a lot of information, we have up to 3 months to respond.

There is usually no charge for requesting your personal information.

There are some circumstances when we don’t have to provide you with the information that you have asked for, or when we might charge a fee. For example, if the information also includes information about someone else and we do not have their permission to give it to you, and/ or the request is unfounded or excessive.

If we refuse to provide your personal information, we will explain why.  If you are not happy, you have the right to contact the ICO.  You must do this within one month.      

This Privacy Notice was created on 24 May 2018.  Its terms are regularly monitored and formally reviewed at least every two years.

We can decide to change our Privacy Notice at any time without having to let you know first.  If we make any changes or plan to use personal information for a new purpose, details will be posted on our website.  If we think that it's necessary to tell you directly about changes which we have made, we'll contact you.

If you are unhappy about the way that we have used or processed your personal information, you can contact our Data Protection Officer, who will try to help you with your concerns.

If you remain unhappy, you can make a complaint to the Information Commissioners’ Office (“the ICO”), which is the UK’s Supervisory Authority for data protection issues.

The ICO can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Phone: 0303 123 1115
Email: casework@ico.org.uk
Web: ico.org.uk

In this section