You need a high level of transparency to comply with GDPR and the Data Protection Act 2018 (DPA).
In relation to data subjects this generally means you need to:
- tell people if you’re using their personal data
- provide them with a copy of it
There are exceptions, however, for:
- data in relation to which a claim to Iegal professional privilege (LPP) could be maintained in legal proceedings, and
- the duty of confidentiality to a client
LPP and client confidentiality override a data subject’s right of access and right to be informed under the DPA.
Legal professional privilege
Legal professional privilege (LPP) protects certain confidential communications from disclosure without your client’s permission. LPP is a right not of lawyers but of clients. An assessment of whether LPP applies often requires delicate and difficult balances to be drawn. For these reasons, it's critical that you take great care to advise clients on LPP appropriately.
There are two types of LPP:
- legal advice privilege
- litigation privilege
Legal advice privilege
Legal advice privilege protects communications between a lawyer and client made in connection with the giving or receiving of legal advice. This includes communications that form part of a continuum which aims to keep a lawyer and client informed so that legal advice may be given as required.
Litigation privilege protects communications between lawyers or their clients and any third party for the purpose of obtaining advice or information in connection with existing or reasonably contemplated litigation. For litigation privilege to apply, the communications must also be made for the sole or dominant purpose of conducting that litigation and the litigation must be adversarial rather than investigative.
There are narrow exceptions to LPP and it may also be waived by clients (explicitly or by implication).
Our practice note on legal professional privilege may help you decide if privilege applies.
Duty of confidentiality
The duty of confidentiality applies to all confidential information about a client's affairs, no matter how the solicitor came by that information. There are a small number of exceptions to the above which are discussed in the SRA guidance to rule 4 – confidentiality and disclosure, but in general you must keep your client’s information confidential unless the law or your client’s consent allows you to disclose it.
The duty of confidentiality continues beyond a solicitor ceasing to act for a client. In the case of a client dying, the right to confidentiality passes to the personal representatives of the former client.
If a solicitor obtains information relating to a prospective client, they may still be bound by a duty of confidentiality, even if the person concerned does not go on to instruct their firm.