Privacy Notice
Purpose
This privacy notice sets out the standards that you can expect from the Legal Services Board (LSB) when we request or hold personal information ('personal data') about you; how you can get access to a copy of your personal data; and what you can do if you think the standards are not being met.
About personal information
Personal data is information about you as an individual. It can be your name, address or telephone number. For further information about the types of information we process please refer to the applicable headings below:
Personal data processed under the LSB's regulatory remit
Employees
Applicants to the LSB
Individuals contacting the LSB
Visitors to our website
Access to personal information about you
Complaints procedure
Personal data processed under the LSB’s regulatory remit
Our published list of disqualified persons
The Legal Services Board (LSB) is required under section 100 of the Legal Services Act 2007 (‘LSA 2007’) to maintain and publish lists of those who have been disqualified in the provision of one or more legal services.
This applies to persons who have been disqualified by a licensing authority under section 99 of the LSA 2007.
Our published restricted interest list - objections and conditions
The Board is also required under schedule 13, paragraph 51 of the LSA 2007 to keep and make available a list of persons to whom a relevant licensing authority has:
- objected to holding of a restricted interest in a licensed body, or
- imposed conditions on their holding of a restricted interest in a licensed body.
What information does the LSB publish?
The LSB will publish the name and date of birth of persons who are entered onto any of the above lists once it has been notified in accordance with the LSA 2007 by the relevant approved regulator or licensing authority.
Why do licensing authorities collect this information and why does the LSB publish it?
It is in the public and the consumer’s interest that information about people who are disqualified or in some way restricted from involvement in the provision of legal services is made available. The LSB is also expressly obliged under the LSA 2007 to publish its lists of disqualified persons and to ensure that its restricted interest list is made available to every licensing authority.
What happens to this information when it expires or the circumstances of the person listed change?
In line with Information Commissioner’s Office (ICO) guidance on data protection law, once a record on any of the lists has expired or is no longer valid for whatever reason, it will be permanently deleted and securely disposed of from all records kept by the LSB.
For further more detailed information and for access to the lists, please click on the link below:
LSB Public Registers
LSB Research
The LSB regularly carries out research as part of its regulatory function. In most cases any personal data collected for research from such individuals as members of the public, or persons regulated by the approved regulators that are overseen by the LSB, will be carried out by a third party who will then pseudonymise the data before it is shared with the LSB. The LSB will only engage with third parties who can provide assurances that they have in place appropriate safeguards that enable them to collect personal data in full compliance with data protection laws.
Where however the LSB does collect personal data either directly from data subjects or from another data controller (such as an approved regulator), the default position will be for the LSB to pseudonymise that data at the point of collection. On rare occasions, and only when it is considered necessary, the LSB may retain personal data for research purposes, but only where it can do so in full compliance with data protection laws.
If necessary the LSB may additionally carry out a data protection impact assessment and record the safeguards in place to ensure that the data is held securely. The types of personal data that the LSB might retain and the period during which that data is held will depend on the nature of the research but we will never hold the data for longer than necessary.
Further information on the LSB’s processing of personal data for the purposes of the LSB’s regulatory functions, including any current personal data processing for research, can be found in the link below:
Register of personal data processed under the LSB’s regulatory functions
Employees
The LSB collects and processes personal data relating to its employees to manage the employment relationship. The LSB is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
What information does the LSB collect?
The LSB collects and processes a range of information about you. This includes:
- your name, address and contact details, including email address and telephone number, date of birth and gender;
- the terms and conditions of your employment;
- details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the LSB;
- information about your remuneration, including any benefits such as pensions or insurance cover;
- details of your bank account and national insurance number;
- information about your marital status, next of kin, dependants and emergency contacts;
- information about your nationality and entitlement to work in the UK;
- information about your criminal record;
- details of your schedule (days of work and working hours) and attendance at work;
- details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
- details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
- assessments of your performance, including objectives, appraisals, performance reviews, peer reviews, performance improvement plans and related correspondence;
- information about medical or health conditions, including whether or not you have a disability for which the LSB needs to make reasonable adjustments; and
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
How does the LSB collect your data?
The LSB may collect your personal data in a variety of ways. For example, data might be collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as your annual LSB choices form); from correspondence with you; or through interviews, meetings or other assessments.
In some cases, the LSB may collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.
Why does the LSB process your personal data?
The LSB needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer your LSB choices, (which includes your pension and other benefits) and life assurance entitlements.
In some cases, the LSB needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.
In other cases, the LSB has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the LSB to:
- run recruitment and promotion processes;
- maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
- operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
- operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
- operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
- obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
- operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the LSB complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
- ensure effective general HR and business administration;
- provide references on request for current or former employees;
- respond to and defend against legal claims; and
- maintain and promote equality in the workplace.
Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities).
Where the LSB processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that the LSB uses for these purposes is anonymised or is collected with the express consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.
Who has access to data?
We know how important it is to protect your privacy and to comply with data protection laws. We will safeguard your personal data and will only disclose it where it is lawful to do so.
Your information will be shared internally with members of the LSB’s HR team, your line manager, the Senior Leadership Team and IT staff if access to the data is necessary for performance of their roles. Your information may also, where necessary, be shared with other colleagues at the LSB, including but not limited to your peers and the Board.
The LSB also shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service.
The LSB also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits including but not limited to pensions and life assurance, Childcare Vouchers and the provision of occupational health services. The LSB will also share your data with its Remuneration and Nominations Committee, which comprises of both independent members and LSB Board members. We may also share your data with our auditors in accordance with carrying out their duties.
Your data is highly unlikely to be transferred to countries outside the European Economic Area (EEA), however where this may occur, the LSB will specify the purpose for the transfer and the legal basis on which your data will be processed. Where necessary the LSB may decide to seek your explicit consent (see below) to transfer your data outside the EEA. At all times, your data will only be transferred outside the EEA on the basis of adequate assurances received from those receiving your data. This may take the form of a declaration of adequacy, binding corporate rules or other safeguards.
Collecting your data lawfully - do we need your consent?
The LSB will normally rely on one or more of a number of legal bases for collecting and processing your personal data. It will not therefore be necessary to seek your consent on every occasion. Further information on the legal bases that the LSB relies on for matters where it regularly collects your personal data (including but not limited to the matters referred to under, “Why Does the LSB process your personal data?” above), can be found within the following link:
In certain circumstances the LSB may decide that it will only process your personal data if you give express consent. This will normally only occur where your personal data cannot be processed in reliance of another legal basis. In such limited circumstances you will be asked to sign a declaration of consent. You may withdraw your consent at any time by signing a withdrawal form which will be provided to you when we request your consent. Where your consent is sought, you will therefore receive the two forms simultaneously.
How does the LSB protect data?
Where is your personal data stored and is it secure?
Your data will be stored securely in a range of different places, including your manager’s and your own personal “documents” folder on Wisdom, in the LSB's HR Wisdom folder and in hard copy HR files. On a short term basis, correspondence containing your personal data will also be stored in the LSB's email system.
The LSB takes the security of your data seriously. The LSB has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. The LSB has data protection and other information security policies which are available to staff within our database. Where the LSB engages third parties to process personal data on its behalf, they do so in accordance with agreed terms which reflect the legal obligations of both the LSB and those third parties under current data protection laws. Third parties who process your personal data are accordingly under a duty of confidentiality and are obliged to implement appropriate technical measures to ensure the security of your data.
For how long does the LSB keep data?
The LSB will only retain your personal data for as long as necessary, however the period of retention will vary depending on the types of data held and the purposes for which it is retained. Further information on the various retention periods that the LSB adheres to are contained with the LSB’s Data Retention and Disposal Policy, which is available to staff within our database.
What if you do not provide personal data?
You have some obligations under your employment contract to provide the LSB with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the LSB with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the LSB to enter a contract of employment with you. If you do not provide other information, this will hinder the LSB's ability to administer the rights and obligations arising as a result of the employment relationship efficiently.
Your rights
As a data subject, you have a number of rights. You can:
- access and obtain a copy of your data on request;
- require the LSB to change incorrect or incomplete data;
- require the LSB to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
- withdraw your consent where this is the basis on which your data has been processed; and
- object to the processing of your data where the LSB is relying on its legitimate interests as the legal ground for processing.
If you would like to exercise any of these rights, please contact the LSB’s data protection officer using the details at the bottom of this privacy notice.
If you are dissatisfied with the data protection officer’s response to your request you can complain in accordance with our ‘Complaints Procedure’, which is set out at the bottom of this privacy notice.
Applicants to the LSB
As part of any recruitment process, the LSB collects and processes personal data relating to job applicants. The LSB is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
What information does the LSB collect?
The LSB collects a range of information about you. This includes:
- your name, address and contact details, including email address and telephone number;
- details of your qualifications, skills, experience and employment history;
- information about your current level of remuneration, including benefit entitlements;
- whether or not you have a disability for which the LSB needs to make reasonable adjustments during the recruitment process;
- information about your entitlement to work in the UK; and
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
The LSB may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment such as written tests or presentations.
The LSB will also collect personal data about you from third parties, such as references supplied by former employers, if you are successful in your application for employment at the LSB.
Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).
Why does the LSB process personal data?
The LSB needs to process data to take steps at your request prior to entering into a contract with you. It may also need to process your data to enter into a contract with you.
In some cases, the LSB needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.
The LSB has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the LSB to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The LSB may also need to process data from job applicants to respond to and defend against legal claims.
The LSB may process information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.
Where the LSB processes other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes.
If your application is unsuccessful, the LSB may keep your personal data on file in case there are future employment opportunities for which you may be suited. The LSB will ask for your consent before it keeps your data for this purpose and you are free to withdraw your consent at any time. If your consent is requested we will send you a consent form, together with a blank consent withdrawal notice.
Who has access to data?
Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.
The LSB will not share your data with third parties, unless your application for employment is successful and the LSB makes you an offer of employment. The LSB may then share your data with former employers to obtain references for you, and any other third parties who may need to receive notification of your employment.
The LSB will not transfer your data outside the European Economic Area.
How does the LSB protect data?
The LSB takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties. The LSB has data protection and other information security policies which are available to staff within our database.
For how long does the LSB keep data?
If your application for employment is unsuccessful, the LSB will hold your data on file for six months after the end of the relevant recruitment process. If you agree to allow the LSB to keep your personal data on file, the LSB will hold your data on file for a further three months for consideration for future employment opportunities. At the end of that period, your data will deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment by our HR team. The periods for which your data will be held are set out above within the privacy notice for employees of the LSB.
Your rights
As a data subject, you have a number of rights. You can:
- access and obtain a copy of your data on request;
- require the LSB to change incorrect or incomplete data;
- require the LSB to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
- object to the processing of your data where the LSB is relying on its legitimate interests as the legal ground for processing.
If you would like to exercise any of these rights, please contact the LSB’s data protection officer using the details at the bottom of this privacy notice.
If you are dissatisfied with the data protection officer’s response to your request
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to the LSB during the recruitment process. However, if you do not provide the information, the LSB may not be able to process your application properly or at all.
People who contact the LSB
The LSB receives regular enquiries and requests for information from, among others, members of the public, authorised persons and representatives of third party organisations. For further information on how to make an enquiry, please click on the link below:
Enquiries web page
When we receive an enquiry by email, we file a copy of the email, together with our replies and subsequent correspondence, within a designated folder in our electronic database. Any enquiries which are made to us by telephone are recorded as an attendance note and stored in the same way as emails. Hard copy documents are scanned to our database and the originals are destroyed.
We will only use the personal information we collect in the course of an enquiry to provide a response. We may share your personal information internally with colleagues at the LSB in order to do this, and we have internal policies in place to ensure that your personal information is handled carefully. We will never share your personal information with third parties unless we obtain your consent to do so. If we consider that your enquiry should be referred to another individual or organisation, we will assist you by providing you with the information you need to contact them yourself. We do compile and publish statistics showing information like the number of enquiries we receive, but not in a form which identifies anyone.
We will keep personal information contained in our database in line with our data retention and disposal policy. This means that, once we consider that we have dealt with your enquiry in full we will delete your information from our database. However, if your enquiry includes a complaint about an approved regulator, we will retain your information for a longer period. If we notice a common issue within the enquiries we retain, we may undertake a specific review of that issue and take further action with the approved regulator if required. We will notify you if further action is contemplated and we will seek your consent for your personal information to be shared with the approved regulator. If you do not want your information to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint about an approved regulator on an anonymous basis. We will never hold your information for more than 6 years.
Visitors to our website
We use Google Analytics to collect information about how people use this site. We do this to make sure it is meeting its users’ needs and to understand how we could do it better.
Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. We do not collect or store your personal information (eg your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.
Use of cookies by the LSB
You can read more about how we use cookies on our Cookies page.
Access to personal information about you
You can find out if we hold any personal data about you by making a ‘subject access request’. If you wish to make a subject access request, or if you require any assistance in completing your request, please contact:
Board Secretary, Legal Services Board One Kemble Street London WC2B 4AN
boardsecretary@legalservicesboard.org.uk
Telephone: 020 7271 0070
Role of the Data Protection Officer (DPO)
The GDPR introduces a duty for the LSB, as a public authority, to appoint a data protection officer (DPO). DPOs assist organisations to monitor internal compliance, inform and advise on data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and act as a contact point for data subjects and the supervisory authority (the ICO). The DPO is an expert in data protection, adequately resourced, and reports to the highest management level. The LSB’s DPO is Holly Perry, Head of Corporate Services: holly.perry@legalservicesboard.org.uk
Complaints procedure
Stage 1
If you are dissatisfied with the LSB’s response to your request for information, you may discuss the decision with the person who dealt with your request. They will often be in the best position to understand your situation and give you an explanation as to what has happened.
Stage 2
However, if you are not satisfied with the response you receive, you may submit your complaint in writing to the LSB’s Chief Executive, either by e-mail to Neil.Buckley@legalservicesboard.org.uk or by post to the following address:
Chief Executive
Legal Services Board
One Kemble Street
London
WC2B 4AN
The Chief Executive will call for a full report to see whether you have received fair treatment. The Chief Executive will advise you in writing of the outcome of your complaint.
Stage 3
If you are dissatisfied with the Chair’s decision, you have the right to apply to the Information Commissioner for a decision as to whether the LSB has dealt with your request for information in accordance with the requirements of the Freedom of Information Act. An application may be made to the Information Commissioner’s Office by post to the following address:
Information Commissioner’s Office
Casework and Advice Division
Wycliffe House,
Water Lane, Wilmslow
Cheshire SK9 5AF
The Information Commissioner’s telephone help line is 08456 306060 or 01625 545745. The ICO’s website is www.ico.gov.uk. Information on complaints can be accessed at: http://www.ico.gov.uk/complaints/data_protection.aspx.
Changes to this statement
If this privacy statement changes in any way, we will place an updated version on this page.
Regularly reviewing this page ensures you are always aware of the information we collect, how we use it, and under what circumstances, if any, we will share it with other parties.
Accessibility