The Legal Ombudsman (LeO), as a data controller, is mandated by data protection legislation to process personal and sensitive data safely and securely.

Under data protection legislation personal information we hold about individuals must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained and documented and not used in any way that is incompatible with those purposes.
• Relevant to the purposes it was originally collected for and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary.
• Kept securely.

We are registered with the Information Commissioner’s Office (ICO) to process personal and special categories of information under the Data Protection Act 2018.

Our registration number is Z1858613.

The Data Protection Act 2018 and General Data Protection Regulation (GDPR) 2016, both set out the reasons why organisations are able to collect and process personal information. 

The Legal Ombudsman is obliged to identify the lawful basis in which we are processing individuals’ personal and special categories (sensitive) data.

The Legal Ombudsman is lawfully able to collect and process certain personal information on a legitimate interest basis for business purposes only, this  includes special categories of data provided to perform our duty.

Personal data means information relating to a natural (living) person or data subject, which can be used to identify the person, for example:

• Name
• Identification number
• Social media posts
• Location data
• Online identifier.

Special category of personal data

This is information which is thought to be "extra sensitive" such as ethnicity, sexual orientation and religion.

Data controller 

This is the organisation that determines or decides the purposes, conditions, and means of the processing of personal data.

Processing

This means anything that is done to the personal data we hold. 

What information we collect

To enable the Legal Ombudsman to investigate your complaint, we collect detailed information about your case. This may be gathered through our online complaint checker, emails, our equality and diversity monitoring form, or other correspondence and information provided by the relevant legal service provider. We will only ask for information that we think is relevant to your case.

Examples of the personal and other information we may need include your:

• name
• address
• email
• phone number
• family circumstances, financial information and health information, depending on the nature of your case

We also record phone conversations you may have with our investigator or ombudsman during the investigation process. These recordings will form part of the complaint case file that we hold.

This information can be held in a variety of formats, including electronically on computer systems, in video and audio files, and sometimes paper records. Any paper records we receive are scanned onto our system and the original paper is securely destroyed.

How we use your personal information 

The information you share with us will mainly be used to talk to you about your complaint, investigate what has happened and share our findings with you and your legal service provider.

It is important to us that we provide a high standard of service, and we conduct regular surveys with both consumers and legal service providers to understand people's views on the service we have provided. We use an external research company to do this.

When you bring a complaint to us, your information is automatically added to the survey list. However, you have the right to withdraw your permission to be included at any time. Please tell your investigator if you wish to do this or contact us at enquiries@legalombudsman.org.uk.

The Legal Ombudsman feeds back to the legal sector and other stakeholders about the complaints we have seen, to help stop the same issues arising again and improve standards of service and complaints handling in the legal sector. This can involve drawing on information from individual cases, to highlight things that have gone wrong (and sometimes right). If we use your case in this way, we will ensure personal details are removed and anonymise the case so you can’t be identified.

There will be times when we are under a legal duty to share information. This includes, but is not limited to:

• disclosure under a court order
• sharing with the Ministry of Justice for inspection purposes
• sharing with the police for the prevention or detection of crime
• where there is an overriding public interest to prevent abuse or serious harm to others
• disclosure to a Regulator if we identify a situation of potential misconduct or if the information is requested.

When we can and cannot share evidence

When a complaint is brought to us, we contact the service provider and make them aware that a complaint has been referred to us about them. We share the personal details of the person making the complaint with them as part of this initial process.

We would usually share the evidence that is being relied on during our investigation as part of reaching our conclusion about the outcome of a complaint. We do this to be open and transparent, and because it is fair on the parties involved. We don’t share evidence that hasn’t been relied on.

Occasionally we may decide not to share evidence that we have relied on. This may include circumstances where:

• the document provided by the service provider is subject to a lien (a type of legal right or claim)
• there may be a legal rule or reason preventing the sharing of documents
• documents identify third parties, and we may need their consent
• there are personal or confidential documents that the other party should not see, such as bank statements and personal statements.
• one of the parties has asked us not to share their comments
• information is sensitive and accepted in confidence (under our Scheme Rule 5.24)
• legislation such as Data Protection Act 2018, UKGDPR, Legal Service Act 2007 does not permit its disclosure.
  
  

How we look after your information

As outlined above, your personal information may be held in a range of formats. These may be paper or electronic, including audio recordings and electronic databases. We hold these for specified periods of time as set out in our Policy on the Retention and Disposal of Records.

If you submit information through our online complaint form:

• Partially completed forms will be stored securely for 30 days after which they will be deleted if you have not completed the form.
• Completed forms will be stored securely on the website for 30 days, after which they will be deleted.
• We will hold and process your information in accordance with the General Data Protection Regulation (GDPR), in conjunction with the Data Protection Act 2018 as explained above.

If you send us documents by post, they will be scanned and posted by a third-party processor commissioned by the Legal Ombudsman.

Other purposes for collecting information from you

We use digital contact forms on our website to provide an accessible and efficient service for all our customers. We ask you to tell us what you’re contacting about so that we request only the information we need to answer your specific enquiry. We store this information electronically. If we need anything more from you, we will contact you to let you know.

Enquiries

Information we will ask for when you make an enquiry will include:

• your name
• email address
• a file reference number if you, or someone you are contacting us on behalf of, has an existing complaint with us.
• the name of your business or organisation if you are contacting us on its behalf.
• your constituent’s name if you are a Member of Parliament.
• brief detail about your enquiry.

For some enquiry types, you may have the option to attach one document.

Subject Access Requests, Freedom of Information requests and other data requests

When requesting information from us under the Data Protection Act 2018, UK GDPR, Freedom of Information Act 2000 or other legislation, we will ask you for information so we can process your request. This includes situations where:

• you are requesting information that we may hold about you, or your request is for someone who you are acting on behalf of;
• you are requesting information we hold as a public body.

The information we ask you for depends on the nature of your request, but may include:

• your name
• address
• email address
• phone number
• copies of identification
• summary of your request
• complaint reference number

When someone visits www.legalombudsman.org.uk we use Google Analytics to collect some standard information and details on visitor behaviour patterns. We do this to find out things such as number of visitors to parts of the site.

We collect this in a way which does not identify anyone. We will not associate any data gathered with any personally identifying information. If we do want to collect personally identifiable information through our website, we will be up front about it.

We will make it clear when we collect personal information and will explain what we intend to do with it.

Use of cookies
Cookies are small text files that are placed on your computer by websites you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to owners of the site.

You may delete and block all cookies from this site, but certain functionality of our site will not work. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Web chat
Communications from your web chat will be stored on the website server for 5 days, after which it will be deleted. The agent that you speak to at the time will also retain a copy of the webchat to make or add to your case file or complaint.

We run a regular programme of courses and events for the legal profession, as well as sharing information through a quarterly newsletter.

If you sign-up for one of these we will always be clear how we are going to use your information, and only use it for the services you have signed up to. We will also provide a way to opt out of these services.

The Data Protection Act gives you certain rights, including the right to:

• Request access to the personal data we hold about you, for example in records about your complaint with us (see "How to access your personal data" below).
• Request the correction of inaccurate or incomplete information recorded in records, subject to certain safeguards.
• Request your personal information to be transferred to other providers on certain occasions.
• Object to the use of your personal information. In certain circumstances you may have the right to:
  
  
  • "Object" to processing (sharing) of your information where this would be for a purpose other than the one you originally agreed to.
  • Challenge any decisions made without human intervention (automated decision making).
  • Ask us to restrict the use of your information where appropriate

We will always keep your information confidential and only share information when necessary. If we think something has gone wrong and there has been a breach of data security, we have procedures in place and will notify you and any applicable regulator in line with our legal requirements.

How to access your personal data

To access personal data we hold about you, please visit our contact us page, where you can make a request. If you can't make your data request using our online forms, please write to us at the address on the contact us page.

The Information Commissioner’s Office (ICO)

The ICO regulates the Legal Ombudsman under data protection and freedom of information legislation. 

If you make a data request but are unhappy with our response, or you think we are not processing your personal data in line with the law, you can complain to the ICO. There is more information about how to do this on the ICO's website (this is an external website and will open in a new browser tab).

• Information Commissioner's Office 
  Wycliffe House 
  Water Lane 
  Wilmslow 
  Cheshire, SK9 5AF 
  
  
• Telephone: 0303 123 1113 (local rate)
• Telephone: 01625 545 745 (national rate)
• Email: icocasework@ico.org.uk
• Website: https://ico.org.uk/