Introduction
This Privacy Policy explains how we manage personal information. It also describes your rights to access and correct personal information we hold about you, and how you can make a complaint about our management of your personal information. This is in addition to our obligations of confidentiality to clients and other parties arising from sources other than the Privacy Act.
Application of this Policy
This Privacy Policy only applies to some of the personal information we manage. It only applies to personal information we manage for the purposes of or in connection with our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act).
Other personal information we manage remains excluded by applicable exemptions in the Privacy Act.
Personal information: what we collect
Types of personal information
We collect your contact and identity details, financial information and case related information about you and any relevant entity or person. This may include sensitive information.
The types of personal information we may collect includes:
- Identity information: name, date of birth, gender, signature, photographic identification, offices or directorships held;
- Contact information: residential and postal addresses, email addresses, telephone numbers;
- Professional and business information: occupation, employer, job title, professional qualifications, business holdings and structures;
- Financial information: bank account details, billing information, payment card details;
- Matter-related information: information relevant to your legal matter or the legal matter of our client;
- Transaction information: details of services provided to you or your organisation;
- Communication records: records of correspondence and communications with you;
- Website and technical data: IP address, browser type, device information, pages visited, cookies (see section 8);
- Recruitment information: employment history, qualifications, references, right to work status, background check results; and
- Sensitive information: including sexual orientation, racial and ethnic origin, political beliefs, religious affiliation, criminal record, and health information.
Identity verification and the AML/CTF Act
We may be required to verify your identity and collect certain information under the AML/CTF Act when we provide designated services. Identity documents might also be required for other services such as court matters, real property transactions and asset dealings.
This includes collecting identification documents and information about the source of funds and beneficial ownership of entities.
How we collect personal information
Sources of information
We collect information directly from our clients, from other lawyers, government sources or public sources such as registers or the internet.
Direct collection
Where reasonable and practicable, we collect personal information directly from you. This may occur when you:
- engage us to provide legal services;
- respond to communication with us or engage a solicitor or agent to do so;
- contact us by telephone, email, post or in person;
- complete forms or provide documents to us;
- visit our website or use our online services; or
- apply for employment with us.
Indirect collection
We may also collect personal information about you from third parties, including:
- our client(s), where we collect information in the course of providing legal services;
- other parties to legal proceedings or transactions and their lawyers;
- witnesses of fact, expert witnesses, health care providers and hospitals;
- courts, tribunals, law enforcement and government agencies;
- publicly available sources, including public registers, websites and social media;
- referrers who introduce you to us or lead agencies and advertising sites;
- recruitment agencies and previous employers (for job applicants); and
- identity verification, commercial data brokers and background check service providers.
Anonymity and pseudonymity
If you are a client, you have the option of requesting to deal with us anonymously or by using a pseudonym. However, in most cases this is not lawful nor practical for legal services. If you do not provide us with the personal information we request, we may not be able to provide you with legal services or respond to your enquiry.
Why we collect personal information and how we use it
We collect, hold, use and disclose personal information for the primary purpose of providing legal services to our clients, complying with regulatory and insurance obligations and operating our legal practice.
Secondary purposes include financial management, system improvement, enforcement of our right to payment and managing the relationship between our firm and former clients once the retainer has concluded.
Primary purposes
This includes:
- providing legal advice and representation to you or to our client(s);
- managing client matters and files;
- conducting legal research and investigations;
- preparing and reviewing legal documents;
- communicating with you and other parties;
- billing and collecting fees, including pursuit of our rights under a Costs Agreement or retainer;
- complying with our legal, professional and insurance obligations; and
- administering and managing our firm.
Secondary purposes
We may also use and disclose personal information for secondary purposes that are related to our primary purposes, including:
- maintaining and developing our relationship with you;
- quality assurance and improvement of our services, including training our AI models or those of our AI providers (subject to our obligations of confidentiality to you);
- training and professional development;
- ongoing Customer Due Diligence as required by the AML/CTF Act;
- training AI or automated systems including AI development by our vendors with appropriate confidentiality safeguards in place;
- enforcement of our right to payment of fees;
- internal reporting and analysis; and
- risk management and insurance purposes.
Disclosure of personal information
We may disclose personal information to third parties to facilitate the purposes of collection noted in section 4.
These purposes include disclosure to parties to proceedings or transactions and their representatives, to Courts, government and regulatory agencies as may be necessary or appropriate to establish legal rights and to progress transactions in which we are instructed.
We also disclose information to third parties (such as data storage or archiving companies, our regulators or our insurers) who hold or process information for us.
Your personal information and confidential data is held by us subject to our duty of confidentiality under the Australian Solicitor's Conduct Rules (ASCR) and any applicable undertakings or court rules. We may disclose personal information to third parties subject to those obligations and for the purposes described in this Privacy Policy, including:
- to discharge our professional obligations to you or to our clients or in the reasonable execution of our instructions;
- to comply with our legal obligations or in answer to a compulsory notice such as a subpoena or warrant, or to disclose information under the AML/CTF Act, Criminal Code(s), Legal Profession Act or other relevant legislation;
- to barristers, mediators, expert witnesses, investigators and consultants and other legal practitioners engaged to act for you (and/or our client) or in relation to the matter;
- other parties to legal proceedings or transactions as instructed, reasonably necessary or required by law;
- courts, tribunals, government agencies and regulators;
- our professional indemnity insurers;
- a Costs Assessor in the event that an assessment is ordered or reasonably necessary;
- service providers who assist us to operate our business (including IT providers, AI providers, document management providers, and marketing service providers);
- related entities;
- as permitted under the ASCR confidentiality exceptions; and
- any person you expressly or impliedly authorise us to disclose information to.
Overseas disclosure
We will disclose information to overseas recipients where this is reasonably necessary to progress our instructions (dealing with a company with an overseas office, for example).
We may disclose personal information to recipients located outside Australia where reasonably necessary or convenient to facilitate the purposes of collection, holding, use and disclosure of information stated in sections 2 and 5 of this policy.
The following circumstances are common examples when that may apply:
- where your matter involves overseas parties or overseas proceedings;
- to overseas law firms or legal practitioners engaged in a matter;
- to our staff, staff of a related entity or contractors if working or travelling overseas;
- to parties such as regulators and auditors who may use overseas processors or offices;
- to service providers whose systems or servers are located overseas (including cloud storage, AI and IT service providers if we consider that the confidentiality arrangements that will apply to such information is sufficient); and
- where you instruct or authorise us to do so.
Cross-border disclosure of personal information
Countries where personal information may be disclosed include: United Kingdom, United States, New Zealand, Singapore.
Security of personal information
Security measures
We hold your personal information using a system designed to protect against data breaches, however like all data security systems, risks may only be mitigated but not eliminated. It is our practice to require our storage service providers to be reputable.
Retention and destruction
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and professional obligations and to ensure that pertinent evidence remains available if reasonably required.
Third party websites
Our website may contain links to third party websites, such as payment processors. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.
Access and correction
We take reasonable steps to ensure that the personal information we use or disclose is accurate, complete and up to date, having regard to the purpose of the use or disclosure.
We have procedures in place for dealing with and responding to requests for access to, and correction of, the personal information held about you. Your right to request access may arise under the Privacy Act, your retainer with us, the Legal Profession Act or the common law.
In most cases, we expect that we will be able to comply with your request. However, if we do not agree to provide you access or to correct the information as requested, we will give you written reasons why. For further information, please contact us.
To assist us to keep our records up to date, please notify us of any changes to your personal information.
Data breaches
In Australia, if we suspect that a data breach has occurred, we will undertake an assessment into the circumstances of the suspected breach within 30 days after becoming aware of the occurrence of the suspected breach. Where it is ascertained that a breach has actually occurred and where required by law, we will notify the Privacy Commissioner and affected individuals in accordance with our legal requirements.
Under the Privacy Act and under an eligible data breach declaration, we may be asked or required to share and/or handle a limited amount of personal information to prevent or reduce the risk of harm to individuals whose personal information has been or may have been breached.
Complaints and questions
We have procedures in place for dealing with complaints and concerns about our practices in relation to the Privacy Act, the APPs, and any alleged breach of this Policy. We will respond to your complaint in accordance with the relevant provisions of the APPs. For further information, please contact us.
Contact
Our Privacy Officer can be contacted to discuss or attempt to resolve any complaints relating to the collection, storage and use of your personal information.
Redmond Collins Hoffmann
Level 13, 288 Edward Street, Brisbane QLD 4000
(07) 3620 2000
If you are not satisfied with our response, you may also contact the Office of the Australian Information Commissioner (OAIC) or the Legal Services Commission.