The Law Society erroneously advised firms to delete client data if they didn't obtain fresh consent to keep it. 

The Law Society was attempting to advise members about the steps they should take to comply with GDPR, the glorious new data regime that's requiring companies to beg for permission to keep sending junk. Only the Law Society took it a bit far, and told firms in emails and a PDF advice booklet that they were under an obligation to seek consent just to hold client data.

"Regardless of when you initially received consent from a client or any other individual (yesterday or 10 years ago)", advised the Law Society, "you must gather explicit consent again from all parties to hold and process their data".

It continued, "Start amending or deleting the records of individuals who have either denied consent or have not responded by the deadline you have given”.

  "Hang on everyone. The Law Society would like to recall the message, 'Burn the outsider'." 

A bonfire of client files would make a wonderful spectacle and give everyone in the office a fresh start feeling. But GDPR actually does not require a firm to to seek consent to hold information on people, only to contact them to explain the firm's data protection policy (and even the extent of that requirement is debatable).

There are reports that the misguided advice created confusion. Bernard George, the director of legal training provider Socrates, said “We had lots of reaction to our bulletin from firms, saying they had been staring at the LS guidance in bafflement”. The top tips from the Law Society, which lost a case brought by Socrates last year, was “disastrously wrong”, George told RollOnFriday. “You would be mad to start deleting client records just because people do not respond to a misguided request for consent”.  

The Law Society has now removed its hardline interpretation of the GDPR requirements from its website. A spokesman said, “The Law Society moved very quickly to correct a recent email about GDPR. We apologise for our error and have re-contacted the people who received the communication with the mistake corrected”. Rather marvellously, it means the Law Society has sent two emails, one wrong and one a retraction, in response to regulations intended among other things to cut down unwanted emails.
Tip Off ROF

Comments

Anonymous 25 May 18 11:13

What a glorious institution fit for the modern age the LS is. Aren't we all glad that it doesn't regulate us anymore. Oh, hang on...

Anonymous 25 May 18 12:15

Of serious concern is the potential exposure caused to small firms who felt obligated to destroy client files unnecessarily as a result of the Law Society's erroneous advice and did so before the advice was retracted. While the big firms are able to obtain their own competent advice, small firms are often reliant on their trade association to provide guidance and not in a position to second guess it.

Of concern for the wider profession is the fitness of the Law Society to represent it in the public sphere if it keeps making these basic mistakes.

Anonymous 25 May 18 17:57

Do you really need a data protection specialist? The ICO has been doing what it can to let the world know that consent is not the only lawful basis. Read the Regulation itself. It is not that difficult. And does the Law Society not know any competent lawyers. Seriously, where are they getting their advice from? We have the abuse of a dominant position case, the retreat from one recognised provider for the QLTS, to this incorrect advice. And a massive data breach in between. And a lot more.

Anonymous 25 May 18 23:09

Not their only error. An article on their website has a paragraph which refers to Art 48 - which does not apply in the U.K.

Anonymous 30 May 18 15:02

anonymous user
25/05/2018 10:13
Rate it
10
Report as offensive
What a glorious institution fit for the modern age the LS is. Aren't we all glad that it doesn't regulate us anymore. Oh, hang on...

The Law Society doesn't regulate anyone. That's the SRA.

Anonymous 31 May 18 08:00

Well I for one am comforted that the LS it at least consistent. Having displayed breathtaking incompetence as regards employment law over the years it's good to see that they have now branched out into being hopeless on data protection as a side business. Go LS!