Experts in
Data Protection & Information Law

ABOUT ME

I’m an Advocate of the Royal Court of Jersey. I’m based in Jersey and I provide specialist legal services (predominantly litigation) in the field of information law (data protection, freedom of information, defamation etc.). I also deal with mental health and capacity, personal injury, employment and general civil litigation matters. More information about me and my background can be found here.

I am regulated by the Law Society of Jersey and registered with the Jersey Office of the Information Commissioner as a fee-paying controller (registration number 63043).

This privacy notice (Notice) explains the various ways in which I obtain, hold, use and disclose personal data. This Notice also explains what your rights are in relation to any personal data about you that is processed by me.

It applies to everyone whose personal data I collect and process. This includes individuals in the categories below or who work for any of the following:

• My clients
• other lawyers and law firms
• people who are involved in court or other legal proceedings (including legal claims, criminal actions, inquests, tribunals, arbitrations, mediations, investigations, and regulatory actions) or the provision of related or other legal, advisory and/or consultancy services, or people who are involved in insurance claims I am handling for clients. This may include plaintiffs/claimants, defendants/respondents, witnesses, experts, and service providers related to such court or other legal proceedings, services, or claims, such as investigators, mediators and costs lawyers
• people who are involved in contracts and transactions I am working on, such as other businesses or individuals my clients are contracting with
• regulators, insurers, auditors, professional advisers, and certification/accreditation bodies (such as IAPP); and
• people whose details we process in connection with my marketing activities.

Any questions in relation to this Notice should be directed to info@advocatedvb.com.

RELEVANT LAW

The way in which I process personal data is governed by data protection law, which includes the Data Protection (Jersey) Law 2018 (the DPJL 2018), the Data Protection Authority (Jersey) Law 2018 (the DPAJL 2018) and, where relevant, the General Data Protection Regulation (EU)2016/679 (GDPR).

THE DATA I COLLECT

I process personal data in order to provide legal services. This means any information about an individual from which that person can be identified. The type of information I collect includes:

• contact information for individuals (such as full name, job title, organisation, date of birth, address, email address and telephone number). I may collect additional information to enable the identity of individuals to be verified
• financial information, including your bank account details
• information regarding an individual’s legal requirements and personal or professional situation
• information about individuals employed by or associated with my clients, advisers or the organisations involved in a matter on which I am instructed
• medical records and health information as necessary for the provision of services where the services I provide involve or relate to personal injury, clinical negligence, mental health or other medical matters
• information obtained as a result of investigations carried out in relation to individuals which may involve surveillance conducted by third parties and/or by researching online activity, and accessing various subscription databases and open-source platforms
• special category personal data (including criminal convictions and offences data) may be processed if necessary for the legal matter we are advising on, this includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation
  
  

I will usually collect most information from you. However, I may also collect information from:

• Publicly accessible sources, e.g. the Jersey Financial Services Commission website, the Public Registry (PRIDE land registry system) or social media sites such as LinkedIn;
• Your colleagues or third-party business contacts who have referred you to me, or put you in touch with me (including other lawyers who may instruct me to assist them with a matter on your behalf);
• A third party with your consent (e.g. your bank or insurance provider, GP or other medical services provider);
• Legal Aid in Jersey (either if I have been appointed to act for you under the terms of the Legal Aid Scheme, from time to time);
• The courts and Tribunals of Jersey:
  • If I am appointed as amicus, for example, I will receive information from the Judicial Greffe.
  • If I am appointed to preside as Chairman on an individual’s application to the Mental Health Review Tribunal I will receive information from the Tribunal Registrar and Health and Social Services (who provide reports as part of the review process);
• Citizens Advice Jersey as part of providing information to individuals as part of their legal advice clinic; 
• Other parties to legal proceedings, including any legal representatives.

(If I am appointed to preside as Chairman on an individual’s application to the Mental Health Review I do not process data on my own systems. This processing activity is carried out by the Judicial Greffe who is the data controller for such information. More information can be found in their privacy notice here.)

HOW DO I USE YOUR PERSONAL DATA?

Lawful basis on which I will use your personal data

I will only use your personal information when the law allows me to do so, i.e., where I have a lawful basis for processing. Most commonly, I will use your personal information in the following circumstances:

• Where I need to perform the contract, we are about to enter into or have entered into with you or take any steps you ask us to before entering into a contract with you (Schedule 2 Part 2 Para 2 of the DPJL 2018).
• Where it is necessary to do so in order to comply with any legal obligations I have, such as under proceeds of crime laws (Schedule 2 Part 2 Para 2 of the DPJL 2018).
• On the basis of consent (Schedule 2 Part 1 Para 1):
  • Where I rely on your consent for processing this will be brought to your attention when the information is collected from you.
  • You have the right to withdraw consent at any time, see the Your Rights section below for further information about how you may withdraw your consent.
  • I do not rely on or require your consent for the majority of my processing.
• Where the processing is necessary for my legitimate interests in:
  • providing legal, advisory and/or consultancy services
  • ensuring regulatory compliance and maintaining accreditations
  • providing my clients with the best service
  • promoting my services
  • receiving feedback
  • improving my services and identifying ways to grow my business; and/or
  • for the legitimate purposes of my clients or other third parties in receiving those services. I will only rely on this lawful basis where I consider that your interests and fundamental rights do not override such interests.

When processing your personal information, I comply with the provisions of this privacy notice and, in respect of the provision of legal services I am also bound by professional obligations of confidentiality.

Special category data

In most cases, when I process special category data (including criminal conviction and offences data) it is because it is necessary to do so for any legal proceedings, obtaining legal advice or the establishment, exercise or defence of legal claims (Schedule 2 Part 2 Para.12). I may however process special categories of data with your explicit consent (Schedule 2 Part 2 Para 1), where it is necessary to protect your vital interests (for example in the event of an emergency (Schedule 2 Part 2 Para 9)) or where the data has been manifestly made public by you (Schedule 2 Part 2 Para 11).

Purposes for which I use your personal data

I may process your information for the following purposes:

Legal, advisory and/or consultancy services

Where I receive personal data in connection with the provision of legal, advisory and/or consultancy services, I process that data for the purposes of the provision of those services. This includes:

• Providing legal and related services, such as:
  • managing court or other legal proceedings (including legal claims, criminal actions, inquests, tribunals, arbitrations, mediations, investigations and regulatory actions);
  • providing legal advice
  • providing consultancy services
  • advising on and negotiating legal contracts and transactions;
• Complying with my legal obligations or making disclosures to government, regulatory or other public bodies where in my reasonable opinion the disclosure is appropriate and permitted by law. This includes:
  • performing checks of my clients and others as I am required to do by law or which are good practice, such as anti-money laundering and anti-terrorism checks. In undertaking such checks, I may ask individuals to provide information and use publicly available information
  • disclosures required by law or court order
  • disclosures to the police, tax authorities, or other public or government authorities where in my reasonable opinion the disclosure is required in relation to any criminal investigation or prosecution; and
  • disclosures to our regulators, ombudsman, or other government, public or regulatory authority, including any data protection supervisory authority or regulator of legal services, where in my reasonable opinion the disclosure is required or permitted by law.

• Providing access to my files for audit, review, or other quality assurance checks, by my clients, regulators, auditors, professional advisers, and certification/accreditation bodies.
• Processing required in connection with the day-to-day operation of my business such as billing and payments, complaints handling and internal record keeping. For this I may use third party service providers such as IT service providers.
• Processing required in connection with any actual or proposed reorganisation, merger, sale, joint venture, assignment, transfer, or other transaction relating to all or any portion of my business or assets.

Marketing

I process personal information in connection with marketing or communications purposes, including so that I can:

• send you invitations to any events as and when I think they might interest you
• share with you news and offers about my products and services
• ask you for feedback (for instance, in a survey) about my client services, and to manage, review and act on the feedback

manage any changes to your marketing preferences or comply with any unsubscribe requests.

Use of Artificial Intelligence (AI)

I may use artificial intelligence (AI) systems to support the delivery of legal services, as well as to enhance internal operational efficiency. These systems may include large language models, machine learning algorithms, and generative AI tools. Third party data may be processed using approved tools.

I verify the accuracy of AI-generated content before it is used to provide professional legal services. AI tools are assistive in nature and do not replace professional judgement.

I am committed to protecting your personal data when using AI. Personal data is only processed through AI tools that have been formally onboarded and approved. These tools comply with our confidentiality obligations and data protection policies.

None of the AI tools I use train on data.

My AI governance framework is based on internationally recognised principles, and I ensure that my use of AI is fair, transparent, explainable, and aligned with my firm’s values.

COOKIES

What is a cookie?

A cookie is a small text file that contains a small amount of information and is downloaded onto your devices (e.g. your computer or smartphone) when you use a website.  

Do I use cookies?

I do not have any tracking enabled on my website and the only cookie I use is a first party, necessary cookie called ‘elementor’ which allows me to make changes to my website content.

WHO DO I SHARE DATA WITH?

I will never sell your information or pass it to any third party for marketing purposes or for any other purpose unconnected with my business.

I may need to share some of the above information with other parties such as:

• Any sub-contractors, agents or service providers (including any experts I engage to assist with your case);
• Courts or tribunals;
• Third parties with whom I engage for the hosting of events or other marketing initiatives;
• Law enforcement agencies where considered necessary for me to fulfil legal obligations applicable to it;
• Regulators or other governmental or supervisory bodies with a legal right to the material or a legitimate interest in any material. 

Where I enter into an engagement with a third party pursuant to which data may be processed by that third party, I will impose contractual obligations on them to ensure that they are only allowed to use your information to complete the tasks I have asked them to carry out and that they take appropriate measures to protect your personal data. 

I may also disclose your personal data to third parties:

• if I am under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply my Letter of Engagement or other agreement with you; or
• to protect my rights, property, or safety or that of my clients or any third party I interact with.

Other than as set out above, and save insofar as is necessary in order for me to carry out my obligations arising from any contracts entered into between you and me, I will not share your data with third parties unless I have procured your express consent to do so.

I do not intend to transfer any personal data to jurisdictions outside of Jersey or the EU/EEA.  If transfer your personal data outside Jersey or the EU/EEA, as applicable, is required I will ensure that at least one of the following safeguards is in place, as applicable:

• Adequacy decision, as approved by the European Commission
• Permitted derogation for specified circumstances
• Standard contractual clauses, as approved by the European Commission and adopted by the Jersey Data Protection Authority (together with the local addendum).

Third party links

My website may, from time to time, contain links to and from other websites including the websites of my clients or partners who have provided feedback or testimonials; industry-related websites such as the Legal 500; or networking or social media websites/platforms such as LinkedIn, Instagram and X. Please note that these websites have their own privacy policies/notices and terms of use and I do not accept any responsibility or liability for these policies and terms of use. Please check these policies/notices before you submit any personal data to those websites.

SECURITY

I take appropriate measures to ensure that any personal data are kept secure, including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. I limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

I also have procedures in place to deal with any suspected data security breach. I will notify you and any applicable regulator of a suspected data breach where I am legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although I will do my best to protect your personal data, I cannot guarantee the security of your data transmitted to my website; any transmission is at your own risk. Once I have received your information, I will use strict procedures and security features to try to prevent unauthorised access.

WHERE I STORE YOUR PERSONAL DATA

All information I hold about you is stored on secure systems provided by my third-party service provider within the EU.

HOW LONG DO I KEEP YOUR INFORMATION?

I retain personal information for the period reasonably necessary for the purpose for which it was collected. In particular:

• I store all personal information collected in connection with services that I provide to my clients, e.g. emails that I exchange with you that contain instructions or information required for me to perform services, for so long as the relevant client remains a client of the firm, and to enable me to resolve any disputes, enforce my rights, respond to queries, and perform services for the relevant client in the future.

Please note that I am obliged to keep client data for 11 years after the last material entry on the relevant file, this in accordance with the rules of the Law Society of Jersey.

YOUR RIGHTS

Under data protection legislation, you have various rights in connection with any personal data about you that is processed by me as data controller. These include rights to:

• access to your personal data and to certain other supplementary information that this Policy is already designed to address
• require me to correct any mistakes in your information which I hold
• require the erasure of personal data concerning you in certain situations
• receive the personal data concerning you which you have provided to me in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations
• object at any time to processing of personal data concerning you for direct marketing
• object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
• object in certain other situations to my continued processing of your personal data
• otherwise restrict my processing of your personal data in certain circumstances

Further information on those rights can be found on the website of the Jersey Office of the Information Commissioner:  www.jerseyoic.org.

If you would like to exercise any of those rights, please email (info@advocatedvb.com) or write to me providing enough information to allow me to identify you. It would also be helpful if you could let me know the information to which the request relates. I may require formal proof of identity (photo ID and recent utility bill) and where I request this I must receive it before I am obliged to respond to your request.

CONSEQUENCES OF FAILING TO PROVIDE DATA AND KEEPING INFORMATION UP TO DATE

If you are a client and you do not provide information I need or you ask me to cease processing or erase your data, then the effect may be that I am then unable to provide legal services to you. 

If your personal details change, please email me and I will endeavour to update your personal data within seven working days.

RIGHT TO LODGE A COMPLAINT

I hope that I can resolve any query or concern your raise about my use of your information so please contact me in the first instance to discuss any concerns.

You have the right to lodge a complaint to the Jersey Data Protection Authority about the processing of your data by me. Their contact details are:

Jersey Office of the Information Commissioner
2nd Floor
5 Castle Street
St Helier
Jersey

Tel: +44 1534 716530
www.jerseyoic.org

CHANGES TO THIS NOTICE

I reserve the right to modify this Notice at any time. Any changes will be notified and made available via my website.

Last updated 15 December 2025.