GDPR Query - Solicitor Info

[travelbuddy3]

Afternoon

I need to send docs/emails to my solicitors about my interactions with my ex-employer. Solicitors have sent me some guidelines regarding GDPR etc.

I am confused as to how I can achieve GDPR compliance if all my interactions have the names of several people in those email conversations. If you put that together with the company name, you know where they work and can identify the person.

For ex: I cant mask the name of my manager from the email as that doesn't make any sense.

Any thoughts? Ta

You don't need to give any personal identifiable information nor any information about the company to your solicitor in order to be given good quality legal advice. Why do you think you need to, it doesn't add any value - In fact I would strongly advise against it.

If you've had a consultation with the solicitor and you are now sending them a more detailed account of the problem in hand, in writing, you can state at the start of your correspondence that you've redacted (ie masked) all identities including your employers details.

You can clarify it very easily:

I work for Company123

My manager Person A, said to me blah blah blah

HR Person B hear what was said, and repeated it to HR Person C etc etc.

You just need to get across the important facts. Who the people are, will be of no interest to the Solicitor, only that there were x number of people involved and who said or did what.

Your solicitor is required to comply with the UK-GDPR in relation to any personal data you provide them with if/when you become a client. You, as a private individual, are not a data controller and there’s therefore no requirement for you to redact any personal and/or company identifiable information from the documents you provide them with.

But why provide living people's informatio when you don't need to. I would de-risk the situation by not providing it in the first place. Need to know basis.

You, as a private individual, are not a data controller

This is often repeated but it is simply not true. We all process other people's personal data, even if it is only their telephone number or their postal address. We are all therefore data controllers under GDPR. Any processing we do in the course of a personal or household activity is exempt. But if, for example, someone has a blog and posts personal information relating to someone else, that would be a breach of GDPR even if the blogger was purely doing it as a hobby.

I agree with @daisychain01 as to the approach you should take. They don't need to know names at this stage. Referring to people as person A, person B, etc. ensures you are safe.

You do not need to redact anything you send to your solicitor as it is covered by legal professional privilege that exists between the solicitor and their client.

@SeasonFinale

You do not need to redact anything you send to your solicitor as it is covered by legal professional privilege that exists between the solicitor and their client.

The fact there is legal professional privilege simply means the subject(s) do not have the right to be informed or the right of access. The other provisions of GDPR still apply. In any event, the solicitors have sent the OP guidance on GDPR, so it sounds like they want her to redact names.