The impact of GDPR on divorce proceedings

Under GDPR, solicitors either in litigation or in contemplation of litigation can send such documentation to third parties, providing they have a legal basis for doing so.

If the solicitor cannot obtain explicit consent, they will need to establish another lawful purpose for processing data. This will often be in order to comply with a legal obligation.

A legal obligation includes directions under a court order. The processing might be required either alternatively or additionally as part of a contractual obligation between the solicitor and their clients.

However, solicitors should be careful to consider whether documents are confidential or not before examining or handling them.

In practice this is a tricky decision for solicitors to make. As the Court of Appeal stated: “A solicitor who receives, reads, and passes on such documents, particularly knowing that they have been taken from the claimant unlawfully, may well be an appropriate defendant.” 

Solicitors may consider the documentation that has been provided to them by their clients is not confidential and pass them onto third parties, for example, to professional advisers.

It is unclear whether third parties would be deemed “data controllers” or “data processors” under the GDPR and this is very much fact sensitive. This should be established before the data is shared between the parties to ensure appropriate contractual documents are in place.

Professionals need to be familiar with GDPR requirements, and build into their terms and conditions of business suitable provisions to ensure compliance.

No matter what kind of relationship exists, personal data must be handled in accordance with the GPDR and it is likely that there will be mutual responsibility between the parties.

The sanctions for breaching data protection laws have become much more stringent under the GDPR, which parties should be mindful of. Where possible, evidence of compliance should be recorded.

This includes recording the lawful basis for processing data, how the data is secured and how long it will be retained for. 

Relevant other considerations under the GDPR are that of data security and data minimisation.

Professionals need to be familiar with GDPR requirements in that regard, and build into their terms and conditions of business suitable provisions to ensure compliance.

Professionals must ensure that they maintain confidentiality in relation to the information they have access to, to limit their processing of personal data to that which is necessary as part of their contractual duties, and not to retain such data for longer than is necessary.

Joint decision