PRIVACY POLICY

• Its legal and ethical obligations of confidentiality, including those prescribed by the Legal Profession Uniform Law (Vic); and
• the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs); and
• the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), in relation to those of our services that are designated services under that Act.

This Privacy Policy explains how we collect, hold, use and disclose personal information, and how an individual may seek access to or correction of the personal information we hold or make a privacy complaint. Please note, references to ‘client’ include a potential client.

Why personal information is collected

The firm collects, holds, and uses personal information where it is reasonably necessary for the purposes of:

• providing a client, or an entity with which the client is connected, with legal services;
• billing for those services;
• complying with our legal, professional and regulatory obligations, including our obligations under the AML/CTF Act, our obligations in relation to conflicts of interest, and our record-keeping obligations;
• administering and managing our practice, including information technology and communications, document and records management, file storage, accounting, quality assurance and professional indemnity insurance; and
• marketing or promoting services to clients.

Types of personal information collected

The firm collects, holds and uses personal information such as:

• instructions given to us for the purposes of providing legal services;
• names and contact details;
• qualifications and occupations;
• information collected to verify a person’s identity, which may include identity documents and, where electronic verification is used, an image of a person’s face or other biometric information;
• financial information, including payment and bank account details and, where we are required to collect it, information about a person’s assets, liabilities, income and the source of the funds or wealth applied in a matter; and
• personal information contained in the instructions, documents and correspondence relating to a matter, which may include personal information about individuals who are not our client.

Sensitive information

Depending on the nature of a matter, the personal information we collect may include sensitive information as that term is defined in the Privacy Act, such as information about a person’s health, racial or ethnic origin, membership of a professional or trade association, criminal record, or biometric information. We collect sensitive information where the individual has consented to the collection and it is reasonably necessary for our functions or activities, or where the collection is required or authorised by law or another exception under the Privacy Act applies. We may also receive sensitive information we have not solicited, for example in documents provided to us in the course of a matter, and where we do we handle it in accordance with the Privacy Act

How information is collected

The firm collects personal information:

• when clients provide instructions for the purposes of receiving legal services;
• when clients otherwise provide information;
• through emails, forms, and through use of the services and facilities available through our websites and social media channels;
• when clients or potential clients attend a seminar or other event organised by us;
• when we use third parties to analyse traffic at our website and social media channels, which may involve the use of cookies;
• from a third-party provider engaged by us to verify a person’s identity; and
• from courts, tribunals, registries and government agencies, and from other parties to a matter and their representatives.
We collect personal information directly from clients to the extent it is reasonable and practicable to do so. However, in some circumstances, we may also collect an individual’s personal information from a third-party source. For example, a client of ours may provide to us another individual’s personal information in relation to the legal matter with which we are assisting.

We use personal information for the purposes for which it was collected, for related purposes where the individual would reasonably expect us to do so, and otherwise as permitted by the Privacy Act.

Our use and disclosure of personal information is also subject to our legal and ethical obligations of confidentiality, which in some circumstances restrict us more than the Privacy Act does.
In the course of providing legal services and administering our practice, we may disclose personal information to:

• other parties to a matter and their legal representatives, and to barristers, experts and other consultants we engage;
• courts, tribunals, registries and other parties in the conduct of proceedings;
• government agencies and regulators where we are required or authorised by law to disclose it, including the Australian Transaction Reports and Analysis Centre;
• providers of software and services engaged by us, as described below;
• our insurers, auditors and professional advisers; and
• any other person with the individual’s consent.

We use third-party providers of software and services to store, manage and process information in the course of providing legal services and administering our practice, including document management, information technology and communications, identity verification and artificial intelligence tools. Those providers are engaged to act on our instructions and are subject to obligations of confidentiality.
We may use artificial intelligence tools to assist with tasks such as legal research, reviewing and summarising documents, extracting information and preparing drafts. We use only tools approved by the firm for use in legal work. We determine which of them we use in each case based on our internal policies, the sensitivity of the information, and any restrictions that apply to the matter. We do not use tools on terms that permit the use information from a matter for their own purposes, including to train artificial intelligence models.
All work is reviewed and settled by a lawyer, who remains responsible for the advice and documents we provide. A copy of our AI policy is available on request.
A client who does not wish us to use any or any particular artificial intelligence tools in their matter, or who wishes to discuss or limit their use, should tell us and we will discuss the request and what it means for the matter.

Some of the information we hold may be stored or processed outside Australia by the providers referred to in this Privacy Policy, including in the United States, and some providers may process information in other countries which they do not specify.
A client who wishes the information for their matter to be handled only in Australia should tell us and we will accommodate that request.

Where the services we provide include a designated service under the AML/CTF Act, we are required by law to collect and verify information about the identity of the client and, where the client is a company, trust or other entity, the individuals who own or control it. We may also be required to collect information about the source of the funds or wealth applied in the matter.
We conduct this process using a third-party identity verification provider, currently First AML. The process may involve collecting identity documents and, where electronic verification is used, an image of a person’s face or other biometric information, and the checking of identity documents against government verification services. Some of this information may be held or processed outside Australia by that provider or by its own service providers.
Information collected for this purpose is used to meet our obligations under the AML/CTF Act and is retained for at least 7 years, as that Act requires. The AML/CTF Act also requires us to report certain matters to the Australian Transaction Reports and Analysis Centre and, in some circumstances, prohibits us from disclosing that we have done so.

Where we use personal information to market or promote our services, we will provide a simple means by which an individual can ask not to receive direct marketing from us. An individual who does not wish to receive direct marketing communications from us should contact our Privacy Officer using the details set out below, and we will action that request.

The firm takes reasonable steps to ensure that personal information held by us is protected from misuse, interference and loss and from unauthorised access, modification or disclosure. We hold personal information in both hard copy and electronic forms in secure databases on secure premises, accessible only by authorised staff and by the providers referred to in this Privacy Policy. Where we engage a provider to store or process information on our behalf, we require that provider to maintain appropriate security measures.
We generally retain the file for a matter for at least 7 years after the completion or termination of our engagement, and information collected to verify identity under the AML/CTF Act for at least 7 years, as that Act requires. We will destroy or de-identify personal information in circumstances where it is no longer required, unless we are required by law to retain the information.

Subject to the exceptions set out in the Privacy Act, you may seek access to and correction of the personal information which we hold about you by contacting our Privacy Officer by telephone, email or otherwise in writing. We will require you to verify your identity and to specify what information you require. If a fee is charged for providing access, you will be advised of the likely cost in advance.