Client Data Privacy Notice

Last updated: November 2020

1. Introduction

During the course of our activities, Reprieve, Registered Charity Number 1114900 of PO BOX 72054, London, EC3P 3BZ  (“we” or “us”), as controller will process personal data (which may be held on paper, electronically, or otherwise) about people like you whom we assist.

We recognise the need to treat such personal data in an appropriate and lawful manner, including in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). The purpose of this notice is to inform you of how we will handle your personal data.

2. Personal Data we collect

We may collect the following categories of personal data about you:

  • personal details, including your name, contact information (including address, e-mail address, and telephone number), a copy of your passport/s and (if applicable) your visa/s, date of birth, physical description (including distinguishing features), details of family members and employers, lifestyle and social circumstances, education and employment details, personal and family photographs, behaviour, financial details, and details of financial dealings;
  • legal details, including potentially legally privileged information relating to your case, details on the commission or alleged commission of any offence, any proceedings for any offence committed or alleged to have been committed, the disposal of those proceedings and the sentence of any court in those proceedings; and
  • sensitive details, including medical and psychiatric records and details of assessments, racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning sex life or sexual orientation.

We may collect this personal data:

  • directly from you; and
  • from other sources, including through our activities in the course of your case, such as when we make investigations like raising freedom of information act requests and subject access requests. Such sources include:
    • electronic sources, such as email, document management systems, and telephony systems;
    • publicly available sources, including websites and newspapers; and
    • third parties, including formal and informal partner law firms and lawyers, formal and informal partner non-governmental organisations and civil society, public authorities, governmental departments, foreign consuls, health professionals, current and former employers, family and friends.

If you do not provide us with the personal data we ask you for, this may have an impact on the support Reprieve can provide if it makes it more difficult or we are unable to assist you without such information.

3. Purposes and Legal Bases for Processing Personal Data
Why do we process your personal data?Which personal data do we process for this purpose?What is the legal basis for processing?
Requesting access to and accessing any and all medical, occupational, financial or other records relating to youPersonal details– Performing our contract with you to provide you with your services; or
– To protect your vital interests
Legal details; sensitive details– To establish, exercise or defend your legal rights; or
– With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests
Sharing information with Partner organisations and other organisations or individuals who we believe will support your casePersonal details– Performing our contract with you to provide you with our services; or
– To protect your vital interests
Legal details; sensitive details– To establish, exercise or defend your legal rights;
– To inform elected representatives about prisoners in the substantial public interest; or
– With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests
Managing press messages in relation to your casePersonal details– Performing our contract with you to provide you with our services; or
– To protect your vital interests
Legal details; sensitive details– To establish, exercise or defend your legal rights;
– Journalistic publication in the public interest (or substantial public interest for sensitive details) in connection with unlawful acts or seriously improper conduct; or
– With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests
Managing campaigns and advocacy in relation to your casePersonal details– Performing our contract with you to provide you with our services; or
– To protect your vital interests
Legal details; sensitive details– To establish, exercise or defend your legal rights;
– Journalistic publication in the public interest (or substantial public interest for sensitive details) in connection with unlawful acts or seriously improper conduct;
– To inform elected representatives about prisoners in the substantial public interest; or
– With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests
Assessing your case in order to determine whether Reprieve can assist youPersonal details– Our legitimate interest in determining the best use of our limited resources in order to achieve our charitable goals
Legal details; sensitive details– To establish, exercise or defend your legal rights; or
– With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests
Complying with our regulatory and compliance obligationsPersonal details– This is necessary for us to comply with our legal obligations
Informing the public about Reprieve’s work with you and other victims of extreme human rights abuses, in order to raise awareness of human rights issues such as the death penalty and canvas supportPersonal details; legal details; sensitive details– Journalistic publication of the information in the public interest
Raising funds to assist in cases such as yours through public education and campaigning about your casePersonal details; legal details; sensitive details– Journalistic publication of the information in the public interest; or
– With your consent
4. Disclosure of Personal Data

We may share your personal data with the following organisations:

  • third parties if we are under a duty to disclose or share that personal data in order to comply with any legal obligation, or to protect the rights, property, or the safety of us, our employees, volunteers, donors, those whom we assist, or others, such as:
    • clinical psychiatrists who support our casework;
    • UK local authorities; and
    • the Foreign, Commonwealth & Development Office.
  • third parties who help us to provide our services to you where this is in your best interests and is legally permissible and we have a legal basis as set out in section 3, such as:
    • lawyers acting on behalf of an individual whom we assist;
    • trusted partners who we are working alongside;
    • members of the general public on our supporter database;
    • media outlets in the UK or the US; or
    • politicians and government officials in the UK, the US, or another jurisdiction.

We may sometimes find it necessary to transfer personal data outside the United Kingdom, including to countries which do not have strict data protection laws. However, we will only transfer your personal data to a third party outside the UK:

  • where the third party is located within the European Economic Area or in a country which has been assessed by the European Commission (or an equivalent UK body) as ensuring an adequate level of protection for personal data; or
  • on the basis of an agreement designed to protect personal data in the appropriate form approved for this purpose by the European Commission (or an equivalent UK body) – please contact the Data Compliance Lead using the contact details in section 8 below if you would like to see a copy of any of these agreements; or
  • where you have given consent to the transfer taking place.
5. Retention of Personal Data

We will delete or permanently anonymise personal data when it is no longer needed for the purposes for which it was collected.

6. Security

We will take appropriate technical and organisational security measures to protect the personal data that we process against unauthorised or unlawful processing and accidental loss, destruction or damage. We will ensure that these measures provide a level of security appropriate to the nature of the data concerned and the risks associated with unauthorised or unlawful processing and accidental loss, destruction or damage. In assessing the required level of security we will take account of the security measures available and their cost.

7. Rights in relation to Personal Data

You have the following rights with respect to your personal data:

  • to be provided with a copy of any personal data that we hold about you at any time;
  • to request that we, without undue delay, update or correct any of your personal data which is inaccurate or incomplete;
  • to object to our processing of your personal data; and
  • where the processing is carried out on the basis of your consent, to withdraw your consent to such processing. To do this, please contact us using the contact details provided in section 8 below.

You may also have the following rights:

  • to request that we, without undue delay, delete any of your personal data;
  • to request the restriction of our processing of your personal data; and
  • to (a) receive the personal data you have provided to us, in a structured, commonly used and machine-readable format; and (b) transmit it to another data controller.

If you wish to exercise any of these rights, please contact us using the contact details provided in section 8 below.

If you consider that this notice has not been followed, please contact the Data Compliance Lead or your case worker as set out in section 8 below. Any breach of applicable law will be taken seriously. You can also raise complaints or concerns about our processing of your personal data with the Office of the Information Commissioner, which regulates data protection in the UK. Details are available at www.ico.org.uk.

8. Contact us

If you have any questions about this notice, please contact the Data Compliance Lead:

  • Deputy Director, Legal and Governance: [email protected]
  • or, to the extent that this is not possible, your case worker, who can liaise with the Data Compliance Lead on your behalf.
9. Changes to this Privacy Notice

We may change this Privacy Notice from time to time. Please check our website regularly for any updates.