PRIVACY NOTICE

Nigel Power KC

Last updated: 30 October 2026

A. Introduction and data controller

1. In order to provide legal advice and representation, I need to collect and hold personal information. This may be your personal data or information about other people involved in a case. I will take all reasonable and proportionate steps to protect it.

2. This notice explains what information I collect, how I use it, who I share it with, how long I keep it and what your rights are. It applies under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”), both as amended by the Data (Use and Access) Act 2025.

3. As a self-employed barrister, I am the data controller of the personal data I process in my practice. I am registered with the Information Commission (“the Commission”), which replaced the Information Commissioner’s Office (“ICO”) on 30 September 2026. My details are:

(a) Name: Nigel Power KC

(b) Address: 7 Harrington Street, Liverpool

(d) Email: nigel.power@7hs.co.uk

(e) Telephone: 0845 450 0707

4. If you need to contact me about your data or this notice, please email me at the address above.

B. What personal data I process

5. Most of my work is in criminal cases, so I process a wide range of personal data, including the most sensitive kinds:

(a) Personal data: names, contact details, dates of birth, addresses, employment, financial and family details, and other information relevant to the case;

(b) Special category data: information about health (physical and mental), racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, and genetic or biometric data;

6. This may relate to my clients, defendants, complainants, witnesses, experts, other professionals and anyone else involved in a case.

C. Where the information comes from

7. I obtain personal data from:

(a) my instructing solicitors, or from lay clients directly in Direct Access cases;

(b) the Crown Prosecution Service and other prosecuting authorities;

(d) the police, witnesses, experts and other parties to proceedings;

(e) public sources, such as court records and the press.

D. Why I process data and my lawful bases

8. I process personal data to provide legal advice and representation, to prosecute or defend in the courts, to keep accounting and professional records, to deal with complaints and appeals, and to comply with my regulatory obligations.

9. Why I do not rely on consent. The Commission’s guidance advises that seeking consent is misleading and unfair where data would still be processed if consent were refused. That is the position in almost all of my work. I cannot do my job, within the Bar Standards Board (“BSB”) Code of Conduct, without processing the material served on me. Consent would also not be freely given by people who depend on my services.

10. Lawful bases (Article 6 of the UK GDPR). I rely on:

(a) Contract: where I am instructed directly by a lay client, or need to take steps before being instructed;

(b) Legal obligation: to comply with the BSB Handbook, the Legal Services Act 2007, court orders and anti-money laundering law;

(c) Public task: where I prosecute or represent defendants in the Magistrates’ and Crown Courts, a task carried out in the public interest;

(d) Legitimate interests: my legitimate interests, and those of my clients, in conducting proceedings properly, dealing with complaints and appeals, and running my practice, where those interests are not overridden by yours.

11. Special category data (Article 9). I rely on processing being necessary for establishing, exercising or defending legal claims, or whenever courts act in their judicial capacity (Article 9(2)(f)), and, where relevant, for reasons of substantial public interest (Article 9(2)(g) and Part 2 of Schedule 1 to the DPA 2018).

12. Criminal offence data (Article 10). I rely on section 10 of, and Schedule 1 to, the DPA 2018, in particular paragraph 33 of Part 3 (legal claims, legal advice and judicial acts).

13. I do not make decisions about anyone by automated means.

E. Who I share data with

14. I share personal data only where necessary to carry out my work or meet my obligations. Recipients may include:

(a) my instructing solicitors and, in Direct Access cases, my lay client;

(b) the court, the judge and other barristers and parties in the case;

(d) experts and other professionals instructed in the case;

(e) my chambers’ staff, IT support and service providers who store or process data for me, including my email, cloud storage and AI providers (see section F);

(f) the BSB, the Legal Ombudsman, my professional indemnity insurers and the Commission, where required.

15. I normally share case material through the DCS or the Criminal Justice Secure Mail service (“CJSM”). I do not sell or rent personal data to anyone.

F. Use of artificial intelligence

16. I use generative artificial intelligence (“AI”) tools to help with some parts of my work, such as organising and summarising case material, preparing chronologies and schedules, and producing first drafts. I currently use Claude, provided by Anthropic (for UK customers, Anthropic Ireland, Limited), on Anthropic’s Team plan. This is a business service governed by Anthropic’s Commercial Terms of Service, not its consumer terms. Under those terms, Anthropic acts as my data processor: it processes personal data only on my instructions and to provide the service, under a Data Processing Addendum that forms part of the terms, as Article 28 of the UK GDPR requires. I remain the data controller of all personal data I hold. These safeguards apply:

(a) No training on my data: Anthropic’s Commercial Terms prohibit it from using my content to train its AI models.

(b) Minimising data: I upload only what a task requires. Where practicable, I remove or replace names and identifying details first. I do not upload details that would identify a complainant entitled to anonymity, including child complainants and complainants in sexual offence cases.

(c) Retention: I delete AI conversations when they are no longer needed. Once deleted, they are removed from my account immediately and from Anthropic’s systems within 30 days, unless Anthropic must keep them longer by law or to enforce its usage policy.

(d) Professional responsibility: AI assists me; it does not replace my judgment. I check all AI output against the original sources, including every authority and citation, and I take full professional responsibility for my work.

(e) No automated decisions: No decision about any individual is made by AI.

(f) Terms of access.: I will not use AI with material where a court order, the terms of the DCS or my instructions do not permit it.

17. I keep my use of AI under review in line with the Bar Standards Board’s Guidance on the use of Artificial Intelligence and Other Technologies (May 2026) and the Bar Council’s guidance on generative AI.

G. International transfers

18. Some of my service providers, including my AI provider and cloud storage provider, may process data outside the United Kingdom, including in the United States. Where they do, I rely on the safeguards permitted by the UK GDPR, such as transfers approved by regulations made under the UK GDPR (previously known as adequacy regulations) or appropriate contractual safeguards set out in those providers’ terms. In the case of Anthropic, its Data Processing Addendum incorporates the Standard Contractual Clauses together with the ICO’s International Data Transfer Addendum.

19. If a case involves people, courts or authorities outside the UK, it may be necessary to transfer data abroad for that purpose.

H. Security and how I handle data

20. Most of my work is done digitally. In particular:

(a) where I receive paper documents, I usually scan them and then shred the originals securely;

(b) where I receive material on disc, I load it onto my computer and then destroy the disc or return it to my instructing solicitors;

(c) I keep data only on computers and tablets protected by industry-standard encryption, passwords and up-to-date security software;

(d) I store some older material with a cloud storage provider that meets UK GDPR requirements;

(e) I follow the Bar Council’s guidance on information security.

I. How long I keep data

21. I keep personal data permanently. This allows me to deal with complaints, appeals and claims, which often arise long after a case ends.

J. Your rights

22. Under the UK GDPR, you have the right to:

(a) ask for a copy of the personal data I hold about you;

(b) ask me to correct inaccurate data;

(d) ask me to restrict how I use your data;

(e) object to my processing of your data;

(f) ask for your data to be transferred to another organisation;

(g) complain to me, and to the Commission, about how I have handled your data.

23. These rights are not absolute. Many are limited by exemptions in the DPA 2018, in particular for legal professional privilege, the prevention and detection of crime, and legal proceedings. I will tell you if an exemption applies.

24. To exercise any of these rights, please email me. I will respond within one month. If a request is complex, or you make a number of requests, I may extend this by up to two further months, and I will tell you if I do. When you ask for a copy of your data, I will make reasonable and proportionate searches for it.

25. Complaints: If you are unhappy with how I have handled your personal data, you can complain to me by email or by post at the addresses above. I will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of progress and tell you the outcome without undue delay. You also have the right to complain to the Commission at ico.org.uk/make-a-complaint or on 0303 123 1113.

26. I will always consider representations from anyone affected by this notice.

K. Data breaches and review

27. If there is a personal data breach that is likely to put people’s rights and freedoms at risk, I will report it to the Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk to you is high, I will also tell you directly.

28. I review this notice regularly and at least once a year. It was last updated on 30 October 2026.

L. Guidance and policies considered

29. In preparing this notice, I have considered the following legislation, guidance and policies:

(a) the UK General Data Protection Regulation;

(b) the Data Protection Act 2018;

(d) the Bar Council’s General Data Protection Regulation: Guide for Barristers and Chambers;

(e) the Bar Council’s UK GDPR: Frequently Asked Questions (March 2023);

(f) the Bar Council’s Considerations when using ChatGPT and generative artificial intelligence software based on large language models (November 2025);

(g) the Bar Standards Board’s Guidance on the use of Artificial Intelligence and Other Technologies (May 2026);

(h) the Commission’s (formerly the ICO’s) guidance on the right to be informed;

(i) Anthropic’s Commercial Terms of Service and Data Processing Addendum;

(j) the Law Society’s guidance, Generative AI: the essentials (September 2025);

(k) the UK Jurisdiction Taskforce’s consultation draft Legal Statement on Liability for AI Harms under the Private Law of England and Wales (2026);

(l) the Department for Science, Innovation and Technology’s Implementing the UK’s AI regulatory principles: initial guidance for regulators (February 2024);

(m) the decision of the Upper Tribunal in Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC), on the risk to confidentiality and legal professional privilege of uploading client material to public AI tools.