UK MDS- logo-01.png

UK Model Diversity Survey:  Privacy Policy

This privacy policy explains how InterLaw Diversity Forum (“we”, “us”, "our") processes your personal data when you use the UK Model Diversity Survey (“UK MDS”) directly, or when your information is entered into the UK MDS by your employer on your behalf.

The UK MDS is a supplier diversity questionnaire that corporate and financial institution signatories (“client signatories”) can request their panel firms/legal service providers (“law firms”) to fill out. The purpose of the UK MDS is to serve as the standard for law firms’ reporting of their diversity and inclusion (“D&I”) metrics to their clients. 

Further information about the UK MDS and the benefits to client signatories, law firms, and society can be found here. 

InterLaw Diversity Forum takes our data privacy obligations very seriously and we have designed the UK MDS with privacy at its core. This privacy policy explains what information is collected through the UK MDS, how it is used, and  what your rights are under data protection laws.

We’ll post any changes we make to the policy on this page and will notify our law firm participant and client signatory key contact of any significant changes.  

This is Version 2 of the policy - last updated on 20 July 2021.

If you have any questions related to this privacy policy, please contact us at: 

jonathan.leonhart@interlawdiversityforum.org 

Who are we?

 

InterLaw Diversity Forum Limited (Company number: 09010439; Registered office: 7 Bell Yard, London, England, WC2A 2JR) is the controller of your personal data. 

InterLaw Diversity Forum was established in 2008 and our mission is to foster inclusion for all diverse, socially mobile, and under-represented talent working in the legal sector, and to promote meritocracy in all sectors by working to 'level the playing field' in order to create environments where the best talent can succeed.

What data is collected through the UK MDS?

Information collected from law firms

The UK MDS asks for participating law firms to provide the names, pronouns, email address, and job title of the Firm Contact, and the name of the CEO/Managing Partner but not for employees and other partners.

Law firms are asked to input the total number only of UK lawyers that are working only in the UK, and the total number of lawyers globally, and then input the firm’s anonymous demographic data for all UK offices as of 31st December of the previous year. 

The survey is split into ‘equity partners’, ‘non-equity partners’, ‘counsel’, ‘associates’, ‘trainees’ and ‘other lawyers’. For each category of individuals, the law firm enters the number of individuals who fall into particular diversity categories e.g., “Asian/Asian British + Male”, “Black/Black British + Sex - 'Prefer not to say'”, “White + Female” etc., “Lesbian/Gay women”, “Trans/Non-Binary”, “Disabled”, “Socially Mobile”, etc.

The law firm is also asked to provide its demographic profile for lawyers in leadership positions, partner compensation, and key client partners, again only in numerical format.

Law firms will never share any names of law firm staff with us when completing the UK MDS (except the Firm Contact and the CEO/Managing Partner); they simply share the number of employees/partners that fall into an applicable diversity category.

As such, no personal D&I data of law firm staff is collected directly. However, if the response to any question in the UK MDS is “1” (meaning one person identified for that D&I metric) then there is a remote chance that the relevant individual could be identified indirectly, although this would only be possible by using publicly available sources (e.g., the law firm’s website or LinkedIn or other communications which may contain photos and other information the firm has published) to try to identify the relevant individual. However, the risk of this is lower given that the results are reported to client signatories in percentages rather than the actual numbers inputted into the UK MDS. 

To give an example, if a law firm with 60 associates were to indicate that there is one associate who is gay, it would not be possible to tell directly from the information in the UK MDS who that individual is – this would be reported as 0.6%. However, it may be possible to indirectly identify that individual through multiple steps. First, it would be necessary to know the total number of associates in the firms (in this case 60) in order to translate the 0.6% percentage back into a real number and to conclude that this represents one associate.  Second, it would be necessary to use other publicly available information to determine who this one gay associate is – for example if the individual appeared in diversity videos published by the law firm or talked about experiences of being gay in their LinkedIn profile which also mentions the firm.  

Additionally, the UK MDS does not track the intersection of race/ethnicity with the diversity categories LGBT+, Disability, or Social Mobility. If the associate in the above example is a gay, black male with a disability, the UK MDS does not report on the percentage of gay black male associates with disabilities. It gives one percentage for black male associates, another percentage for gay associates, another for disabled associates, etc.

In the unlikely event that a firm should still have concerns about the identifiability of an individual, they may choose not to report on this individual, either by assigning them a value of “0” or by counting them under “X not disclosed to firm”, as appropriate.

Information collected from client signatories

InterLaw Diversity Forum will have email addresses of the relevant contacts at client signatories in order to allow them to set up an account with unique log-in credentials (username and password) for the UK MDS, in order to access the reports generated from the participating law firms’ D&I data.  

Information collected automatically

InterLaw Diversity Forum and our service partner, the Law School Admission Council, Inc. (“LSAC”) will also have access to platform usage data (e.g., technical data about interactions with the platform) which they will use only for analysis, security, troubleshooting and system improvement purposes.

The platform uses essential cookies (which are small text files of letters and numbers that are stored on your browser or the hard drive of your computer) that are needed for the operation of the UK MDS and to distinguish you from other users. 

How do we use the data collected and what lawful bases do we rely on?

Interlaw Diversity Forum will use law firms’ responses on a confidential basis to generate reports for client signatories. These reports translate the raw numerical data provided into percentages and we provides this information to the client signatories in a user-friendly format on the UK MDS platform. Only certain individuals at client signatories will have access to the platform through secure log-in credentials on a ‘need-to-know’ basis.

In addition, InterLaw Diversity Forum will use the aggregate data collected by the UK MDS to analyse the state of diversity, equity, inclusion and culture in the UK legal profession. While the names of all law firms participating in the UK MDS will be listed in the research findings, all response information will be aggregated and released in a statistical or summary form. We will not report results in its research findings in categories small enough to allow any participating law firm or individuals to be identified directly or indirectly.

InterLaw Diversity Forum relies on the following lawful bases for our own processing of personal data:

  • Processing is necessary for the performance of a task carried out in the public interest (UK GDPR Article 6(1)(f)) (equality of opportunity or treatment and racial and ethnic diversity at senior levels);

  • Processing is necessary for InterLaw’s and the client signatories’ legitimate interests (UK GDPR Article 6(1)(f)) which are not outweighed by the rights and freedoms of individuals. Such legitimate interests include processing in order to: 

    • (i) operate the UK MDS and generate reports for client signatories; and 

    • (ii) ensure network information, security and the efficient running of the UK MDS; and

  • For special category data, processing is necessary for reasons of substantial public interest (UKGDPR Article 9(2)(g)). InterLaw relies on the lawful bases set out in Schedule 1, Part 2, Data Protection Act 2018 relating to the equality of opportunity or treatment, and/or racial and ethnic diversity at senior levels.

 

Participating law firms will be separately responsible for determining their own lawful basis for the processing of personal data by them and sharing such data with InterLaw Diversity Forum. As separate and independent controllers of the personal data being inputted into the UK MDS, law firms will be responsible for informing staff that their data will be shared with InterLaw Diversity Forum for the purposes of the UK MDS and explaining how individuals can exercise their rights under data protection laws.  

 

Who do we share your data with?

Only InterLaw Diversity Forum and LSAC will have access to the raw data firms enter into the UK MDS platform. LSAC is a Delaware not-for-profit testing organisation that provides data storage, platform development and maintenance, support, and training services to Interlaw Diversity Forum.

InterLaw Diversity Forum and LSAC have a contract in place with appropriate data processing provisions and standard contractual clauses for international data transfers, since LSAC is located in the United States.

Both Interlaw Diversity Forum and LSAC have appropriate technical and organisational security measures in place to protect personal data, including only allowing access to the UK MDS to individuals on a need-to-know basis using secure log-in details. LSAC has appropriate technical and security measures in place to protect the personal data it processes on our behalf, for example access controls, encryption, physical security, and information security policies. 

The UK MDS is built on Microsoft Dynamics 365, Power Platform, and PowerBI, a Microsoft suite of tools where security is managed by Microsoft. Microsoft will not itself have any access to the data on the UK MDS under any circumstances and is purely providing the software.

 

How long do we keep your data for?

InterLaw Diversity Forum will delete the data after six years post-participation, and LSAC will delete the data as soon as it’s no longer needed for LSAC to provide us with maintenance or support services.

Participating law firms will be expected to complete the survey annually so that the information on the UK MDS remains as accurate as possible. 

What are your rights?

You have the following rights in respect of your personal data:

 

  • The right to be informed - you have the right to be provided with clear, transparent, and easily understandable information about how we use your data and your rights, which is why we are providing you with this information in this privacy policy.

  • The right of access - you have the right to obtain access to your data and certain other information (similar to that provided in this privacy policy). This is so you are aware and can check that we’re using your data in accordance with data protection law. You can do this by contacting us on the email address provided below.

  • The right to rectification - you are entitled to have your data corrected if it is inaccurate or incomplete. 

  • The right to erasure – this enables you in some circumstances to request and obtain the deletion of your data where there is no legal reason for us to keep using it.

  • The right to restrict processing – you have rights to suspend further use of your data, whereby we can still store your data but cannot use it further.

  • The right to data portability – you have rights in some circumstances to request the transfer of your data to yourself or to a third party.

  • The right to object to processing – you have the right to object to certain types of data processing, including for direct marketing purposes.

  • The right to withdraw consent – where we are relying on consent to process your data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your data with your consent up to that point is unlawful).

 

How can you contact us?

If you wish to exercise your rights in respect of your personal data, or if you have any questions, comments or requests regarding this privacy policy or our data processing practices, please email:

jonathan.leonhart@interlawdiversityforum.org

If you wish to make a complaint about our handling of your personal data, you can  contact the UK’s Information Commissioner’s Office at:

https://ico.org.uk/concerns/handling/ or call on +44 (0)303 123 1113.