Canter Levin & Berg Solicitors

Scope

This policy applies to anyone whose personal data is processed by us where UK data protection law applies.

It covers complaints relating to:

• How your personal data is collected, used, shared or retained
• The accuracy of your personal data
• The security of your personal data
• Handling of your data subject rights request
• Subject Access Request Internal Reviews
• Delays or failures in responding to data subject rights requests
• Alleged breaches of data protection law
• Any other concerns about how personal data is handled

What is out of scope:

• General service complaints not relating to personal data. Please see our complaints procedure in this regard.

We may decline to take further action on complaints that are a duplication of an existing complaint or that are manifestly unfounded or excessive, taking into account the requirements of applicable data protection law.

Our commitment

We will:

• Treat all complaints seriously and respectfully
• Handle complaints promptly and fairly
• Keep complainants informed throughout the process

How to make a data protection complaint

You can submit a complaint to us through either of the following:

• Email – complaints@canter-law.co.uk
• Post – Complaints, Canter Levin & Berg, St. Nicholas House, Old Churchyard, Liverpool L2 8TX

Any expression of dissatisfaction about how we have handled your personal data will be treated as a complaint.

Time limits for submitting a data protection complaint

• If you want to make a data protection complaint, then you should do so within three months of becoming aware of the issue.
• If you are unhappy about how we’ve responded to your subject access request (SAR), then you should do so within 40 working days.

Waiting longer than these prescribed time limits could affect our ability to look into your complaint. In some cases, a long delay will mean that we will not consider the matter at all.

We may still consider complaints submitted outside these time limits where there are extenuating circumstances and it is reasonable to do so. To ensure that serious concerns are not excluded solely because the time limit has expired, we may consider older complaints where:

• there is an ongoing risk of harm to data subjects
• there are safeguarding concerns, for example where the complaint relates to the processing of children’s or vulnerable adults’ personal data
• there is evidence of a systemic failure

The process

If you are concerned about how we have handled your personal data, you can submit a data protection complaint.

• Stage 1: Initial Handling What happens:
  • We will acknowledge your complaint promptly, generally within three working days.
  • We will review your complaint, and we may contact you for clarification concerning any issues raised.
  • We will investigate the matter.
  • We keep you updated at key stages.
  • We aim to respond as promptly as practicable and ordinarily within one month. More complex complaints may take longer

  There is likely to be a wide range of factors that influence how long your investigation takes. These can include the following:

  • the complexity of the issue
  • the scale of the issue
  • any harm that the complainant is suffering as a result of an unresolved issue

  The time it takes to investigate and complete your case is indicative and may change depending on the above.

  The investigation:

  We will make reasonable and proportionate enquiries, having regard to the circumstances of each complaint.

  We will investigate your concerns and assess compliance with all relevant data protection legislation and regulation (such as the UK GDPR, the DPA 2018, the DUAA 2025, and the PECR 2003), ICO guidance and any of our policies that may be applicable.

  The Outcome:

  You will receive a written response explaining:

  • what we found
  • any actions taken
  • our outcome.

  Stage 2: Review

  If you are not satisfied with the Stage 1 response, you can ask for the complaint to be escalated to Stage 2 for review.

  How to escalate:

  • Contact our Data Protection Officer (DPO) to request escalation within 30 calendar days of receiving the Stage 1 response. Our Data Protection Officer is currently Martin Malone (0151 239 1003/martinmalone@canter-law.co.uk).

  What happens:

  The DPO will:

  • conduct an independent review of the complaint
  • request further information from the data subject or internally, where necessary
  • issue a final outcome within three (3) months (unless your case is complex), including information about escalation to the ICO. Complex complaints may take longer to investigate

  Escalation to the Information Commissioner’s Office (ICO)

  If you remain dissatisfied after Stage 2, you have the right to complain to the ICO.

  While you can complain to the ICO at any point, the ICO may expect individuals to have attempted to resolve concerns directly with the organisation before seeking regulatory intervention. The ICO has published its Data Protection Framework which sets out how they handle data protection complaints, including how they determine if they will investigate a complaint.

  ICO contact details:

  • Website: ico.org.uk/make-a-complaint
  • Phone: 0303 123 1113
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Subject Access Request (SAR) internal reviews

If you are unhappy with how we have responded to your Subject Access Request (SAR), you may request an internal review by our Data Protection Officer (DPO). The purpose of the review is to independently assess whether your SAR was handled fairly, lawfully and in accordance with applicable data protection law, ICO guidance and, if applicable, our procedures.

Requesting a SAR Internal Review

Requests for a SAR Internal Review should normally be made within 30 working days of receiving the SAR response. Requests submitted after this timeframe may not be accepted.

Information about how to request a review will be included in the SAR response.

What the Internal Review Covers

The internal review will consider matters such as:

• how the SAR was interpreted and scoped;
• whether reasonable and proportionate searches were carried out;
• whether any exemptions or restrictions were appropriately applied;
• whether the response was provided within applicable timeframes; and
• whether communications were handled clearly and appropriately.

The review is not intended to repeat the original SAR process or automatically rerun searches. However, where appropriate, we may take additional steps or provide supplementary information if issues are identified during the review.

Outcome of a SAR Internal Review

We will provide a written outcome explaining:

• the findings of the review;
• whether the original SAR response is upheld or amended; and
• any further action we consider to be appropriate.

We aim to complete SAR Internal Reviews as promptly as practicable and ordinarily within three months, although complex cases may take longer.

Escalation to the Information Commissioner’s Office (ICO)

If you remain dissatisfied following the SAR Internal Review, you have the right to complain to the ICO.

ICO contact details:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

9. Contact Details

Data Protection Officer, Canter Levin & Berg

• Email: martinmalone@canter-law.co.uk
• Post: Data Protection, Canter Levin & Berg, St. Nicholas House, Old Churchyard, Liverpool L2 8TX

How to contact us

If you have any questions or comments, wish to complain, or simply need more information, please contact our director responsible for dealing with complaints:

MARTIN MALONE
CANTER LEVIN & BERG,
ST. NICHOLAS HOUSE,
OLD CHURCHYARD,
LIVERPOOL
L2 8TX

T: 0151 239 1003
E: complaints@canter-law.co.uk

Policy review

We review this Data Protection Complaints Policy every two years, or sooner where necessary to reflect changes in legislation, regulation, or guidance issued by the ICO.