Protecting privacy and data – obligations for panel practitioners

The way legal services are delivered is rapidly evolving, shaped by digital communication, remote work, and the growing use of artificial intelligence.

In this changing landscape, panel practitioners undertaking legal aid work must remain vigilant in upholding their legal and ethical responsibilities, particularly around client privacy and data security.

Under clause 8 of our Section 29A Panel Deed, panel practitioners are obliged to comply with the Privacy and Data Protection Act 2014 (Vic).

This includes the information privacy principles (IPP) which govern how personal information must be collected, managed, and protected.

A practitioner’s duty of confidentiality is set out in rule 9 of the Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 (the professional conduct rules).

Panel practitioners must also comply with our Practice Standards.

Top tips for managing privacy and data risks

Here are some steps you can take to better protect client data:

• Use strong passwords, secure encrypted email and messaging with multi-factor authentication.
• Ensure physically secure handling and storage of personal information in your office.
• Check cloud storage settings and limit access to confidential information to authorised personnel only.
• Keep an updated log of staff with access to IT systems and ensure these are current.
• Place cybersecurity measures onto the devices of all team members, including personal phone, tablet and laptop when used for work.
• Check email addresses carefully to prevent emailing client information to the wrong addresses.

Staying informed

Privacy and data protection are always-evolving areas which means panel practitioners need to stay updated about their obligations.

For more guidance and resources, try the following:

• Read about confidentiality and its exceptions on the Victorian Legal Services Board + Commissioner website.
• Discover more privacy resources and IPP guidance from the Office of the Victorian Information Commissioner.
• Read about the importance of preventing 'data leakage' in this Law Institute Journal article by the Legal Practitioners' Liability Committee.

More information

If you are a panel practitioner with a question about your data and privacy obligations, please contact internallegalservices@vla.vic.gov.au