DAC6: The challenges around legal professional privilege in the UK

Legal professional privilege (LPP) is an extremely complicated topic that requires subject matter expertise. When you add DAC6 regulations to the mix, things get even more challenging. 

Back in June 2020, following consultations with leading counsel, the Law Society released guidance on their approach to LPP and DAC6. A summary of this document can be found here. HMRC has reviewed the Law Society guidance, and while they cannot endorse it, they have said they have no particular concerns about the Law Society’s view. 

VinciWorks is working closely with over 40 firms to implement a DAC6 reporting tool. Below are some of the questions firms are discussing when thinking about the effect of LPP on DAC6 reporting:

  1. What is considered to be “confidential communications, and material evidencing such communications”? If information from an arrangement comes from a transaction document that is available to multiple parties (such as a Share Purchase Agreement), and not from the client themselves, will this make an arrangement reportable under DAC6? This is especially relevant when reviewing arrangements from the historical backlog period.
  1. At what point in the DAC6 analysis should the LPP question be examined? Should this be before or after an arrangement is identified as reportable?
  1. How should you approach privilege when you are dealing with multiple jurisdictions? Different jurisdictions have different LPP rules, which need to be analysed depending on where a firm is reporting the arrangement. A firm might be able to rely on LPP in one jurisdiction and not in another.
  1. What type of waiver should a firm request from its clients? Should this be a full waiver or a limited waiver to report when there is no other intermediary involved?
  1. When and how should a law firm enquire whether another intermediary is involved in an arrangement? Should they ask the client or the other intermediaries? Is this act considered a breach of LPP?
  1. What does the Law Society mean when they say that in “most cases” a lawyer is prevented by LPP from making a notification to another intermediary? In which instances would they be required to notify another intermediary?
  1. At what point should you inform the client that you are making a DAC6 report about an arrangement they are involved in? Should the client be consulted before you send the report?

VinciWorks’ DAC6 reporting solution

Interpretation of LPP and DAC6 is difficult. The flexibility of VinciWorks’ DAC6 reporting solution allows you to decide at which point in your DAC6 analysis you want to examine LPP in each jurisdiction your firm is dealing with. VinciWorks’ in-house subject matter experts are here to help you to find a workflow that suits your firm’s approach to DAC6 and LPP in line with industry best practice.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.