Data Privacy Complaints Procedure

1. Purpose and scope

1.1 This procedure explains how to complain to The First Counsel (the "firm", "we", "us") about its handling of personal information, and what the firm will do when you do. It gives effect to, and expands, section 16 of the Website Privacy Policy published at thefirstcounsel.com/privacy (the "Privacy Policy"). The firm's office is at 8th Floor, Askari Corporate Towers, Lahore, Punjab, Pakistan; its email address is [email protected].

1.2 What it covers. The procedure applies to complaints about: (a) information handled in connection with the website — technical data, correspondence, recruitment applications, and any future event registrations, as those categories are defined in the Privacy Policy; and (b) personal information the firm handles in the ordinary administration of its practice — its dealings with correspondents, applicants, suppliers, and personnel. It applies however the information reached the firm, through the website or by any other route.

1.3 What it sits beside, without displacing. Complaints touching information held within a client engagement are subject to section 8, because privilege and professional confidence constrain what the firm can say to anyone other than the client. And nothing here displaces, delays, or is a precondition to any other remedy: the professional-conduct jurisdiction of the Pakistan Bar Council and the Provincial Bar Councils, and the ordinary jurisdiction of the courts, remain available at all times — before, during, or instead of this procedure (see section 7).

1.4 The legal setting, stated plainly. As at the effective date of this procedure ([EFFECTIVE DATE — ON PUBLICATION]), Pakistan has no comprehensive data-protection statute in force and no data-protection authority to receive complaints. The firm operates this procedure as stated professional practice, not statutory compulsion, and will conform it to the anticipated legislation described in the Privacy Policy when enacted.

1.5 A complaint is not a request. If you want access to your information, its correction, or its deletion, use the request procedure in section 11 of the Privacy Policy. A complaint is for dissatisfaction — with how your information was handled, or how a request was answered. A refused or mishandled request may of course become a complaint.

2. Who may complain

2.1 Any person who believes the firm holds or has handled personal information about them may complain: a visitor to the website, a correspondent, an enquirer whose matter the firm did not take, a job applicant, a registrant for any future firm event, a supplier's employee, a present or former member of staff, or a client. No prior or continuing relationship with the firm is required.

2.2 A complaint may be brought through an authorised representative — a family member, an advocate, or anyone else — provided they supply evidence of authority to act. A parent or guardian may complain on behalf of a person under eighteen.

2.3 Making a complaint does not create an advocate–client relationship, and nothing said in the course of one is legal advice.

3. How to complain

3.1 By email. Write to [email protected] with the subject line "Data Privacy Complaint". The subject line is a routing convention: it ensures the message reaches the partner responsible under section 5 rather than waiting in a general inbox. A complaint without it is still a complaint, but the convention gets you there faster.

3.2 By post. Write to The First Counsel, 8th Floor, Askari Corporate Towers, Lahore, Punjab, Pakistan, marked for the attention of [PARTNER RESPONSIBLE FOR DATA PROTECTION — TO BE CONFIRMED BY THE FIRM].

3.3 What to include. Say, as far as you can: (a) who you are and how the firm should respond to you; (b) what information of yours the firm holds, and how it came to hold it — an email, an application, a registration; (c) what the firm did or failed to do, and when; (d) why that troubles you; and (e) what outcome you seek. Attach relevant correspondence if you have it, and say whether you have raised the matter before and what came of it.

3.4 No fee, no form. There is no charge, at any stage, and no prescribed form; a plain email meets every requirement. Complaints may be made in English or Urdu.

3.5 Identity. The firm may ask you to verify your identity, or a representative's authority, before discussing information it holds — a proportionate step, since answering a complaint by disclosing one person's information to another would itself be the kind of failure this procedure exists to address. Verification will not be used to discourage or delay a complaint.

4. Acknowledgment and timeline

4.1 The firm will acknowledge a complaint in writing within [5 — TO BE CONFIRMED BY THE FIRM] business days of receiving it, naming the handler and, where identity verification is needed, saying exactly what is required.

4.2 The firm will give a substantive written response within [30 — TO BE CONFIRMED BY THE FIRM] days of receipt or, where verification was required, of verification, addressing the matters in paragraph 5.5.

4.3 Complex matters. Where a complaint requires more than the usual investigation — many records, several personnel, questions of privilege under section 8 — the firm may extend the period in paragraph 4.2 once, by no more than [30 — TO BE CONFIRMED BY THE FIRM] further days. An extension is not silent: the firm will say within the original period that it is extending, why, and by what date you will now hear.

4.4 If the firm needs further information from you to investigate, it will ask once, clearly, and the time you take to answer does not count against the periods above — which the firm will say when it asks.

4.5 These periods are intended to align with sections 11.2.2 and 16.2 of the Privacy Policy. If the documents ever state different periods for the same step, the shorter governs until the inconsistency is amended away.

5. How complaints are handled

5.1 A responsible partner. Every complaint under this procedure is owned by [PARTNER RESPONSIBLE FOR DATA PROTECTION — TO BE CONFIRMED BY THE FIRM] (the "responsible partner"), accountable for the investigation, the response, and the section 4 deadlines, whoever else assists.

5.2 Independence from the matter. A complaint is not investigated by the people it concerns. Where it involves a particular matter team or individual, the responsible partner investigates provided he or she had no involvement in the events complained of; otherwise the firm assigns another partner with no such involvement. The person investigating decides the outcome; the people investigated do not.

5.3 What the investigation involves. The investigator reads what you sent, gathers the relevant records, speaks to the personnel concerned, and tests what happened against the Privacy Policy, this procedure, the firm's professional obligations, and the law in force in Pakistan. The standard applied is what the firm has publicly committed to — not the minimum an unenacted statute would one day require.

5.4 Confidentiality of the complaint itself. The complaint, your identity, and the investigation are disclosed within the firm only to those who need them to investigate and respond. A complaint is not placed on any client file, is not mentioned to clients or third parties, and is not shared outside the firm except with its professional advisers or insurers where genuinely necessary, under obligations of confidence, or under legal compulsion (section 7.2 of the Privacy Policy).

5.5 The response. The substantive response will state: what was investigated; what the firm found, with reasons; whether the complaint is upheld, upheld in part, or not upheld; the remedy under section 6; and the escalation routes in section 7. Where section 8 limits what can be disclosed, the response will say that limits apply rather than write around them silently.

6. Outcomes and remedies

6.1 A complaint ends in one of three findings — upheld, upheld in part, or not upheld — and every finding comes with reasons. No complaint is dismissed without an explanation.

6.2 Where a complaint is upheld in whole or part, the remedies available include, as the case requires:

(a) correction of inaccurate or incomplete information;

(b) deletion of information that should not be held, subject to the overriding grounds in section 9.3 of the Privacy Policy — a legal hold or statutory retention will be stated, not assumed;

(c) restriction — confining a particular use of information, or stopping it altogether;

(d) an apology and an account — a plain statement of what went wrong, because a person whose information was mishandled is owed an explanation, not merely a fix;

(e) a change of process — amending the practice that allowed the failure, training the personnel involved, and, where the failure exposed a gap in the Privacy Policy or this procedure, amending the document; and

(f) notification — where the failure affected other identifiable people or triggered the incident provisions of section 10.4 of the Privacy Policy, telling those affected.

6.3 This procedure does not award monetary compensation; that is a matter for the courts under the general law of Pakistan. Nothing in it, and no outcome under it, bars or prejudices any claim you may choose to pursue.

7. Escalation

7.1 Internal review. If you are dissatisfied with the substantive response, you may ask, within a reasonable time of receiving it, for review by a senior partner who was involved in neither the events complained of nor the original response. Ask by replying to the response, or by writing to the contact in section 11 with the subject line "Data Privacy Complaint — Review". The review is conducted once, on the papers unless the reviewer decides otherwise, and its outcome — with reasons — is the firm's final internal word.

7.2 The regulator, when there is one. As at the effective date, Pakistan has no data-protection authority, because the statute that would create one has not been enacted. The draft Personal Data Protection Bill proposes a national commission for personal data protection. If and when such a commission — or any other statutory authority with jurisdiction over the firm's handling of personal information — is constituted, complaints will lie to it whether or not you have used this procedure, and this section will be amended to name it.

7.3 The Bar Councils. Where the conduct complained of, if established, would breach the duties advocates owe under the Legal Practitioners and Bar Councils Act, 1973 and the canons of professional conduct framed under it, you may complain to the Pakistan Bar Council or the relevant Provincial Bar Council. That jurisdiction is independent: you need not use this procedure first, and using it does not affect your standing there.

7.4 The courts and the criminal law. The remedies the general law of Pakistan provides remain open, including proceedings before the courts and, where conduct may amount to an offence under the Prevention of Electronic Crimes Act, 2016, complaint to the agencies designated under that Act. This procedure is offered as the fastest route to a remedy, not as a gate in front of any other.

7.5 Complainants in GDPR jurisdictions. Nothing in this procedure limits any right you hold under your local law, including any right to complain to your local supervisory authority about parties subject to that law.

8. Complaints touching privileged client matters

8.1 Information the firm holds within a client engagement is protected by the confidentiality obligations advocates owe under the Legal Practitioners and Bar Councils Act, 1973 and the canons framed under it, and by the privilege recognised by Articles 9 and 12 of the Qanun-e-Shahadat Order, 1984. The privilege belongs to the client, not to the firm, which can neither waive nor erode it to answer a complaint.

8.2 What this means if you are not the client. Where your complaint touches a client matter, the firm may be unable to confirm or deny that it holds particular information, to describe what a matter file contains, or to disclose findings that would reveal privileged or confidential material. The response will say that such limits apply, and everything that can lawfully be said within them — but the firm will not breach a client's confidence to satisfy a complaint, however sincere.

8.3 What this means if you are the client. A client's concerns about their own matter are ordinarily raised with the partner responsible for the engagement, under its terms. This procedure remains available for the data-handling dimension of a concern, and a client — as holder of the privilege — may authorise fuller disclosure to enable a fuller written outcome.

8.4 Privilege is a limit on disclosure, not on investigation. These constraints govern what the firm can tell a third-party complainant; they do not narrow what it examines. The investigating partner will look at everything relevant, privileged or not; any failure found will be remedied under section 6 even where the outward response must remain limited.

9. No retaliation

9.1 No one suffers adverse treatment at the firm's hands for complaining in good faith under this procedure. An enquiry will not be answered more slowly, an application assessed less favourably, an engagement conducted less diligently, or a member of staff disadvantaged, because its subject complained about the handling of their information.

9.2 A complaint made in good faith that turns out to be unfounded attracts the same protection as one that is upheld. Being wrong is not bad faith; neither is being persistent.

9.3 The firm may decline to re-investigate a complaint manifestly repetitive of one already answered, or one that is vexatious, and will give written reasons when it does — the standard in section 11.2.2 of the Privacy Policy. Disagreement with an outcome is neither repetition nor vexation; the route for disagreement is section 7.

10. Records of complaints

10.1 The firm keeps a record of each complaint: the date received, the complainant, the substance, the investigation, the outcome, the remedy, and any review under section 7.1. The record exists so the firm can demonstrate how the complaint was handled and so that patterns across complaints inform its practices.

10.2 Complaint records are retained for 36 months from closure, consistent with the schedule in section 9.2 of the Privacy Policy, then deleted subject to the overriding grounds in its section 9.3.

10.3 Complaint records are held confidentially on the terms of paragraph 5.4, are not used for marketing or any purpose adverse to the complainant, and are reported internally only in aggregate. The record of your complaint is itself personal information; the rights in section 11 of the Privacy Policy apply to it.

11. Contact

11.1 Complaints, review requests, and questions about this procedure should be addressed to:

The First Counsel Attention: [PARTNER RESPONSIBLE FOR DATA PROTECTION — TO BE CONFIRMED BY THE FIRM] 8th Floor, Askari Corporate Towers, Lahore, Punjab, Pakistan Email: [email protected] (subject line "Data Privacy Complaint"; for reviews, "Data Privacy Complaint — Review") Telephone: [TELEPHONE — TO BE CONFIRMED BY THE FIRM]

11.2 This procedure takes effect on [EFFECTIVE DATE — ON PUBLICATION] and will be amended as section 15 of the Privacy Policy describes — above all, when Pakistan's anticipated data-protection legislation is enacted and a statutory complaints route exists to be named. Earlier versions are retained and provided on request.