Tribunal Data Privacy Notice

Who We Are

AI Lane Limited (Company No. 17035654), trading as Ailane, is the data controller for the processing described in this notice. The company is incorporated in Wales, registered at Barry, and registered with the Information Commissioner’s Office (ICO Registration No. 00013389720).

Questions about this notice, or requests to exercise the rights in §13, should be directed to our Data Protection Contact at privacy@ailane.ai. AI Lane Limited does not have a Data Protection Officer under Article 37 UK GDPR — our processing does not meet the Article 37(1) thresholds. The Data Protection Contact is the designated point of contact for data subjects and supervisory authorities.

What This Notice Covers

This notice is the Article 14 UK GDPR transparency notice for Ailane’s regulatory intelligence estate, which is derived from published decisions of the UK Employment Tribunal (ET) and Employment Appeal Tribunal (EAT) and from linked company records. Because the personal data in this estate was not obtained from you directly, Article 14 UK GDPR requires us to make the processing transparent through a publicly accessible notice. This notice discharges that obligation.

This notice does not cover personal data we process about visitors to this website, platform subscribers, or people who correspond with us. That processing is addressed in our main Privacy Policy. The two notices are deliberately separate: the main Privacy Policy governs data you give us about yourself; this notice governs data about you that we obtained from the public record. From June 2026 this estate also includes records published by the Health and Safety Executive (HSE) in its public registers of enforcement notices and prosecutions. This notice covers that processing on the same terms, with the HSE-specific safeguards described in §5, §6, §9 and §14.

Where We Get This Data

We use two named public sources, and we do not process personal data for this estate from any other source:

• His Majesty’s Courts and Tribunals Service (HMCTS) — decisions of the Employment Tribunal and Employment Appeal Tribunal, published on GOV.UK under the Employment Tribunals (Constitution and Rules of Procedure) Regulations 2013. These decisions are Crown copyright material made available under the Open Government Licence v3.0.
• Companies House — corporate registration data (company numbers, registered offices, filed accounts where public, officer records within statutory publication limits), used to link tribunal respondents to their registered corporate identity for employer-level analysis. Made available under the Open Government Licence v3.0.
• Health and Safety Executive (HSE) — the public registers of enforcement notices and of prosecutions (convictions), published by HSE pursuant to its statutory functions at resources.hse.gov.uk, covering the period from March 2021 onwards. These registers record enforcement action against employers; the substantial majority of entries concern corporate entities.

If we add a further public-register source to this estate, this notice will be updated to name it before any processing from that source begins. We do not purchase tribunal data from commercial brokers, receive it from third parties in any other form, or obtain personal data directly from data subjects for this processing.

Why We Process This Data

We process personal data from the sources named in §3 for the following purposes:

• Regulatory intelligence. Structured analysis of tribunal decisions to help employers and their professional advisers understand how UK employment law is applied in practice.
• Exposure scoring. Classification of tribunal cases against a structured compliance taxonomy to produce employer-level intelligence describing a company’s tribunal history and compliance posture. This is an analytical description of what the public record shows; it is not a legal judgment about any individual or employer.
• Statistical research. Production of sectoral, geographic, and temporal statistics on tribunal outcomes, award levels, claim types, and procedural patterns. Output is aggregated or anonymised in accordance with §10.
• Knowledge Library content. Provision of evidence-based employment law intelligence through our conversational platform. Individual claimant-identifiable records are not surfaced as search results in the Knowledge Library.
• Commercial licensing under a ratified governance framework. We have ratified a layered contractual framework for licensing structured employer-level intelligence to professional and institutional clients (Master Data Licence Agreement, Data Processing Agreement, Data Sharing Agreement, as applicable), subject to the redaction and restriction commitments in §10. The framework is operative; no live counterparty arrangements are in place at the date of this notice. Any commercial licensing arrangement will, before going live, be supported by a transaction-specific Data Protection Impact Assessment, and where it would involve redistribution of claimant-identifiable records, by a prior written opinion from external counsel.
• Health-and-safety enforcement intelligence (corporate limb only). Structured analysis of HSE enforcement action at employer level. Only corporate entities enter employer-level linkage, aggregation, or any licensed output. Records concerning individual (non-corporate) enforcement subjects are never licensed, never surfaced to clients, and never enter employer linkage; the only processing applied to them is classification, protective suppression, and deletion at the point the conviction becomes spent.

Categories of Personal Data

The personal data we process, as extracted from published tribunal decisions, falls into four structured categories.

Direct identifiers

Names of claimants; names of individual respondents (where the respondent is a natural person rather than a body corporate); names of witnesses disclosed in the published decision; names of judges, judicial panel members, and legal representatives of record.

Professional-capacity data

Job titles; salary and remuneration where disclosed; length of service; employer identity; professional qualifications or roles material to the claim. This category includes data about judges, representatives, and professional witnesses acting in their professional capacity.

Article 9 UK GDPR special-category data

Where a tribunal decision discloses it in the course of adjudicating a discrimination, harassment, or protected-characteristic claim, we may process data revealing racial or ethnic origin, religious or philosophical beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. We process this data only because the published decision itself discloses it, and only on the Article 9 conditions in §6.

Article 10 UK GDPR limited criminal-offence data

In a narrow subset of cases, a tribunal decision may refer to criminal offences, alleged offences, or related proceedings (for example, dismissal for alleged misconduct also subject to criminal investigation). We treat such references as Article 10 data, processed under the same research and statistics condition in §6, and subject to the heightened redaction commitments in §10. We do not compile criminal-offence registers, and we do not process Article 10 data beyond what the published judgment discloses.

HSE enforcement records (Article 10). Prosecution records published by HSE are criminal-offence data. Where the defendant is a natural person (including where a trading style resolves to a natural person), we treat the record as Article 10 data of that person and apply the quarantine described in §4: no client surface, no licensing, no linkage — classification, suppression, and spent-date deletion only. Free-text case narratives that may identify injured or deceased workers are additionally restricted at ingest and are not readable on any deliverable surface.

Our Legal Basis for Processing

Article 6 — lawful basis

Our lawful basis under UK GDPR Article 6(1)(f) is legitimate interests. The legitimate interests we rely upon are:

• providing a structured regulatory intelligence product to UK employers and their professional advisers, in support of their compliance with UK employment law;
• contributing to public transparency of how UK employment law is applied by tribunals, which HMCTS’s own publication of decisions is designed to serve;
• conducting statistical and analytical research on tribunal outcomes.

We have conducted and documented a Legitimate Interests Assessment (LIA). The LIA reflects that the data is already public, is processed predominantly for professional and institutional audiences, and is subject to the safeguards in this notice. The LIA is available to data subjects and supervisory authorities on request.

Article 9 — special-category conditions

Where we process Article 9 special-category data (see §5), we do so on a layered set of conditions:

• Article 9(2)(e) — manifestly made public by the data subject. Where a claimant brings a tribunal claim and pursues it to a public decision, the information relied upon in that claim becomes part of the published decision. We treat that as manifest public disclosure in relation to the subject matter of the claim, recognising the narrow reading in GC and Others v CNIL (CJEU, C-136/17). We do not rely on this condition alone.
• Article 9(2)(g) — reasons of substantial public interest. Read with the statutory conditions in Schedule 1 Part 2 of the Data Protection Act 2018, in particular the conditions relating to equality of opportunity and the prevention or detection of unlawful acts, where applicable to the specific case.
• Article 9(2)(j) — archiving, research and statistics. Read with Schedule 1 Part 1, paragraph 4 of the Data Protection Act 2018, supported by our Appropriate Policy Document (APD) maintained under Schedule 1 Part 4 of the same Act. The APD sets out the safeguards, retention limits, and procedural measures for our research and statistical processing.

Article 10 — limited criminal-offence data

Where Article 10 data is processed (see §5), we rely on the statutory authority of tribunal publication combined with the research and statistics condition in Schedule 1 Part 1, paragraph 4 of the Data Protection Act 2018, subject to the additional safeguards in §10.

For HSE enforcement records, our Article 6 basis is legitimate interests (Article 6(1)(f)), supported by documented Legitimate Interests Assessments for internal linkage and for corporate licensing. For criminal-offence data within those records we rely on DPA 2018 s.10(5) with Schedule 1 Part 2 paragraph 10 (preventing or detecting unlawful acts), and paragraph 11 (protecting the public) in the alternative, scoped to (i) classification of individual records for the purpose of excluding them from commercial processing and (ii) corporate-limb linkage — as set out in our Appropriate Policy Document maintained under Schedule 1 Part 4.

Consent

Consent (Article 6(1)(a), Article 9(2)(a)) is not the lawful basis we rely upon for the processing described in this notice. The right to withdraw consent (Article 7(3) UK GDPR) therefore does not apply. Data subjects retain the right to object under Article 21, as described in §13.

Who We Share Data With

We share personal data from the tribunal estate with the following categories of recipient:

• AI Lane Limited internal personnel. Access is restricted to staff who need it for the purposes in §4.
• Anthropic PBC (our AI processing provider). Anthropic processes personal data on our documented instructions as our data processor for automated extraction and intelligence tasks, under Anthropic’s Data Processing Addendum with standard contractual safeguards. See §8 for the international transfer basis.
• Supabase, Inc. (our database infrastructure provider). Supabase stores the platform’s structured data on our behalf, as our data processor, under its published Data Processing Agreement. The database instance holding tribunal data is physically located in Frankfurt, Germany (EU), with access controls managed by AI Lane Limited.
• Commercial licensees under the ratified framework (no active arrangements). The layered contractual framework for commercial licensing is ratified and operative (see §4): any licensee will be bound by a Master Data Licence Agreement, Data Processing Agreement, and/or Data Sharing Agreement as appropriate to the role each party takes under the UK GDPR. No commercial licensing arrangement is in place as at the date of this notice.

We do not sell personal data. We do not share personal data with advertising networks, data brokers, political organisations, or social media platforms.

International Transfers

Personal data contained in tribunal decisions is transferred to Anthropic, Inc. in the United States for automated extraction and intelligence processing. This transfer is executed under Standard Contractual Clauses (European Commission Module Two, controller-to-processor, Implementing Decision (EU) 2021/914 of 4 June 2021) as supplemented by the UK International Data Transfer Addendum to the SCCs (the ICO Approved Addendum, version B.1.0, laid before the UK Parliament on 2 February 2022 under section 119A of the Data Protection Act 2018). Both instruments are incorporated by reference into Anthropic’s Data Processing Addendum (effective 24 February 2025), which is automatically incorporated into Anthropic’s Commercial Terms of Service and is accepted by AI Lane Limited.

A Transfer Risk Assessment for this transfer is maintained internally and is available to supervisory authorities on request. Technical and organisational measures applied by Anthropic to the transferred data include AES-256 encryption at rest, TLS 1.2+ encryption in transit, multi-factor authentication on all systems with access to Customer Data, and annual third-party security audits; these are set out in Schedule 2 of Anthropic’s Data Processing Addendum.

Our primary database is hosted by Supabase, Inc. (a US-incorporated infrastructure provider) with tribunal data physically stored in Frankfurt, Germany. Supabase’s support and sub-processor chain may, in limited circumstances, involve incidental access from outside the UK and the European Economic Area; such access is governed by the transfer safeguards in Supabase’s published Data Processing Agreement, including Standard Contractual Clauses where applicable to the transfer concerned. All other processing and storage under our direct control takes place within the United Kingdom and the European Economic Area.

How Long We Keep Data

Retention of personal data in the tribunal estate is governed by our Appropriate Policy Document (APD) and is reviewed at least every two years. The APD retention position for tribunal data reflects its institutional-research and public-transparency purpose: the published source material does not itself expire, and long retention is appropriate to the statistical and historical nature of the research. Retention is long, but not indefinite; each biennial review considers whether continued retention remains necessary and proportionate to the purposes in §4, and whether any category of data should be narrowed, suppressed, or removed.

Retention of tribunal data is a distinct regime from the retention of operational telemetry data generated by the Ailane platform itself (such as service performance logs). Operational telemetry is governed by a separate and shorter retention rule (12 months under our current platform configuration). The two regimes should not be conflated: this notice addresses only the tribunal estate.

We correct or remove records where the underlying published judgment is formally withdrawn, anonymised, or made subject to a restriction order by HMCTS or the tribunal concerned. We also action individual erasure requests as described in §13.

HSE prosecution records of natural persons are subject to an automated rehabilitation-period engine: when a conviction becomes spent under the Rehabilitation of Offenders Act 1974 (England and Wales, as amended) or the Management of Offenders (Scotland) Act 2019, or is removed from the HSE register if earlier, the record is deleted from our estate to an audit ledger. Where the applicable rehabilitation period cannot be determined, the record is suppressed.

Redaction & Anonymity

We apply the following commitments to tribunal data throughout our processing:

• Restricted Reporting Orders (RROs). We comply with all Restricted Reporting Orders made by the Employment Tribunal under Rule 50 of the Employment Tribunals Rules of Procedure 2013. Records subject to an RRO are programmatically suppressed from all external outputs. We monitor HMCTS sources for newly-issued RROs and apply suppression on resynchronisation.
• Sexual Offences (Amendment) Act 1992. The lifetime anonymity provisions of the Sexual Offences (Amendment) Act 1992 apply in any tribunal case arising from or relating to a sexual offence allegation. We enforce anonymity in our outputs in all such cases.
• Professional-capacity framing. Data about judges, legal representatives, and professional witnesses is processed in their professional capacity; we apply a neutral-framing rule to references to such individuals in outputs.
• Commercial-output redaction schema. Any commercial output that includes or derives from tribunal data is produced under a structured redaction schema: individual claimant names are not surfaced in commercial outputs, save where a specific, documented licensing purpose justifies it under the preconditions set out in the fifth bullet below (prior counsel opinion and transaction-specific DPIA); quasi-identifiers (such as age or exact salary) are banded where appropriate; and outputs are scoped to professional recipients operating under contractual confidentiality.
• No commercial redistribution of claimant-identifiable records without prior counsel opinion and transaction-specific DPIA. Any prospective commercial licensing (see §4) that would involve redistribution of claimant-identifiable records requires, in advance, a written opinion from external counsel and a transaction-specific Data Protection Impact Assessment. This is a standing commitment, not a future aspiration; no such redistribution occurs without those two prerequisites.

Automated Decision-Making

We do not use the tribunal estate to make automated decisions that produce legal effects, or similarly significant effects, concerning the data subjects whose personal data is contained in that estate.

Our processing includes automated analytical classification of tribunal cases (for example, against a structured compliance taxonomy) for the statistical and intelligence purposes described in §4. That classification is an analytical description of what a tribunal decision records; it is not a decision about any individual data subject. No individual claimant, respondent, witness, or representative is the recipient of an automated decision made by Ailane on the basis of data in this estate. Article 22 UK GDPR therefore does not engage in relation to the processing described in this notice.

If, at a future date, we introduce any processing that would constitute automated decision-making with legal or similarly significant effects on individual data subjects, this notice will be updated to describe it, the logic involved, the significance, and the consequences — and the Article 22 safeguards (including the right to human intervention and contestation) will be implemented before such processing commences.

Children’s Data

Tribunal decisions may, in rare cases, refer to minors — typically as dependants, family members, or witnesses, and occasionally as claimants in employment matters where a young person’s work was in issue. We operate ongoing checks to identify and remove minor-identifier fields from the estate, applied to records where a data subject can be identified as having been a minor at the time of the tribunal matter. Where a minor’s data appears in a published judgment and is not necessary for the research and statistical purposes described in §4, the minor-identifying fields are redacted in accordance with our Appropriate Policy Document. We do not knowingly process personal data relating to minors beyond what the published judgment itself discloses.

If you are, or were at the time of the tribunal matter, under the age of 18, and you believe personal data relating to you is held in our estate, please contact privacy@ailane.ai. We will treat your request under a priority erasure review.

Your Rights

Under the UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, contact us at privacy@ailane.ai. We will acknowledge your request within 5 working days and respond substantively within one month of receipt, as required by Article 12(3) UK GDPR.

• Right of access (Article 15). You may ask for a copy of the personal data we hold about you in the tribunal estate, along with information about how we process it.
• Right to rectification (Article 16). Where our records inaccurately reflect the published judgment, we will correct them. Where the published judgment itself is disputed, you should contact the tribunal that issued it.
• Right to erasure (Article 17). You may ask us to delete your personal data. We assess each request on its individual merits, considering the age of the judgment, the sensitivity of the data, the continued availability of the underlying judgment on official registers, and the balance between your interests and the legitimate interests set out in §6. Where a judgment has been withdrawn or anonymised on the official register, erasure in our records follows.
• Right to restriction (Article 18). You may ask us to restrict processing while we consider an objection or rectification request.
• Right to portability (Article 20), where applicable. Portability applies where processing is based on consent or contract and is carried out by automated means. Because our lawful basis is legitimate interests (Article 6(1)(f)), portability will typically not apply to this processing. Where it does apply in a specific case, we will provide the data in a structured, commonly used, and machine-readable format.
• Right to object (Article 21). You may object to our processing on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

These rights are exercisable free of charge in the ordinary course. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, as provided by Article 12(5) UK GDPR; we will explain our reasoning if we rely on that provision.

Suppression in respect of JIPA Outputs

If we license structured intelligence to a professional or institutional counterparty under the framework described in §4 and §7 (a “JIPA Output”), you have the right to ask us not to include your data in any future JIPA Output, or to ask us to instruct counterparties to suppress your data from JIPA Outputs already released. To make such a request, contact privacy@ailane.ai and include enough information for us to identify you within the published tribunal record (typically your name as it appears in the decision and a date of birth or claim reference).

We honour suppression requests through an operational subject-rights workflow that records the request, verifies it, applies the suppression at the point any future JIPA Output is generated, and notifies any counterparty who previously received a JIPA Output covering you. We retain a point-in-time record of the suppression state so that, if a question arises later about what was suppressed and when, the answer is reproducible from our records. Acting on a request does not modify the source tribunal record itself, which remains a matter of public legal record on GOV.UK and the Employment Appeal Tribunal site as discussed in §3.

This suppression mechanism is in addition to your other rights described above; it is specific to the JIPA Output processing route and does not limit any right you have under UK GDPR generally.

Why We Have Not Contacted You Directly

Article 14(5)(b) UK GDPR exempts a controller from the obligation to provide individual notice to data subjects where the provision of such information would prove impossible or would involve a disproportionate effort. The Ailane tribunal estate contains personal data relating to in excess of 210,000 individual data subjects (claimants, respondents who are natural persons, witnesses, and representatives identified across more than 131,000 tribunal decisions). Individual notification to each data subject is not feasible: we do not hold contact details for the vast majority of these individuals, obtaining contact details would itself be a disproportionate processing activity, and many data subjects may no longer be reachable at addresses disclosed in decisions from earlier years.

We discharge the Article 14 transparency obligation through this public notice, which is permanently accessible on our website and is linked from our main Privacy Policy and Terms of Service. This approach is consistent with the guidance in Recital 62 UK GDPR, which envisages public transparency measures in precisely these circumstances. The notice is reviewed at least annually and whenever there is a material change to the processing (see §16).

HSE prosecution records. For natural persons identified as prosecution subjects in the HSE register, we do not rely on Article 14(5)(b): each identified individual receives direct postal notice. For the residual population — records where no natural person is identifiable, or no current service address is obtainable with proportionate effort — we rely on Article 14(5)(b) on the basis of a documented cohort-specific assessment (AILANE-ASSESS-ART14-HSE-001), with this public notice serving as the Recital 62 transparency measure. Any member of that residual population who becomes identifiable and reachable is moved to direct notice.

Complaints

If you are concerned about how we handle your personal data, you have two independent complaint channels. You may approach either channel first. You are not required to raise the matter with us before approaching the ICO: Article 77 UK GDPR gives you a direct right of complaint to the supervisory authority.

Internal channel — AI Lane Data Protection Contact

For data subjects who prefer to engage with us directly in the first instance:

• Email: privacy@ailane.ai
• Acknowledgement: within 5 working days of receipt
• Substantive response: within one month of receipt (Article 12(3) UK GDPR), extendable by up to two further months for complex cases, with explanation

Regulatory channel — Information Commissioner’s Office

You have a direct right under Article 77 UK GDPR to complain to the UK Information Commissioner. You can reach the ICO through any of the following:

• Complaint portal: https://ico.org.uk/make-a-complaint/
• Website: ico.org.uk
• Telephone: 0303 123 1113
• Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You may also, in addition to or instead of the above, seek a judicial remedy under Article 79 UK GDPR.

Attribution & Review

Attribution

The tribunal intelligence estate contains public sector information licensed under the Open Government Licence v3.0. Parliamentary information in other parts of the Ailane platform (bills, Hansard, committee proceedings) is licensed under the Open Parliament Licence v3.0.

Review cycle

This notice is reviewed at least once every twelve months, and whenever there is a material change to the processing, the sources, the recipients, the international transfer position, or the retention regime. The version number, last review date, and next scheduled review date are shown at the top of this page and in the footer. Material changes will be signposted in a brief change log on review.

Change log

• Version 3.0 — 12 June 2026 (AMD-182 · CEO-RAT-DIFF-PRIVACY-HSE-001). Added the Health and Safety Executive public registers as a named source (§3) before any new-source processing, honouring the §3 commitment. Added the HSE enforcement-intelligence purpose with individual-record quarantine (§4, §5), the DPA 2018 Schedule 1 conditions and Appropriate Policy Document reference (§6), the spent-date deletion engine (§9), and the HSE direct-notice / residual-cohort Article 14 position (§14). Governing instruments: AMD-177 to AMD-180; Condition C2 of AILANE-OPINION-HSE-EMPLOYER-LINK-001.
• Version 2.1 — 25 April 2026 (AMD-094). Updated §4 and §7 to reflect that the layered contractual framework for commercial licensing of structured employer-level intelligence (Master Data Licence Agreement, Data Processing Agreement, Data Sharing Agreement) has been ratified and is operative under AILANE-SPEC-JIPA-GRD-001 v1.2. No live counterparty arrangements are in place. Added §13 sub-section on the operational subject-rights workflow for JIPA Output suppression. Synchronised the visible version stamps (badge, header, footer): the deployed page had retained v1.0 stamps while body content reflected the AMD-087 update of 24 April 2026; v2.1 supersedes the deployed v1.0 stamps directly.