Data Protection (Jersey) Law
The Data Protection (Jersey) Law 2018 is an information privacy law in the Crown Dependency of the Bailiwick of Jersey, one of the Channel Islands. The latest version is 2018, updating the previous law from 2005 to mirror the General Data Protection Regulation (GDPR). It was adopted on 25 May 2018.[1]
The law
[edit]Eight Principles Data must be...
- fairly and lawfully processed
- processed for one or more specified and lawful purposes
- adequate, relevant and not excessive
- accurate and up to date
- not kept longer than necessary
- processed in accordance with the individual’s rights
- kept safe and secure
- not transferred to countries outside European Economic area unless country has adequate protection for the individual.
Rights of Individuals
- Rights of access
- Rights to prevent processing
- Rights to prevent processing for direct marketing
- Rights in relation to automated decision-taking
- Right to seek compensation
- Rights to have inaccurate information corrected
- Right to complain to the Commissioner
The law implements the European Data Protection Directive of 24 October 1995, which concerns the "protection of individuals with regard to the processing of personal data and on the free movement of such data". These include restrictions on the gathering, collection, and use of personal data, as well as forcing data collectors to let individuals know how their data has been used.[1][3] Gatherers of data are called "data controllers" and must register with the Data Protection Commissioner and pay a yearly fee.[4][2] The law also contains numerous exemptions for journalism, crime investigation, &c.[5] Other Crown dependencies like Guernsey and the Isle of Man have similar laws.[1] The 2005 law was modelled from the UK's Data Protection Act 1998.[4][1] These laws can all trace lineage back to the European Directive on Data Protection, 95/EC/46 of 1995 and the Council of Europe's European Convention 108, passed in 1981.[6][7]
The 2005 overhaul of the Data Protection laws was prompted by the aforementioned Data Protection Directive. It restricted the transmission of protected data to countries outside of the European Economic Area unless they had been certified as having 'adequacy' in their own data protection laws.[4][8] Jersey is considered outside of the European Economic Area, and its 1987 Data Protection law was not adequate, so the restrictions could have harmed Jersey's financial services industry.[4] (Jersey is a major international offshore financial centre[9] and tax haven[10]) In 2008, Jersey achieved 'adequacy status' under the EU rules.[11][12]
Jersey's law is modified to suit this finance industry.[1] One such modification exempts trusts from the law so that they can use the personal information of beneficiaries of the trust without having to disclose certain details of the usage to the beneficiary. This modification was accomplished through a revision called the "Subject Access Exemptions" in 2005.[1][13]
The main office of the law is the Data Protection Commissioner[5][14] (before 2005, called the Data Protection Registrar).[5] The commissioner for the first several years of the law was Emma Martins[4][15] There is also a Data Protection Tribunal.[5] In 2011 an attempt was made to unify the Commission of Guernsey with that of Jersey so that one Commissioner office would serve both Channel Islands.[15]
Notable cases
[edit]In 2007 charity groups had to change the way they operated the Jersey Christmas Appeal because they kept a list of the families who were nominated to receive vouchers for food, toys, fuel, and other needs during the holidays. The beneficiaries had to send in signed forms agreeing to be on the list.[16]
The law has been used at least two times against Jersey politicians.
In 2009, Jersey Senator Stuart Syvret was arrested on charges of violating the law after he blogged an old 1999 police report on a suspected serial killer and rapist Nurse that included the suspect's name. The police investigation had been abandoned for lack of evidence and Syvret had at first accepted this. However over the years Syvret came to believe the government of Jersey was incompetent and corrupt, especially after his experiences as Health Minister during the Jersey child abuse investigation 2008. He came to believe that the "Nurse M"[17] (or "Nurse X" in court documents) investigation had been incomplete, that the suspect was still dangerous. This was his alleged motivation for blogging the suspects name in 2009.[18] At trial he argued that his actions fell under the exemptions of the Law, but the Magistrate rejected this. In November 2010 he was convicted of violating Articles 17, 21, and 55 of the Data Protection Law and sentenced to 10 weeks imprisonment and a fine. Assistant Magistrate Bridget Shaw gave the analysis and opinion:[18][19]
"he must have caused distress to X and his family and risked provoking violence either by or against X. The defendant also risked causing great distress to relatives of the deceased. In my opinion this was done to create a totally unfounded scandal to undermine public confidence in the administration of justice."[18]
In 2011, Saint Brélade Deputy and Housing Minister Sean Power was forced to resign after he forwarded an email he pulled off a printer in the States Building. The email discussed Syvret.[20]
External links
[edit]- Text of the Law as it was enacted, from jerseylaw.je
- Current law as amended
- Office of the Information Commissioner, Jersey
- A MASS-MURDERER Archived 21 April 2012 at the Wayback Machine, the 2009 blog posting over which Syvret was convicted.
References
[edit]- ^ a b c d e f Jersey: Data Protection In Jersey And Other Offshore Jurisdictions 23 July 2008 Article by Wendy Benjamin, mondaq.com, retrieved 2012-09-14
- ^ a b c Annual Reports Archived 16 July 2006 at the Wayback Machine, 2006, Office of the Data Protection Commissioner, Jersey, retrieved 2012-9-15
- ^ See the UK Act data protection article for a complete breakdown of the Eight Principles
- ^ a b c d e Annual Reports Archived 16 July 2006 at the Wayback Machine, 2005, Office of the Data Protection Commissioner, Jersey, retrieved 2012-9-15
- ^ a b c d "DATA PROTECTION (JERSEY) LAW 2005". Jersey Legal Information Board. Retrieved 30 March 2022.
- ^ A Brief History of Data Protection in Jersey Archived 28 August 2006 at the Wayback Machine, Jersey Office of the Data Protection Commissioner. retrieved 2012-9-14
- ^ Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data Council of Europe, Strasbourg, 28.I.1981, coe.int, retrieved 2012-9-14
- ^ Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Eur-Lex.europa.eu, retrieved 2012-9-15
- ^ "The Global Financial Centres Index 8" (PDF). Z/Yen. 2010. Archived from the original (PDF) on 11 October 2010. Retrieved 15 September 2012.
- ^ Jersey: Tax haven or international finance centre? 2009 2 3, BBC.co.uk, retrieved 2012-9-14
- ^ Annual Reports Archived 16 July 2006 at the Wayback Machine, 2008, Office of the Data Protection Commissioner, Jersey, retrieved 2012-9-15
- ^ Commission Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey, Eur-Lex, europa.eu, retrieved 2012-9-15
- ^ Subject Access Exemptions, 2005/2006, from jerseylaw.je
- ^ Office of the Data Protection Commissioner Archived 24 July 2008 at the Wayback Machine, Jersey government, gov.je, retrieved 2012-9-14
- ^ a b Islands to join forces on data protection[usurped] Monday 19 September 2011, thisisjersey.com, retrieved 2012-9-15
- ^ Now Data Protection threatens Christmas[usurped] Saturday 24 November 2007, thisisjersey.com, retrieved 2012-9-14
- ^ Syvret replaced the name of the Nurse with the term "Nurse M" on his blog. See for example Thursday, 19 March 2009, A MASS-MURDERER, blogspot.com, retrieved 2012-9-14
- ^ a b c Before: Assistant Magistrate Mrs B. Shaw, Between Stuart Syvret and the Attorney General and the Connetable of Grouville, retrieved 2012-09-14
- ^ Jersey politician Stuart Syvret bailed pending appeal 18 November 2010, bbc.co.uk, retrieved 2012-09-14
- ^ Minister resigns after breaching data protection code. 2 February 2011. bbc.co.uk. retrieved 2012-9-14