Data Protection (Commencement, Amendment and Transitional) (Bailiwick of Guernsey) Ordinance, 2018

Summary

This Ordinance brings the Data Protection (Bailiwick of Guernsey) Law, 2017 into force on 25 May 2018 and sets out transitional rules that soften certain new duties for a defined transition period, while saving consents, proceedings, offences and records from the former data protection regime. It also transfers the rights, liabilities and records of the former Data Protection Commissioner to the new Authority and makes consequential amendments to the Law and to e-Privacy Ordinances.

• Commencement: The Data Protection (Bailiwick of Guernsey) Law, 2017 and this Ordinance both take effect on 25th May, 2018.
• Transitional exemptions until the transition date: Controllers and processors are temporarily excused from certain notification, joint-controller, impact assessment, processor-use, processor measures, and secondary-processor authorisation duties in relation to processing that is a continuation of lawful processing carried on before commencement.
• Data subject requests still apply: Even where a notification duty is exempted, a controller must, on request, give the data subject the information the notification duty would otherwise have required.
• Data portability delayed: The right to data portability under section 14 of the Law (and corresponding provisions) does not have effect until the transition date.
• Breach reporting applies regardless of when breach occurred: Controllers and processors must comply with breach reporting duties for any personal data breach, whether it occurred before or after commencement, but only once they first become aware of it after the Law comes into force.
• Savings of consents, proceedings and offences: Consents validly obtained under the former Law continue to have effect (subject to conditions), and pending proceedings, notices, and offences under the former Law continue to be dealt with under that Law, with the Authority substituted for the former Commissioner.
• Transfer of rights and records to the Authority: All assets, rights, liabilities, obligations, agreements and records of the former Commissioner become those of the Authority, and the Commissioner must take all steps necessary to give effect to this transfer.
• Amendments and revocations: Schedule 1 revokes specified prior Orders and Regulations; Schedule 2 amends the Data Protection (Bailiwick of Guernsey) Law, 2017; Schedule 3 makes consequential amendments to e-Privacy Ordinances (including substituting Authority terminology for references to the Commissioner).

The document is primarily a commencement, transitional and consequential-amendment instrument rather than a source of new ongoing compliance obligations, but it does impose specific duties on controllers and processors during the transition period and on the former Commissioner in transferring functions to the Authority.

Key obligations

• A controller exempted from a notification duty must, on request by a data subject, still provide the information that duty would have required to be given or published.
• Controllers and processors must comply with personal data breach reporting duties for breaches occurring before or after commencement, provided they first become aware of the breach after the Law comes into force.
• The Commissioner must do everything necessary to transfer assets, rights, liabilities, records, registrations and notifications to the Authority.
• Data subjects who wish to withdraw pre-commencement consent must do so by written notice to the controller or by another means the controller provides, for the consent to cease having effect.

Applies to

controllers, processors, joint controllers, data subjects, the Data Protection Authority, former Data Protection Commissioner

Deadlines

• 25th May, 2018: Commencement date of the Data Protection (Bailiwick of Guernsey) Law, 2017 and this Ordinance.
• until the transition date: Period during which specified transitional exemptions apply to controllers and processors for continued processing, and during which the right to data portability has no effect.

Related documents

• This document amends Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)
• This document commences Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)
• This document is made under Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)
• This document amends European Communities (Implementation of Privacy Directive) (Guernsey) Ordinance, 2004