Conditions for Lawful Processing (Data Protection (Bailiwick of Guernsey) Law, 2017)

Summary

This guidance from the Guernsey Office of the Data Protection Authority explains the lawful bases (conditions) that a controller must identify and document before processing personal data under section 7 and Schedule 2 of the Data Protection (Bailiwick of Guernsey) Law, 2017. It sets out separate lists of conditions for ordinary personal data and for special category data, and reproduces tables of sector specific processing authorised by enactment.

• Core rule: Controllers must not begin processing personal data unless they have clearly established and documented which lawful processing condition applies.
• Necessity test: Most conditions require that the processing be necessary; if the purpose could reasonably be achieved without the processing, that condition cannot be relied on.
• Ordinary personal data: At least one condition must be satisfied, such as consent, necessity for a contract, protection of vital interests, legitimate interests (not for public authorities), public function, legal duty, court order, health/social care, public health, legal proceedings, law enforcement, not-for-profit purposes, historical/scientific purposes, equal opportunity, or authorisation by regulation or enactment.
• Special category data: A stricter list applies, generally requiring explicit consent or one of the other listed necessity-based conditions (vital interests where consent cannot be obtained, legal proceedings, law enforcement, health/social care, public health, not-for-profit context, historical/scientific purposes, equal opportunity, or authorisation by enactment).
• Special authorisation: Where the Committee for Home Affairs has granted special authorisation for particular processing, this may be relied on instead of a standard condition, but the controller must document the reliance and comply with all attached conditions.
• Sector specific tables: The document lists specific authorised processing scenarios (numbered 1 to 16) covering, among others, abandoned vehicle registered keeper data by the Environment Committee, STSC-related body employee/debtor/creditor data, Ofsted inspections, confidential counselling services, insurance business processing of health or criminal data, pension scheme health data, criminal record checks for employment or service provision, employment-related special category data, elected representatives acting on constituent requests, publication of court or tribunal judgments, protective functions, police officers, and public authorities assessing money laundering, terrorist financing or financial crime risk to the Bailiwick, each with its own specific conditions.

This is explanatory guidance rather than a standalone instrument creating new duties; it directs controllers to the existing statutory requirement to identify and document a lawful basis before processing, and to satisfy the specific conditions attached to any of the enumerated sector specific processing activities they rely on.

Key obligations

• Controllers must not begin processing personal data until they have clearly established and documented the specific lawful processing condition relied upon.
• Controllers must satisfy at least one of the listed conditions for ordinary personal data, or at least one of the stricter listed conditions for special category data, before processing.
• Where relying on the necessity-based conditions, controllers must be able to show the processing could not reasonably achieve its purpose without the processing.
• Where relying on special authorisation from the Committee for Home Affairs instead of a standard condition, controllers must document why they are relying on it and adhere to all attached conditions.
• Controllers relying on any of the sector specific processing conditions in the tables (items 1 to 16) must satisfy the specific documented conditions attached to that item, such as inability to obtain consent, public interest justification, or safeguards in an approved arrangement.

Applies to

controllers, public authorities, the Environment Committee, STSC or a STSC-related body, persons acting for or on behalf of Ofsted, persons providing confidential counselling, advice or support services, persons carrying on insurance business, persons administering pension schemes, employers and persons providing goods, facilities or services to the public, elected representatives, police officers