Exemptions Outlined in Schedule 8 of the Data Protection (Bailiwick of Guernsey) Law, 2017 - Technical Guidance

Summary

This is technical guidance from the Guernsey Office of the Data Protection Authority explaining the exemptions listed in Schedule 8 of the Data Protection (Bailiwick of Guernsey) Law, 2017. It does not create new legal duties itself but interprets when controllers may lawfully withhold compliance with data subject rights (and, in some cases, breach notification duties) because an exemption applies.

The guidance covers three categories of exemption: those based on the nature of the personal data (e.g. references, judicial and Crown appointments, examination data, marking data, privileged items), those available where compliance would cause demonstrable prejudice (e.g. armed forces, management forecasting, financial services data, negotiations, tax and crime information, regulatory purposes), and wider public interest exemptions (journalism, art, literature, academia, public security) plus other exceptions such as disclosures required by law, trusts, court directions and serious harm to data subjects.

• Case by case use only: Exemptions must be applied narrowly to specific personal data in specific circumstances, never as a blanket policy.
• Documentation expected: Controllers relying on an exemption should document the decision and the reasoning, and be prepared to produce that documentation to the Authority on request.
• Prejudice-based exemptions: For exemptions in Part II of Schedule 8, it is not enough that the exemption is engaged; the controller must be able to show that compliance would likely prejudice the relevant activity or purpose.
• Marking data timing: Requests relating to exam marking data made before results publication have an altered response timescale rather than being fully exempt.
• Two exemptions that must be applied: Disclosures prohibited or restricted by other enactments (paragraph 16A) and serious harm to data subjects or other individuals (paragraph 16D) are described as exemptions that must be applied when the stated circumstances arise, unlike most other optional exemptions.

The guidance closes with practical steps for assessing whether an exemption applies and supplementary guidance on the management forecasting/planning and financial services data exemptions, emphasising proportionality and minimum necessary restriction of data subject rights.

Key obligations

• Controllers must consider and apply exemptions on a case-by-case basis rather than applying them as a blanket policy across all similar data.
• Controllers relying on a prejudice-based exemption (Part II of Schedule 8) must be able to demonstrate that compliance with the designated provision would likely cause prejudice to the relevant activity.
• Controllers should document any decision to rely on an exemption, including the reasoning, and retain that documentation to provide to the Authority if requested.
• Where a subject access request relating to exam marking data is received before publication of results, the controller must respond within the earlier of five months from the day after receipt or two months after the publication date, rather than the usual one month.
• Any restriction of a data subject's rights under an exemption must be the minimum necessary and proportionate to the risk or effect being avoided.

Applies to

data controllers, data processors, organisations processing personal data in the Bailiwick of Guernsey, relevant persons providing corporate finance services under financial services legislation

Deadlines

• one month: Usual timescale for responding to a data subject rights request, including marking data requests received after publication of exam results.
• the earlier of five months from the day after receipt or two months after the publication date: Altered response timescale for data subject rights requests relating to exam marking data received before publication of results.