Data Protection (International Cooperation and Assistance) (Bailiwick of Guernsey) Regulations, 2018

Summary

This Guernsey regulation confers additional functions on the Office of the Data Protection Authority (the Authority) relating to international cooperation and mutual assistance under the GDPR and the Council of Europe Data Protection Convention. It sets out how the Authority must cooperate with foreign data protection authorities and assist individuals in exercising data protection rights across borders, and restricts how information obtained through such cooperation may be used.

• GDPR cooperation duty: The Authority must have particular regard to Articles 60, 61 and 62 of the GDPR (cooperation, mutual assistance and joint operations between supervisory authorities) when performing its functions, and act consistently with those provisions so far as appropriate.
• Cooperation with foreign authorities: On request, the Authority must give foreign authorities information about the Law and its administrative practices, and take steps to obtain and share factual information (excluding personal data itself) about processing carried out in the Bailiwick; it may make equivalent requests of foreign authorities.
• Assistance to non-resident individuals: Where a non-Bailiwick-resident individual seeks assistance against a controller established in the Bailiwick, the Authority must either provide information enabling a complaint under section 67 of the Law or treat the request as such a complaint, or otherwise supply the controller's address and other necessary information.
• Assistance to Bailiwick residents: Where a Bailiwick resident seeks to exercise a protected right in another country, the Authority must forward a sufficiently detailed request to the relevant foreign authority, or notify the resident of its reasons for not doing so.
• Restriction on use of shared information: Information received by the Authority from a foreign authority under these provisions must not be used for any purpose other than that specified in the original request.

The Regulations came into force on 25 May 2018 and operate alongside the Data Protection (Bailiwick of Guernsey) Law, 2017. They primarily impose duties on the Authority itself rather than directly on businesses, though data controllers established in the Bailiwick may be the subject of assistance requests handled under this framework.

Key obligations

• The Authority must have particular regard to, and act consistently with, Articles 60, 61 and 62 of the GDPR when performing its functions under section 65 of the Law.
• On request by a foreign authority, the Authority must supply information about the Law and its administrative practices and obtain and share factual (non-personal-data) information about processing carried out in the Bailiwick.
• On a request from a non-resident individual concerning a controller established in the Bailiwick, the Authority must either provide information to enable a complaint under section 67 or treat the request as such a complaint, or provide the controller's address and other necessary information.
• On a request from a Bailiwick resident to exercise a protected right abroad, the Authority must forward the request to the relevant foreign authority if satisfied it meets the specified requirements.
• If the Authority decides not to forward a Bailiwick resident's request, it must notify the resident of the reasons as soon as practicable and in any event within 28 days of the decision.
• The Authority must not use information received from a foreign authority for any purpose other than that specified in the request under which it was obtained.

Applies to

data controllers established in the Bailiwick, foreign data protection authorities, Bailiwick residents seeking to exercise data protection rights abroad, non-resident individuals seeking assistance against Bailiwick controllers

Deadlines

• 25 May 2018: Commencement date on which the Regulations come into force.
• within 28 days of making that decision: If the Authority decides not to forward a Bailiwick resident's assistance request to a foreign authority, it must notify the resident of its reasons within this period (and as soon as practicable).

Related documents

• This document is made under Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)