Data Protection Authority (Jersey) Law 2018

Summary

This Law establishes Jersey's Data Protection Authority as an independent statutory body, sets up the office of Information Commissioner, and gives the Authority its constitution, functions, and enforcement powers under the Data Protection (Jersey) Law 2018. It also sets out the registration regime for controllers and processors and the fees, sanctions and administrative fine framework that backs it up.

• Authority and Commissioner: Creates the Data Protection Authority as a body corporate and the Information Commissioner as its chief executive, with rules on appointment, tenure, removal, meetings, delegation and confidentiality.
• General functions: Gives the Authority functions to administer and enforce the Law and the Data Protection Law, monitor and report to the States, promote public and controller awareness, and cooperate with other supervisory authorities.
• Registration and charges: Requires controllers and processors to register with the Authority (Article 17) and to pay prescribed charges once registered (Article 18).
• Enforcement powers: Sets out complaint handling, investigations and inquiries, breach determinations, sanctions, administrative fines and limits on those fines, plus a procedure to be followed before making a breach determination or order.
• Investigation and inquiry powers (Schedule 1): Gives authorized officers power to issue information notices, enter and search premises (subject to safeguards and warrant requirements), and to conduct or require data protection audits, with the audited controller or processor bearing the cost of a required audit.
• Transitional provisions (Schedule 2): Controllers already registered under the Data Protection (Jersey) Law 2005, and all processors, are exempt from re-registering under this Law until the end of a defined registration period; existing enforcement notices and pending assessment requests under the 2005 Law carry over and take effect under the equivalent provisions of this Law.

The Law is administrative and enforcement-focused rather than prescriptive on data handling itself: substantive data protection obligations sit in the separate Data Protection (Jersey) Law 2018, while this Law provides the institutional machinery (the Authority, the Commissioner, registration, fees, and enforcement powers including administrative fines) used to apply and enforce it.

Key obligations

• Controllers and processors must register with the Authority under Article 17, unless covered by the Schedule 2 transitional exemption.
• Registered controllers and processors must pay the prescribed charges set under Article 18.
• A controller or processor required to appoint an approved auditor for a data protection audit under Schedule 1 must pay for that audit.
• Persons served with an information notice or subject to entry, search or warrant powers under Schedule 1 must comply with those powers, subject to the stated safeguards.
• Processors that were unregistered under the 2005 Law must register within the 26 week transitional registration period from commencement.
• Members, staff and agents of the Authority must not disclose confidential information obtained under the Law or the Data Protection Law except with lawful authority, on pain of criminal penalty.

Applies to

data controllers, data processors, Data Protection Authority members and staff, Information Commissioner

Deadlines

• 26 weeks from the day this Law comes into force: Transitional registration period for processors that were not previously required to register under the 2005 Law.
• end of the registration period (as defined for each controller by reference to when their entry under the 2005 Law would have expired): Point at which the Schedule 2 transitional exemption from registration under Article 17 ends for controllers previously registered under the 2005 Law.

Related documents

• This document amends Data Protection (International Co-operation) (Jersey) Regulations 2005
• Data Protection (Registration and Charges) (Jersey) Regulations 2018 is made under this document