2022 MoU between the Jersey Data Protection Authority/Information Commissioner and the States of Jersey Police

Summary

This is a bilateral Memorandum of Understanding setting out how the Jersey Data Protection Authority/Information Commissioner (JDPA/JOIC) and the States of Jersey Police (SOJP) will co-operate and share information in the exercise of their respective statutory functions. It is a framework agreement, not a source of legally enforceable rights, and does not override any applicable law.

• Information sharing: SOJP will pass to JDPA/Information Commissioner information indicating significant breaches of data protection or FOI legislation or significant governance/security weaknesses at a regulated entity; JDPA/Information Commissioner will pass to SOJP information suggesting specified criminal offences under the DPJL 2018, Authority Law or FOI Law may have occurred.
• Requests for assistance: Each party will use best endeavours to respond to requests for information or operational assistance, including support in executing warrants and investigating criminal offences.
• Investigation coordination: Parties will notify each other of significant investigation developments, consider joint or parallel investigations, hold case conferences where both criminal and regulatory interests arise, and give at least 24 hours' notice before publishing enforcement announcements affecting the other party.
• Confidentiality and data handling: Shared information must be protected according to its sensitivity, marked appropriately if confidential, not disclosed to third parties without consultation, and any personal data breach must be reported under the DPJL 2018.
• Retention and disposal: Information shared under the MoU must not be retained longer than necessary and must be securely disposed of once no longer required.
• Costs: A Receiving Party may require a contribution to costs if fulfilling a request would be substantially costly.

The MoU took effect once both parties signed it (dated 2022) and remains in force until either party gives 30 days' written notice of termination. Confidentiality, retention and disposal obligations survive termination.

Key obligations

• SOJP must pass to JDPA/Information Commissioner information indicating a significant breach of regulatory legislation, a significant breach of a binding regulatory requirement, or significant governance/security weaknesses at an entity subject to the DPJL 2018
• JDPA/Information Commissioner must pass to SOJP information indicating a crime may have been or is about to be committed under specified provisions of the DPJL 2018, Authority Law or FOI Law
• Parties must confirm urgent oral requests for assistance or information in writing within five business days unless otherwise agreed
• Parties must notify each other without delay if information shared under the MoU is found to be inaccurate, incomplete or out of date
• Parties must give the other appropriate notice, no later than 24 hours prior to publication, of any press release or public statement relating to enforcement cases of mutual interest
• Parties must apply appropriate security measures and classification marking to shared confidential information and consult before passing it to a third party or using it in enforcement proceedings
• Parties must report any wrongful disclosure of confidential material to the originating party without delay, including personal data breach reporting obligations under the DPJL 2018
• Information supplied under the MoU must not be retained longer than reasonably required and must be securely disposed of once no longer needed
• A party wishing to terminate the MoU must give the other 30 days' advance written notice

Applies to

Jersey Data Protection Authority/Information Commissioner (JOIC), States of Jersey Police

Deadlines

• within five business days: Written confirmation required for urgent oral requests for assistance or information, unless otherwise agreed
• no later than 24 hours prior to publication: Notice to the other party required before issuing a press release or public statement on an enforcement case of mutual interest
• 30 days' advance written notice: Notice period required for either party to terminate the MoU
• once both Parties have signed it: The MoU takes effect upon signature by both parties