Definitions, the Data Protection Principles and Lawful Bases

Summary

This is JOIC guidance explaining the foundational concepts of the Data Protection (Jersey) Law 2018 (DPJL 2018): key definitions, the six Data Protection Principles in Article 8, and the lawful bases and conditions organisations must use before processing personal data or special category data. It is split into an easy read section for individuals and general readers, and a technical section for controllers, processors and practitioners.

• Six Data Protection Principles: Personal data must be processed lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary; accurate; kept no longer than necessary; and secured through appropriate technical and organisational measures.
• Lawful bases for ordinary personal data: Before processing, a controller must select one of six lawful bases under Schedule 2 Part 1: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
• Conditions for special category data: Processing of sensitive data (health, racial/ethnic origin, religious beliefs, biometric or criminal data, etc) requires selecting one specific condition from Schedule 2 Part 2 before processing begins, such as explicit consent, employment/social security needs, vital interests, public interest, research, or specific insurance/pension and policing conditions.
• Key definitions clarified: Explains what counts as personal data, special category data, anonymised data, deceased persons' data, controllers, joint controllers, processors, and the wide definition of processing.
• Scope of the law: Applies to automated processing and to manual records held in a structured filing system; does not apply to purely personal or household activity.
• Territorial scope: Applies to controllers/processors established in Jersey, those using equipment in Jersey, and those outside Jersey processing data of Jersey-based data subjects to offer goods/services or monitor behaviour.

The guidance is explanatory in nature, restating and illustrating obligations that already arise directly from the DPJL 2018 rather than creating new standalone duties. It points readers to further JOIC guidance notes on controller and processor duties, joint controllers, and legitimate interest assessments.

Key obligations

• Controllers and processors must process personal data in accordance with the six Data Protection Principles under Art.8 DPJL 2018 (lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality).
• Before processing ordinary personal data, an organisation must identify and rely on one lawful basis from Schedule 2 Part 1 of the DPJL 2018.
• Before processing special category data, an organisation must identify and rely on one specific condition from Schedule 2 Part 2 of the DPJL 2018.
• Organisations must determine the correct lawful basis or condition before any collection, use, sharing or storage of personal data begins, not retrospectively.
• Organisations must be able to demonstrate how the Data Protection Principles are applied in practice within their organisation.

Applies to

data controllers, data processors, organisations processing personal data in Jersey, individuals (as data subjects, for informational purposes)