Definitions, the Data Protection Principles and Lawful Bases

Summary

This is JOIC guidance explaining the foundational concepts of the Data Protection (Jersey) Law 2018: key definitions, the six Data Protection Principles, and the lawful bases organisations must rely on to process personal data and special category data. It is split into an easy-read section for individuals and small organisations and a technical section for controllers, processors and practitioners.

• Data Protection Principles: Organisations must process data lawfully, fairly and transparently; use it only for specified purposes; collect only what is necessary; keep it accurate; retain it only as long as needed; and keep it secure.
• Lawful bases (ordinary data): Before processing ordinary personal data, a controller must identify one lawful basis from Schedule 2 Part 1 (consent, contract, legal obligation, vital interests, public task, or legitimate interests).
• Lawful conditions (special category data): Before processing special category data (e.g. health, ethnicity, religion, biometric, criminal data), a controller must identify one condition from Schedule 2 Part 2, which lists numerous specific conditions including explicit consent, employment/social protection needs, vital interests, not-for-profit membership, legal claims, public interest, medical/social care, public health, research/archiving/statistics, equality monitoring, prevention of unlawful acts, malpractice concerns, journalism/academic expression, counselling, insurance/pensions, and certain non-law-enforcement police functions.
• Key definitions: Explains what constitutes personal data, special category data, controllers, joint controllers, processors, and processing, plus the territorial and material scope of the DPJL 2018 (including the filing system and personal/household exemptions).

The guidance is explanatory and does not itself create new statutory duties beyond those already in the DPJL 2018, but it clarifies that controllers and processors must be able to demonstrate which principle and lawful basis/condition applies to each processing activity, decided in advance of processing.

Key obligations

• Controllers and processors must apply and be able to demonstrate compliance with the six Data Protection Principles in Art.8 of the DPJL 2018 for all personal data processing.
• Before processing ordinary personal data, an organisation must select and be able to justify one lawful basis from Schedule 2 Part 1 of the DPJL 2018, decided before any collection, use, sharing or storage of the data.
• Before processing special category data, an organisation must select and be able to justify one lawful condition from Schedule 2 Part 2 of the DPJL 2018, decided before processing begins.
• Insurers and pension scheme administrators relying on the Schedule 2 Part 2 para.23/24 conditions must limit processing of relatives' health data to the specified relationships and purposes and must not use it to make decisions about the relative themselves.

Applies to

data controllers, data processors, joint controllers, organisations processing personal data in or connected to Jersey, insurance businesses, occupational pension scheme administrators, police (in non-law-enforcement functions)