Statement following Credit Reference Agencies Announcement (2026-07-03)

Summary

This is a public statement from Jersey's Information Commissioner, Paul Vane, responding to an announcement that Jersey residents' personal information will begin to be shared with United Kingdom Credit Reference Agencies (CRAs). It explains the background, the data involved, and the legal safeguards required under the Data Protection (Jersey) Law 2018. It does not itself impose new regulatory rules but sets out the Commissioner's expectations and individuals' rights.

• What is being shared: Name, residential address and date of birth of Jersey residents will be automatically provided to specified UK CRAs from the end of this month, drawn from the Jersey Population Register.
• Legal basis: An amendment passed by the States Assembly in January 2026 permits this specific sharing; CRAs still cannot access the Jersey electoral register directly.
• Opt out: Sharing is not compulsory and individuals are able to opt out.
• Government obligations: The Government of Jersey must comply with the Data Protection Principles under the Data Protection (Jersey) Law 2018, limit disclosure to what is necessary for identity verification for credit purposes, establish a lawful basis for sharing, and put in place a robust data sharing agreement with each CRA.
• Individual rights: Individuals retain rights under the Data Protection (Jersey) Law 2018 and can complain first to the Government of Jersey, and then to the Jersey Office of the Information Commissioner if unsatisfied.

The statement is aimed at reassuring the public about safeguards while acknowledging the change addresses long standing difficulties Jersey residents faced in securing credit due to CRAs' inability to verify local addresses.

Key obligations

• The Government of Jersey must comply with the Data Protection Principles under the Data Protection (Jersey) Law 2018 when sharing personal data with UK CRAs.
• Disclosure of personal data to CRAs must be limited only to what is necessary for verifying identity for credit purposes.
• A lawful basis for the data sharing must be established.
• A robust data sharing agreement must be in place with each CRA receiving personal data.
• Individuals must be given the ability to opt out of having their personal information shared with CRAs.
• Individuals dissatisfied with how their data has been handled must first complain to the Government of Jersey before escalating to the JOIC.

Applies to

Government of Jersey, UK Credit Reference Agencies, Jersey residents/individuals

Deadlines

• from the end of this month: Automatic sharing of Jersey residents' name, address and date of birth with UK Credit Reference Agencies is due to begin.