Data Protection (International Co-operation) (Jersey) Regulations 2005

Summary

These Regulations implement Jersey's obligations under the 1981 Council of Europe Convention on data protection (Convention 108), setting out how the Jersey data protection Authority (JOIC) co-operates with foreign designated authorities in other Convention countries when individuals seek to exercise data protection rights across borders.

• Authority to foreign authority cooperation: The Authority must, on request, provide foreign designated authorities with information on Jersey data protection law and administrative practice, and take appropriate measures to furnish factual information about specific automatic processing carried out in Jersey (excluding the personal data itself).
• Requests from people outside Jersey: Where a person outside Jersey makes a valid request (naming themselves, identifying the data, the Convention rights concerned and reasons), the Authority must notify them of the relevant data controller's address for notices, or of their rights and remedies under Part 6 of the Law, or treat the request as an assessment request, depending on the circumstances.
• Requests from Jersey residents: Where a Jersey resident asks the Authority for help exercising Convention rights abroad, the Authority must forward a properly particularised request to the relevant foreign designated authority, or explain its reasons if it decides not to.
• Restriction on use of information: Information the Authority receives from a foreign designated authority as a result of a request may only be used for the purposes stated in that request.

The Regulations mainly impose duties on the Authority itself rather than on private-sector entities, though data controllers are referenced as the subject of requests and their register entries and contact details may be disclosed to requesters in defined circumstances.

Key obligations

• The Authority must furnish requested information on Jersey data protection law and practice to a foreign designated authority making a request under Article 13(3)(a) of the Convention.
• The Authority must take appropriate measures to furnish factual information about specific automatic processing in Jersey to a requesting foreign designated authority, excluding the personal data itself.
• On receiving a valid request from a person outside Jersey, the Authority must notify them of the relevant data controller's address and other necessary information, or of their rights and remedies under Part 6 of the Law, or treat the request as an assessment request under Article 21 of the Authority Law, as appropriate.
• The Authority must forward a properly particularised request from a Jersey resident seeking to exercise rights abroad to the relevant foreign designated authority, or notify the person of its reasons if it declines to do so.
• The Authority must not use information received from a foreign designated authority except for the purposes specified in the request that led to its receipt.

Applies to

data controllers, the Authority (Jersey Office of the Information Commissioner), persons resident in Jersey, persons resident outside Jersey, foreign designated data protection authorities

Related documents

• Data Protection Authority (Jersey) Law 2018 amends this document