32
DAYS LEFT

New registration requirements

If you use personal data in your work you are legally obliged to register here during 1 Jan - 28 Feb.
More details at odpa.gg/2021.

Jargon Explained

We want everyone to engage positively and constructively with data protection rights and responsibilities. To do that, we try and present information and guidance in a relevant and accessible way. Although it is sometimes necessary to use legal terminology, we will use plain English wherever we can. Data protection is for all of us, not just for lawyers.
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z

A


Adequacy decision

The Bailiwick is one of several jurisdictions that the European Commission (EC) currently recognises as offering an adequate standard of data protection. An adequacy decision from the EC is essential to the continued success of the Bailiwick’s economy as it allows EU organisations to easily transfer data to the islands of the Bailiwick.

Administrative fine

A fine ordered by the Data Protection Authority

Anonymised

Data is considered 'anonymised' if an organisation has irreversibly removed all information from a set of data that could have identified individual people. If data has been irreversibly anoymised then it is no longer classified as personal data. 

Authorised jurisdiction

  • The Bailiwick of Guernsey
  • A Member State of the European Union
  • Any country, any sector within a country, or any international organisation that the (European) Commission has determined ensures an adequate level of protection within the meaning of Article 45(2) of the GDPR and for which the determination is still in force.
  • A designated jurisdiction (by Ordinance)

B


Biometric data

Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows and confirms the unique identification of that individual, such as facial images or dactyloscopic (fingerprint) data.

C


Child

An individual under 18 years of age. Visit our children area for more information. 

Specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a clear statement or by clear affirmative action, signified agreement to the processing of personal data relating to the data subject.

Controller

A person (individual or legal) that, alone or jointly with others, determines the purposes and means of the processing of any personal data.

Criminal data

Criminal data is any personal data about a person's: criminal activity; alleged criminal activity; investigations into that person; and legal proceedings involving that person.    

 

D


Data harms

The harm a person experiences that is caused by the misuse, loss, or improper sharing of their personal-data both deliberate and/or accidental. Harm can be felt physically or emotionally. For example, loss of money through fraud or identity theft, or damage to a person’s reputation and any emotional distress they suffer.

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIAs) are an important compliance tool when you are embarking on new processing or making changes to existing processes. In some cases it will a legal requirement that you conduct a DPIA.  

You can read more about DPIAs here

Data subject

A 'data subject' is the person who is identified (or identifiable) by personal data. So you, me, your family and friends are referred to as 'data subjects' when our personal data is being used by a organisation/entity. 

Data subject rights

Means a legal right a person* has under our Law. Please see Your Rights for more detail.

*(people are known as 'data subjects' in the Law)

F


Filing system

Any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

G


GDPR

This is the acronym for the European Union's General Data Protection Regulation. The GDPR does not have direct application in the Bailiwick of Guernsey as we are not an EU member state.

But our local Law (The Data Protection (Bailiwick of Guernsey) Law, 2017) gives equivalent protections to the GDPR, and the Bailiwick is recognised as an 'adequate' jurisdiction by the European Commission. This allows for free-flow of data between the EU and the Bailiwick.

Genetic data

Personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual, including as a result of an analysis of a biological sample from the individual.

H


Health data

Personal data relating to the health of an individual, including the provision of health care services, which reveals information about the individual’s health (physical or mental) status.

Health or social care purpose

Includes the purpose of preventative or occupational medicine, the assessment of the working capacity of an employee or worker, medical diagnosis, the provision of medical, health or social care or treatment, or the management of medical, health or social care systems and services.

High risk

Processing of personal data is deemed to be likely to pose a high risk to the significant interests of data subjects where it involves –

  • A systematic and extensive evaluation of personal aspects relating to data subjects based on automated processing, and decisions are based on the evaluation that affect the significant interests of the data subjects,
  • Large scale processing of special category data,
  • Large scale and systemic monitoring of a public place, or
  • Any other prescribed kind or description of processing.

High-risk processing

Any processing of personal data that is likely to pose a high risk to the significant interests of data subjects. This should be determined by considering the nature, scope, context and purpose of the processing as well as the technology, mechanism or procedure used to process the data in question.

Processing of personal data will be considered as posing a high risk where it involves –

  • a systematic and extensive evaluation of personal aspects relating to data subjects based on automated processing, and decisions are based on the evaluation that affect the significant interests of data subjects,
  • large-scale processing of special category data,
  • large-scale and systematic monitoring of a public place, or
  • any other prescribed kind or description of processing.

I


Identifiable individual

An individual is identifiable from any information where the individual can be directly or indirectly identified from the information, including –

  • by reference to a name or an identifier
  • by reference to one or more factors specific to the person’s physical, physiological, genetic, mental, economic, cultural or social identity,
  • where, despite pseudonymisation, that information is capable of being attributed to that individual by the use of additional information, or
  • by any other means reasonably likely to be used, taking into account objective factors such as technological factors and the cost and amount of time required for identification in the light of the available technology at the time of processing.

Identifier

A number or code that is assigned to an individual by a controller or processor and that uniquely identifies that individual. It includes location data and number or code issued to an individual by a public authority but excludes an individual’s name.

O


One month

The Law requires controllers to comply with a request to exercise data subject rights within the designated period which is specified as one month.

The Interpretation and Standards Provisions (Bailiwick of Guernsey) Law, 2016 provides that one month shall mean calendar month.

P


Personal data

‘Personal data’ has a very broad legal definition, it is: ‘any information relating to an identified or identifiable [living] individual’.

The scope of what is considered ‘personal data’ expands even further when you consider that it includes both factual information about people as well as opinions expressed about people. It also includes anonymised data that could identify people if it was combined with other information.

NOTE: personal data does not include: any data about a dead person; any information, facts or opinions that do not relate to, or identify people (e.g. employment statistics, or anything else that has been irreversibly anonymised) 

Personal data breach

A personal data breach is defined in section 111(1) of the Law as any incident that meets the following criteria: “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”.  There will likely be a breach whenever any personal data is accidentally lost, corrupted or disclosed, or if someone accesses it or passes it on without proper authorisation to do so.

One of the key changes to the local data protection law that came into force in May 2018 is that organisations are legally required to notify the ODPA of any personal data breach within 72 hours of becoming aware of it (see section 42 (2) of the Law).

Organisations can report a breach to us online here. We have produced guidance on handling data breaches here

You can access the statistics we publish about personal data breaches here

Processing

The legal definition of ‘processing’ is very broad: ‘Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.’

In plain English, ‘processing’ can be summed up as: anything you do with personal data

Some examples of processing include: Collection; Recording; Organisation; Structuring; Storage; Alteration; Retrieval; Consultation; Use; Disclosure; Dissemination; Restriction; Erasure; Destruction.

Processor

An individual or other person that processes personal data on behalf of a controller and includes a secondary processor (another processor engaged by the primary processor).

Profiling

Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, including aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation

The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, where that additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable individual.

Public authority

The following are public authorities for the purposes of the Law.

(a)  the States,

(b)  a public committee,

(c)  a holder of a public office,

(d)  a statutory body,

(e) a court or tribunal of the Bailiwick,

(f)  any person hearing or determining an appeal, or conducting a public inquiry, under any enactment,

(g)  the salaried police force of the Island of Guernsey or any police force which may be established by the States of Alderney or Chief Pleas of Sark,

(h)  a parish Douzaine of the Island of Guernsey or the Douzaine of the Island of Sark,

(i)   any person exercising or performing functions or holding any office similar or comparable to any of the persons described in paragraphs (a) to (h) in respect of any country other than the Bailiwick, or

(j)   any other person that exercises or performs any function that is of a public nature in respect of the Bailiwick or any other country.

S


Significant interests

A person’s ‘significant interests’ are defined in the local Law as any aspect of their life that could be put at risk due to their #personal-data being breached. This could include their physical safety, their reputation, and could extend to placing them at risk of identity theft, fraud, financial loss, psychological distress or humiliation.

Special category data

Personal data revealing an individual’s racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, genetic data, biometric data, health data, data concerning an individual’s sex life or orientation, criminal data.