In his first Business Brief column as the Bailiwick’s new Data Protection Commissioner, Brent Homan outlines his ambitious vision for the future of regulation in the islands.
A data protection vision for Guernsey: embracing compliance and elevating confidence
In being welcomed by Guernsey’s community I am delighted to outline my vision for the Bailiwick which is ‘a model for the global data protection community with a public and private sector that embraces compliance and elevates trust and consumer confidence’.
And how we get there involves a strategy that is seamlessly aligned with the ODPA’s Strategic Plan supported by the following pillars:
- Balance - in ensuring the right compliance tool is selected for the right situation
- Trust - earned by demonstrating integrity, accountability and transparency
- Partnership - both with those we serve, as well as our regulatory counterparts
As to principal data protection challenges for Guernsey, I see three:
- Promoting proactive compliance to address any residual attitude that compliance is simply a nuisance and legal obligation to be checked off
- Breach risks which disproportionately injure Guernsey’s residents
- Technological innovation which on one hand creates exciting opportunities to improve government and commercial services, but on the other, involves unprecedented risks to individual’s fundamental rights and freedoms
Towards ‘promoting proactive compliance’, it will be key to underscore how respecting privacy represents both good business and good government.
For the private sector, this means local companies can realise a competitive advantage through high data protection standards.
And for government, providing data-driven services whilst protecting people’s information provides an opportunity to elevate trust - an essential ingredient to any functioning government.
The strategy for instilling this human-centric culture is well underway at the ODPA. I see the ODPA not only ‘staying the course’ through its existing exemplary outreach activities, but reinforcing this approach with additional tools such as data protection ‘health assessments’.
This would be balanced against our obligation to investigate complaints in a fulsome and timely manner, the results of which serve to correct and deter non-compliant behaviour.
urning to breaches, we shall emphasise the importance of viewing security safeguards as a dynamic rather than static responsibility.
Organisations can think of breach preparedness like cruise control of a car. You can’t set it and then jump in the back seat to make yourself a sandwich because you will crash… especially on Guernsey’s roads! You have to steer carefully, be aware of present dangers to you, your passengers and other road users and be prepared to confront unknown threats awaiting you at the turn of the road.
Working with people’s data is no different.
Turning to technological innovation, its impact on privacy can be described as revolutionary. This is especially relevant in Guernsey, as our financial services sector (and many others) increasingly adopt AI and automated decision-making tools.
And for government, good intentions do not always translate to safe data protection practices. In fact, Guernsey can attest to how the good intentions of one government, can later be exploited with disastrous consequences, as was experienced during the Nazi occupation and use of census data to target groups for persecution.
The ODPA strategy for confronting tech-driven privacy risks will include leveraging our membership on leading forums such as the Global Privacy Assembly’s Artificial Intelligence Working Group.
Finally, the ‘Power of Partnership’ holds particular promise for the ODPA.
On the home front, we shall work closely with other digital market regulators in the Channel Islands to tackle common challenges towards advancing a vibrant Bailiwick economy where people’s privacy rights are respected.
Abroad, there is an opportunity for the ODPA to increase its participation in international networks and where issues align, joining in on global collaborative enforcement efforts.
At the end of the day, by combining a highly talented ODPA team with a motivated public and private sector we can realise the innumerable benefits of superior data protection practices. This will no doubt help us achieve the goal of being a model jurisdiction in the global data protection community.
I am grateful for the privilege of embarking on that journey with the Bailiwick community.
&
Indulge