THE Bailiwick’s Data Protection Commissioner is advising local businesses to be wary of misinformation and myths as the new Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law) comes into effect.
The Law will be introduced on Friday 25 May, the same day as the General Data Protection Regulation (GDPR) comes into force across the European Union.
It will extend the rights of individuals, providing them with greater transparency and control over the processing of their personal information.
Emma Martins, Data Protection Commissioner, says that for many who may not be familiar with the new requirements, it may be creating uncertainty; and wishes to emphasise that the Office of the Data Protection Commissioner (ODPC) is seeking to provide clarity specifically on the issue of consent and marketing communications. ‘Headlines often lack context or understanding of all of the different lawful conditions businesses and organisations will have for keeping and using personal information under the Law. Where businesses are being advised badly it does a disservice to them as well as their clients.
The new legislation is not about burdening organisations with undeliverable or expensive targets, it is about empowering individuals and ensuring their personal data is handled properly.’ Mrs Martins advised, ‘I am sure many of us have inboxes bursting with emails from organisations asking if we are still happy to hear from them. There is a widely held and mistaken belief that they must obtain new consent if they want to continue to process your data.’ Mrs Martins confirmed that consent is one way to ensure processing is lawful but it is not the only way.
The Law provides a number of conditions which may be relied upon to ensure processing is lawful, one of which is consent. ‘Where you, as a business, have an existing relationship with customers who have purchased goods or services from you, consent may not be the appropriate condition upon which to rely. Even if consent has been previously relied upon and is most appropriate for your business going forward, you may not need to automatically refresh all existing consents to ensure compliance with the new legislation. If the consent you obtained at that time meets the new standard there is no need to obtain fresh consent. ‘The new Law does set the bar high for consent, so it is important to check the new requirements. If consent is being relied upon, make sure it is informed and unambiguous – people must know exactly what they are consenting to. ‘Where you have previously sought consent but that consent does not meet the new standards, it will be appropriate to seek fresh consent from those individuals if consent remains your lawful processing condition.
However, transitional provisions approved last week by the States of Deliberation mean you can carry out this refresh over the next twelve months relying upon existing consent until obtained. ‘If you did not seek consent in the first place, and cannot identify another lawful processing condition, it is not appropriate to contact the individuals in a purported attempt to refresh it now. If you can identify another lawful processing condition for keeping and using the data, ensure your data collection statement clearly reflects that so that individuals are provided with information about how their personal data is processed. If you cannot identify another lawful processing condition, it may be the case that you can no longer use or keep this data. ‘So think about whether you actually need new consent before sending the emails and make sure that it is clear and easy for people on your marketing database to withdraw their consent should they wish to do so. ‘Ensuring the clients on your database have been provided with clear information about the processing of their data is by far the most important thing a business can do. It will assist in building a relationship of trust and confidence with your clients going forward.’
Mrs Martins advised all businesses and individuals to consult the Office of Data Protection Commissioner website or seek guidance from appropriately experienced advisors in relation to the new law to prepare for the changes required.
The following documents provide further information on aspects of this press release.
Conditions for Lawful Processing Consent Information to be Given – Transparency
&
Indulge