Registration and beyond: changes coming in January 2021

The Office of the Data Protection Authority (ODPA) is notifying all organisations in the Bailiwick of the need to register with them and pay an appropriate fee from next year.

This change comes into effect in January 2021 and all organisations, businesses and sole traders that handle data about people will have a legal obligation to complete a registration under The Data Protection (Bailiwick of Guernsey) Law, 2017. The exemption period currently in place ends on 31 December and the ODPA is reaching out to the regulated community in Guernsey, Alderney, Herm and Sark to make sure everyone knows what is changing, why it’s changing, and what they need to do.

The Bailiwick’s Data Protection Commissioner, Emma Martins, confirmed the new framework is the result of 18 months’ work and looks forward to working with all local organisations engaging with data protection.

‘We have been liaising closely with the States of Guernsey on this new reporting and funding model and it is designed to be fair, simple and innovative, recognising that organisations want regulatory administration processes to be as straightforward as possible. Their time should be spent looking after data well, not completing forms that do little to assist in overall compliance standards.’

‘The simple act of registering does not make a business compliant with the Law – how they treat people’s data determines that. We are keen to register organisations from January and help them understand and engage positively with their legal duties under our local data protection law.’

To help make this process as straightforward and accessible as possible, there will be a link from the final page of the Guernsey Registry’s online annual validation process which will point to the ODPA’s online registration process. This is to remind people of the legal requirement to register under the data protection law if they are working with personal data.

The annual levy to be paid to the ODPA is based on the number of employees in each organisation. It has been set at £2,000 per year for businesses with 50 or more full-time equivalent staff, and remains at £50 for all other entities. This will help fund the ODPA’s activities. Charities and non-profit organisations must register, but do not need to pay any levy.

Entities, such as corporate service providers, who currently register a number of entities with the ODPA can, from January 2021, opt to become an ODPA Levy Collection Agent (LCA). This will allow them to continue registering their administered entities with the ODPA and collect the relevant fees from them. LCAs must be registered with or regulated by the GFSC. If you wish to act as an LCA you will need to prepare, in consultation with the entities you wish to register, prior to the Christmas break so that you can give the ODPA an accurate count of how many confirmed entities you are registering during January-February 2021.

Mrs Martins added,

‘From 2021, LCAs will provide a second route to register with the ODPA for certain organisations and allows them to outsource this administrative task. Local corporate services providers that are registered with or regulated by the GFSC can act as LCAs, and will help in raising awareness of the legal requirement to register with us. Organisations who register via an LCA can then focus on looking after the data in their care, reaping the benefits of building trust and confidence with their customers, service users, staff and any other people whose data they use. This shift in focus from annual box-ticking, to a truly embedded culture of looking after people’s data well helps avoid