The ODPA sent
this email to all its registered entities (text reproduced below) on 17 May 2019 to inform them of some important changes to the registration process and some action they may need to take before 23 May 2019.
Background
- On 25 May 2019 the transition period of our local data protection law comes to an end; find out what this means for you here.
- There is a specific aspect of transition that we need to draw your attention to as you are currently on our list of registered entities: the changes to our registration process.
- The good news is, it’s going to be much simpler after 24 May 2019.
- The Committee for Home Affairs approved these changes to the registration process on 13 May 2019.
What’s changing? The three changes are:
- We will be collecting less information from you as part of your registration.
- We will be removing the public search function of our register.
- We will be using the term ‘registration’ instead of ‘notification’.
Why is this happening?
Looking at each of the changes in turn:
1. After 24 May 2019 we
no longer need to collect the following information from you, as
you should be keeping your own record of it:
- The purposes you process personal data for
- Types of personal data you process
- People whose personal data you process
- Organisations you disclose this data to
- Where you transfer data to
Since its introduction in May 2018
The Data Protection (Bailiwick of Guernsey) Law, 2017 (sections 12 and 13) states that
you must provide the above information in your own publicly available privacy statement.
Read guidance on information to be given in privacy statements here. It also forms the basis of the record keeping required under section 37 of the Law, and Regulation 8 of
The Data Protection General Provisions (Bailiwick of Guernsey) Regulations, 2018. This
template of a controller’s duty to keep records may be useful for you.
This is good news, because it means that now you only need to maintain this information yourselves in
one place, in
your preferred format, rather than having to amend the information we hold too. As a result the act of renewing, and editing your registration with us will be much simpler after 24 May 2019.
2. We are
removing the public search function of entities registered with us because the
responsibility for the public record of this information has switched to the registered entity themselves, and hence
there is no statutory need for us to maintain a public register. The onus is now on the registered entity themselves to make this information publicly-available in their own way.
3. The last change is simply a terminology change to
reflect the legislation wording: what we used to call ‘notification’, we will now refer to as ‘registration’. This simply means that what was your ‘
notification number’, will now be called your ‘
registration number’.
What do you need to do?
Again, taking each change in turn:
- ACTION REQUIRED: You need to maintain your own publicly-available record of all the information previously detailed in your registration. It is your responsibility to ensure your privacy statement is kept up-to-date and that it includes all the required information. If you do not currently have one, please take a copy of your existing registration by going to ‘Search the Register’ before 23 May 2019. After 24 May 2019 the ‘search the register’ function of our website will be removed and you will only be able to renew or amend your registration.
- AWARENESS ONLY: You need to be aware that you will not be able to search our register after 24 May 2019.
- AWARENESS ONLY: You just need to be aware of the change in terminology to replace the word ‘notification’ with the word ‘registration’.
What’s next?
From 2020 onwards, it is expected that a new model will be in place to fund the ODPA’s work. Work is ongoing to devise a fair, simple, and innovative funding model, more information on this will be available soon.
Questions?
If you need any assistance, or more information
please contact us.
&
Indulge