Guernsey and Jersey face significant impact from EU Data Protection reforms

Sweeping changes to European privacy and Data Protection legislation will have a significant impact on the Channel Islands, says the head of the CI Data Protection regulator.

Emma Martins has warned that the authorities will need to prioritise reform of existing laws and practices, and that businesses must be ready for the impact of the changes which are expected to take effect from 2018.

And she has warned that delays or failure to adequately prioritise and resource the work could have a seriously detrimental effect on the financial and digital sectors, which rely on seamless flows of information across jurisdictions.

The new legislation, in the form of the General Data Protection Regulation (GDPR), focuses on giving members of the public stronger rights in terms of the way that governments and businesses process their information, including:

• New limits on how your personal information can be used (or “processed”) or shared with others by government departments or companies.
• New protection for young people under 16, allowing for parental consent for their personal information to be processed.
• New rights for people to demand the erasure of their personal information, restrict the use of personal information and to data portability.
• A new requirement for “public bodies” and certain private sector organisations to have qualified Data Protection officers, with legal protection for those officers.
• Fines of up to 20 million euro – almost £16 million – or 4% of global annual turnover for serious contraventions of the rules.

Mrs Martins holds the role of Information Commissioner in Jersey (with responsibility for regulating Data Protection and Freedom of Information legislation) and Data Protection Commissioner in Guernsey.

She says that with such a clear potential impact on the financial services and burgeoning digital sectors in both Islands, it is imperative that politicians and governments recognise the importance of the reforms, and that they sufficiently prioritise the work here in the Islands.

If no new resources are put into this area, she says that meaningful action will be “extremely challenging” and the Channel Islands will be left behind in an era of global changes in the way data now underpins innovation, economic growth and consumer rights.

She said: “If Jersey and Guernsey are to respond in a timely manner to these developments, ensuring the continued high standards of protection for data whilst remaining a competitive and attractive jurisdiction for processing activities, then we need to progress with the significant task of reviewing the requirements, drafting new legislation and supporting business in getting compliance right.”

“These matters sit against a backdrop of budgetary pressures for all areas of government and the Islands need to decide on a clear pathway based on proper assessment of the opportunities and risks associated with both action and inaction.”

“Even if the Channel Islands do not update their own legislation, the extra-territorial nature of the GDPR will mean that businesses which hold data relating to EU citizens are going to have to comply with the requirements so need to start preparing now. “Whilst it is clear that the GDPR will have a significant impact on all businesses, those who are taking their current legal obligations in respect of data protection seriously will be at a distinct advantage.”