As part of International Data Protection Day on 28th January, the Office of the Information Commissioner and Data Protection Commissioner is calling on all businesses in the Channel Islands to ensure they make themselves aware of impending legislative changes that will have significant ramifications for the way that they handle all personal data.
When it comes into force across the European Union (EU) from May 2018, the General Data Protection Regulation (GDPR) aims to strengthen data protection rights for individuals and harmonise compliance requirements for businesses.
GDPR is set to be the largest change to the protection of personal data across Europe since implementation in 1995 of the EU Data Protection Directive which is currently in force. At that time, and in response to the transfer controls on data exported from the EU, the Channel Islands implemented the Data Protection (Bailiwick of Guernsey) Law, 2001 and the Data Protection (Jersey) Law 2005 which ensured the continued free flow of data to the Islands.
The Regulation will be overseen by the European Parliament, the European Council and the European Commission. The governments of Jersey and Guernsey, together with the Channel Islands Brussels Office, are working with the Commission as well as key stakeholders, to ensure the Islands are prepared for the changes and businesses are aware of their responsibilities and have time to prepare.
The Commissioner is using Data Protection Day, an international day designed to raise awareness and promote privacy and data protection best practices, to start the public conversation about GDPR and its implications.
Emma Martins, head of the Channel Island Data Protection regulator, said, ‘The introduction of GDPR will be transformative for how businesses handle personal data; we are on the verge of huge change in data regulation. To support businesses of all sizes, we will be preparing information and guidance as the law drafting progresses throughout 2017 and are committed to continuing this conversation with businesses.
‘I cannot over emphasise the importance of being prepared for this legislation. I particularly want to stress this to the Islands’ small to medium sized business communities who may not have access to the legal or compliance expertise and resources available to larger organisations. The new regulations are certainly going to up the game in terms of compliance obligations and there is much greater accountability for data controllers and processors. Wherever personal data is involved, whether that is staff, client or any other information relating to individuals, data protection compliance will have to be considered and built in at the beginning of the process and to a more significant and demonstrable degree.’
Mrs Martins is also clear that GDPR is extremely important for individuals: ‘Whilst this is important for the Channel Islands in that it will ensure we remain a trusted jurisdiction with no restriction on data flows, its importance for all of us in a personal context should not be underestimated. We live in an era where a vast amount of our personal information is being collected and used in ways unimaginable only a few years ago. What happens to that data is a deeply serious question and effective regulation plays a significant part in ensuring we all have the rights we are entitled to and have come to expect living in a democracy.’
Both governments have committed to GDPR being incorporated into local law with the intention of being ready for implementation for May 2018.
‘I have had extremely positive meetings with senior representatives from the States of Jersey and States of Guernsey, both of which are committed to ensuring the Islands are fully compliant with GDPR. In anticipation, we have begun a comprehensive review of the Commission’s structure and resources to ensure we are in in a strong position to support businesses at this time,’ added Mrs Martins.
Data Protection Day is aimed at individuals, families, consumers and business and encourages people to consider the important of protecting their personal information online.
For further information about GDPR, please visit the bespoke GDPR section of our website: http://www.dataci.je/gdpr/