Data Protection Commissioner: re-appointment.

STATES OF JERSEY

DATA PROTECTION COMMISSIONER: RE-APPOINTMENT

Lodged au Greffe on 17th June 2016 by the Chief Minister

STATES GREFFE

2016  P.65

PROPOSITION

THE STATES are asked to decide whether they are of opinion

to agree to re-appoint Mrs. Emma Martins as Data Protection Commissioner for a further period up to 31st December 2018, pursuant to Article 6 and Schedule 5 of the Data Protection (Jersey) Law 2005.

CHIEF MINISTER

REPORT

1. Introduction

In December 2015, the States Assembly agreed to extend the appointment of the Data Protection Commissioner[1] ("the Commissioner") until 30th September 2016 (see P.151/2015).

This extension was also agreed by the States of Deliberation in Guernsey.

This agreed extension in both Islands provided a limited window of opportunity in which to consider the role of the Commissioner in the context of new European Union ("EU") data protection legislation, which was announced by the European Commission on 15th December 2015, following agreement between the European Parliament and Council, and published as the official texts of the new EU data protection framework on 4th May 2016. This extension also provided opportunity to consider terms and conditions and arrangements to strengthen independence and governance in light of these wider changes.

An initial review of these developments has been completed, involving work by the Chief Minister's Department, including officers working on digital policy, and applying the expertise of the Law Officers' Department, the Channel Islands Brussels Office, and the Commissioner, and having consulted with agencies such as Digital Jersey. Importantly, it has also involved discussions and consultation with colleagues in Guernsey. The helpful advice of the Jersey Appointments Commission has also been sought.

This work has identified a number of actions which need to be addressed, which working in parallel with Guernsey, will secure important regulatory and economic growth objectives for both Islands. These actions include an extension to the appointment of the Commissioner. This will ensure that the expertise of the office is maintained, and secures continued pan-Island working to address these important EU changes. This will enable us to safeguard our existing services business as well as secure new opportunities. The extension will be accompanied by the establishment of a new interim "Information Commission", subject to discussion with Guernsey counterparts, to strengthen independence and governance within the existing legal framework during this transition.

2. Strategic context

New EU legislation was published officially in May and comprises the "General Data Protection Regulation" ("GDPR"), which will replace the existing 1995 Data Protection Directive, and a new Directive covering data transfers between law enforcement authorities. The GDPR aims to give citizens control over of their personal data and to simplify the regulatory environment for business as part of a digital single market.

These developments sit against a backdrop of far-reaching changes in the way data and information is shaping our lives and how people are now doing business – the Internet, including e-mail and social media, are ubiquitous, and many new developments such as cloud-computing and data analytics, are expanding the importance and use of information and data.

In response, the GDPR will enhance the existing rights of individuals, including the right to withdraw consent to the processing of their data, the right to be forgotten', and the right to data portability', so that people clearly own their own data. It will also significantly enhance enforcement and governance mechanisms, including establishing a new independent European Data Protection Board, and the introduction of significant fines to enforce compliance.

These EU changes will affect other jurisdictions, including the Islands. The GDPR will restrict transfers of EU citizens' data to jurisdictions where the EU does not believe adequate standards of data protection are in place, meaning that jurisdictions that process data on EU citizens must achieve "adequacy status". Jersey and Guernsey currently hold this EU adequacy status under the existing rules, but changes will be needed locally to maintain this status under the GDPR, including enhancing the independence and effectiveness of our local regulatory authority.

These EU changes are also important to economic growth, productivity and prosperity. The financial services industry is global and needs to meet international standards for the protection and exchange of data. The digital industry depends upon effective regulatory frameworks to support growth, and other industries rely increasingly on information and data, and the technological tools that collect this information and by which customers transact and business is done. Achieving adequacy under the new GDPR is essential for the Island's prosperity, and on first review, should be beneficial for Islanders.

The  potential benefits  from these  changes can be  achieved  by being nimble  and innovative, whilst maintaining the highest international standards and continuing to be a dependable and stable place to do business. This is a model that has served the financial services sector well. There is a comparable window of opportunity in the area of data, information and the digital economy.

The draft Jersey Digital Policy Framework recently published for consultation outlines this in more detail. It will address the potential difficulties of non-compliance with the EU developments, as well as helping deliver opportunities for data and services which are consistent with our diversification objectives.

However, there is a need to provide more robust institutional independence, including a fuller separation between government and regulation. The Commissioner's functions are more important than ever before, and it is vital that the legislative provisions are given the priority they need. This is important so that Jersey complies with the EU GDPR, but it is also important for other reasons –

• The Freedom of Information (Jersey) Law 2011 ("the FOI Law") now means that the Commissioner plays a more central role in regulating States Departments, including the States Greffe, to ensure that the public receive the information they are legally due, and providing independent oversight of the appeals process.

• More personal data is being collected and shared across Departments and Parishes than ever before, as they link their systems and procedures together for the benefit of customers, supporting programmes such as eGov and "tell us once".
• The appointment of the Commissioner is currently dependent on the nomination and support of the Chief Minister. The allocation of funding to the Commission is provided via the Medium Term Financial Plan ("MTFP"), which is proposed by the Council of Ministers. The terms and conditions of the Commissioner are proposed by the Chief Minister.
• The powers under the Laws are currently vested in one person. This places particular pressure on a single post-holder, however good they are at their job, especially given the delicate and complex nature of the issues which must be considered. This is highlighted by recent examples, including the extensive report produced by the Commissioner regarding the Independent Jersey Care Inquiry's management of sensitive information, and the first decision notice issued under the FOI Law to uphold the non-release of financial reports into the Jersey International Finance Centre.

3. Actions

The following interim actions are proposed to enable the development of updated legislation, which would be introduced early in 2018, to ensure that the Islands are able in good time to be deemed adequate under the new GDPR. The focus will be on creating a more robust, independent, and expert regulatory environment for data and information, in which Islanders' rights can be upheld and enhanced, commercial opportunities expanded, and international and local regulatory challenges met.

1. Commence  work  on  the  development  of  an  enhanced  regulatory framework. Government, in consultation with agencies and with the support of the Commissioner, will focus on the development of the new regulatory framework  for  consideration  and  implementation  during  2018.  This  will support the Island's strategic objectives and future prosperity. Discussions are ongoing with Guernsey colleagues in order to ensure the continuation of the existing pan-Island approach and co-ordination of the development of this enhanced regulatory framework. Once the initial phases of scoping this work have been completed, a fuller briefing will be provided for all States Members.
2. Establish a pan-Island interim information commission. This would be an interim (non-statutory) independent board, comprised of a few people who could provide independent oversight of the proposed changes before a new legislative and statutory governance framework is introduced during 2018. The interim commission would also assist with developing the terms of reference for any subsequent new and statutory Information Commission which may be proposed in due course. In addition, the interim commission would be able to make  recommendations  to  the  Chief  Minister, including  in  exercising  his powers under Schedule 5 of the current Data Protection (Jersey) Law 2005, dealing with the tenure of the Data Protection Commissioner.

Whilst this Proposition needs to be advanced in a timely manner so as to extend the appointment of the Commissioner prior to expiry of the current contract, Guernsey  have  only  very  recently  had  an  opportunity  to  complete  the

appointment of their new committees, including the Committee for Home Affairs, which leads on data protection matters. It should be noted, therefore, that the interim information commission remains subject to discussion and agreement with Guernsey. Subject to this, the aim would be to establish the interim commission by 1st January 2017.

3. Re-appoint the current Information Commissioner.  There is a  need to re-appoint  the  current  pan-Island  Commissioner  until  such  time  as  the legislation  is  updated  and  a  new  regulatory  framework  comes  into force, currently expected to be during 2018, in order to secure the essential continuity of expertise required during this period of significant change.

It is anticipated that the current post of Commissioner would be likely to evolve, possibly becoming a more permanent senior pan-Island regulatory position, as is usual with other independent regulatory bodies, probably overseen by a new statutory pan-Island Information Commission, who would naturally need to confirm such an appointment. Any such longer-term governance arrangement would be considered in the first instance by the Jersey States Assembly and Guernsey  States  of  Deliberation  when  new  data  protection  legislation  is proposed in due course.

The Jersey Appointments Commission appreciates the challenges inherent in making a successful transition, and supports this overall proposal as a practical solution.

In  addition,  this  extension  of  the  appointment  of  the  Commissioner  is understood to be supported by Guernsey, who have provided clear and positive feedback on the performance of the current Commissioner, and who have also stressed the need for continuity of expertise during this period of change.

In addition, and while a decision is not required on this matter at this stage, it should be noted that it seems likely there will be a need to move the Commissioner, and the associated regulation of both Data Protection and Freedom of Information, outside of government  departmental  structures,  in  line  with  the  approach  adopted  for  other independent regulatory bodies. Any such change would be proposed through the new legislation and would also include a move towards more of a self-funding model, again in line with other independent regulatory bodies. This would enable the Commission to demonstrate the necessary levels of operational and financial independence.

Conclusions

It is essential that clear direction and assurance is provided in this important policy area during this period of significant transition. The approach suggested in this proposal will enable work to advance on the important undertaking of responding to the GDPR, modernising  legislation,  and  providing  the  necessary  confidence  to  Islanders  and businesses.

This approach will also enable the continuation of the pan-Island regulator, ensuring that the Islands retain the expertise we have, supporting wider joint working and strategic alignment between the Islands, and so ensuring a more effective combined voice on the international stage.

Financial and manpower implications

The salary of the Data Protection Commissioner was approved in 2006 at a level equivalent to a Civil Service Grade 15/3. As part of the decision in 2011 to move to a pan-Island Commissioner, it was agreed that costs be divided between Jersey and Guernsey 60%/40% respectively, reflecting activity levels; and a £15,000 supplement was also agreed for the Commissioner to reflect the broader pan-Island responsibilities. Subsequently, the Commissioner took on the additional responsibility of the Freedom of Information (Jersey) Law 2011. In addition, the growth of the importance of data to business and individuals has continued to accelerate, and the challenge of the GDPR has emerged as a consequence. Having considered these matters, and following an independent review of terms and conditions and having considered other jurisdictions, it is recommended that the total salary of the Commissioner be increased by £8,800 to £111,000, inclusive of the £15,000 supplement being brought into base salary. This additional cost will be met through best use of existing resources.

As to the Interim Information Commission, it is hoped that members may wish to serve their community in an honorary capacity. It is, however, recognised that a member from another  jurisdiction,  such  as  the  United  Kingdom,  may  reasonably  expect  to  be reimbursed for expenses and expertise. There is, therefore, a modest provision of up to £28,000 for the administration and expenses of an Interim Commission during the period 2016 to 2018. This aspect is subject to discussions with Guernsey, as noted previously.

In addition, and subject to satisfactory assessment, a persuasive business case is being developed to ensure that adequate resources are available in government and to the Commissioner  for  the  development  and  implementation  of  the  new  regulatory framework during 2018. This is being done through the EPGDP, established in the MTFP to deliver economic and productivity growth, and also examining existing resources. This is important so that we can deliver on the stated ambitions of jobs and growth, and provide the protection that Islanders deserve and expect.