The official version of this document can be found via the PDF button.
The below content has been automatically generated from the original PDF and some formatting may have been lost, therefore it should not be relied upon to extract citations or propose amendments.
Proposed Amendments to the Data Protection (Jersey) Law 2005
REPORT
Current data protection legislation has been in force for over four years in Jersey.
In light of local regulatory experience and mindful of developments in other jurisdictions, the following proposed changes have been identified:
- Amending the provisions in relation to information notices.
The draft Amendment Law would provide the Commissioner with the power to serve an information notice on a person other than a relevant data controller or data processor. This closely follows the position under section 12(1) of the Data Protection Acts 1988 and 2003 in Ireland and would not remove existing rights of appeal. Whilst it is recognised that the recent legislative changes in the United Kingdom (the Coroners and Justice Act 2009) do not reflect this, there are a number of policy reasons to support the proposed approach, including:
The Commissioner has encountered difficulties in the course of investigation when applying existing legislation e.g. refusal by an individual to release relevant information results in an investigation being hampered;
the UK Information Commissioner's Office has lobbied heavily for equivalent wording to that contained in the draft Amendment Law;
the proposed amendment will lead to a more effective and proportionate regulatory environment (i.e. more limited recourse to "heavy duty" powers under the Data Protection (Jersey) Law 2005 e.g. involvement of police, obtaining of warrant etc).
- Amending the professional requirements in relation to the President of the Data Protection Tribunal.
Removing the requirement for the President of the Data Protection Tribunal to be of seven years standing as an advocate or solicitor should provide greater latitude in the context of any future appointment process. It does not remove the requirement for a prospective appointee to be a local advocate or solicitor.
- Amending the maximum penalty applicable to an offence under Article 55 of the Data Protection (Jersey) Law 2005.
The draft Amendment Law increases the maximum penalty to two years imprisonment and an unlimited fine. This is consistent with the position adopted in Guernsey in 2009. Similar measures are proposed in the United Kingdom. It recognises that the nature of the breaches in respect of data in this context are increasingly serious and the consequences severe. In addition, other legislation is increasingly looking to the Data Protection (Jersey) Law 2005 for remedy for serious data breaches.
- Amending the power of seizure to include equipment found on premises.
The draft Amendment Law would ensure that equipment, as well as documents and "other material", is capable of being seized under a warrant. This is proposed as a result of increasing computerization of data and as such, the evidence which is required for an investigation is rarely limited to documents. Again, existing safeguards have been retained.
- Amending the maximum fee chargeable for subject access requests relating to health records.
The draft Amendment Law would allow data controllers who are required to respond to subject access requests relating to personal data defined as a health record to charge a maximum of £50. This recognises that health records are largely unique in their nature and supplying copies of the data contained therein requires significantly more resource than requests that relate to other data.
- Amending the provisions relating to subject access exemptions for trustees
The draft Amendment Law would allow the restrictions on information provision relating to trustees contained within the Foundations (Jersey) Law 2009 to be recognised within the Data Protection (Jersey) Law 2005.
- Amending the provisions relating to subject access exemptions
The draft Amendment Law would add Article 41 of the Drug Trafficking Offences (Jersey) Law 1998 to the list of miscellaneous exemptions contained within the Data Protection (Subject Access Exemptions)(Jersey) Regulations 2005.
- Amending the provisions relating to the notification fee for charities
The draft Amendment Law would allow data controllers whose sole processing activities relate to charity work to be exempt from the notification fee.
Financial and manpower implications
There are no financial or manpower implications for the States arising.
European Convention on Human Rights
In the view of the Minister for Treasury and Resources, the provisions of the draft Data Protection (Amendment No.2)(Jersey) Law 201- are compatible with the Convention rights (as defined in Article 1 of the Human Rights (Jersey) Law 2000).