This content has been automatically generated from the original PDF and some formatting may have been lost. Let us know if you find any major problems.
Text in this format is not official and should not be relied upon to extract citations or propose amendments. Please see the PDF for the official version of the document.
STATES OF JERSEY
Corporate Services
Data Protection Review Sub-Panel
FRIDAY, 19th FEBRUARY 2010
Panel:
Deputy T.A. Vallois of St. Saviour (Chairman) Senator S.C. Ferguson
Deputy D.J. De Sousa of St. Helier
Mrs. H. Ruelle (Panel Adviser)
Witnesses:
Senator A.J.H. Maclean (The Minister for Economic Development) Mr. J. Mews (Director, Finance Industry Development)
In attendance:
Ms. K. Boydens (Scrutiny Officer)
[12:00]
Deputy T.A. Vallois of St. Saviour (Chairman):
Good afternoon and welcome to the Corporate Services Scrutiny Panel for Data Protection. I would just like to refer firstly your attention to the protocol in front of you to ensure that you are happy with the terms of that? Yes? I would just like to ask you if you could give your name and your title for the tape.
The Minister for Economic Development:
Yes. Senator Alan Maclean, the Minister for Economic Development.
Director, Finance Industry Development:
James Mews, Director, Finance Industry Development.
Deputy T.A. Vallois:
Thank you. My name is Deputy Tracey Vallois and I am Chairman of the panel.
Senator S.C. Ferguson: Senator Sarah Ferguson.
Mrs. H. Ruelle (Panel Adviser):
I am Helen Ruelle from Mourant du Feu & Jeune and I am the panel's legal adviser.
Deputy D.J. De Sousa of St. Helier : I am Deputy Debbie De Sousa.
Deputy T.A. Vallois:
Okay. Thank you. We have called you to the panel purely to ask you your views on the proposed amendments to the Data Protection (Jersey) Law 2005, just purely because obviously we are trying to see whether it is proportionate to Jersey, whether it is robust in the way it has been put forward, so we would appreciate if you could give us details of how you see this affecting the businesses and the economy with regards to the changes being proposed.
The Minister for Economic Development:
Right. Well, just very briefly we have had an initial look at the information that has come out. I think in principle we understand the drive by the Data Protection Commissioner to improve, having gone through a period of settling in since the law was first introduced. We think generally what has been proposed is probably not unreasonable. We have of course some concerns, as you might well imagine from a business perspective. Any changes and an increase from a, if you like, red tape bureaucracy regulatory perspective has a cost to business and I think it is important that it is proportional. I think there is one aspect of the proposals that perhaps concerns us in some respects, and that is the ability to give greater powers from an investigative point of view and I think that is an area where we would like to understand a little bit more about before giving any more detail. But certainly we have some concerns about the additional power that the commissioner is seeking in that respect and the effect that it may well have from a burden point of view on business.
Deputy T.A. Vallois:
Okay, so if we look at the amendments as we go down, because there are 8 amendments being proposed. Amendment 1, which I think is the one you were just referring to, which is the investigative powers, would there be any effect on businesses if ex-employees of another firm were liable?
The Minister for Economic Development: Sorry, could you repeat that?
Deputy T.A. Vallois:
Would there be any effect on businesses if ex-employees of another firm were liable?
Director, Finance Industry Development:
Right. I think the big issue here and I must admit we have not had much time in order to consider these and so I think one of the important things, a caveat to all of this is that we have asked Jersey Finance to send an email out to their members and come back to us. They have not had the time to do that yet, they are collating general responses at the moment about how the finance industry are finding the data protection laws at the moment, and then the subsequent bit is looking at these proposed changes. So until we get that back to a certain degree we are talking in a slight vacuum, but we will try and assist as we can today and feed any further information which we get back to you when we receive that in. But I suppose one of the things which could be a concern is the fact that if we are seeking to gold plate something and go beyond the U.K. (United Kingdom) position which could have a consequent effect on business, because obviously every investigation will have costs associated with that, we would be concerned if we are going too far. So obviously the U.K. has done a number of things in this area and some of these, for example the first amendment, proposes to go further than the U.K. and so I am not sure what work has been done in that regard in terms of looking at why we should go beyond what is an international standard.
Deputy T.A. Vallois:
Okay. Amendment 1 was something that the I.C.O. (Information Commissioner's Office) in the U.K. was lobbying for for many years and it still has not been introduced as yet. Also it is already in provision of the Irish law, it was originally there from the beginning, so it is something that they have always had and were always aware of. The concerns with us is how far that the commissioner can go and how the responsibility is lying with the data controller at present but this is asking the Data Commissioner to go that little bit further and ask individuals for information. So we would just like to see if that affects business and if that would have a detrimental effect on business in your view?
Director, Finance Industry Development:
Well, I think it is likely that anything that places additional responsibilities and burdens on additional people is likely to have some effect. Now, it is hard to know how much effect that would be in reality. I do not know, for example, how many investigations are carried out. But the mere fact that an individual has additional responsibilities is probably going to affect the way they approach the work that they do and it is that whole area which obviously causes concern.
The Minister for Economic Development:
I think you should bear in mind of course that the Island has predominantly a large number of small and medium sized entities and of course the impact from a cost perspective is that much greater on organisations that are much smaller, 5 or less employees, 75 to 80 per cent of businesses in the Island fall into that category, so there would be a concern there. But clearly we have not got a quantified statement.
Director, Finance Industry Development:
Are you able to tell us more about why the U.K. has not brought in these changes?
Deputy T.A. Vallois:
I will pass that over to my adviser.
Mrs. H. Ruelle:
I do not know, is the answer. We have been trying to find out through various Hansard debates and things like that exactly what the reasons were. We have not yet been able to get to the bottom of the exact reasons. All we know is that generally speaking, from the information we have had so far, it is obviously, as you have pointed out, a wide power and therefore there is general concern because it is a wide power that anything more specific or detailed than that at the moment we have not been able to get hold of. But we continue to look into that area.
The Minister for Economic Development:
Could I just ask, in the U.K. have representative groups for business like the Chamber of Commerce, Institute of Directors and such like been particularly vocal on the matter in the U.K. at the plans that have been put forward?
Mrs. H. Ruelle:
Again I do not know. It has been a long time since I practised in the U.K. It is not something that I have been closely involved with, but again it is something that we have been trying to find out through various channels. So yes, that is exactly the sort of thing we will be looking at.
Deputy T.A. Vallois:
It may be of interest, because I have done a lot of research on a personal basis as to data protection, looking at the I.C.O. website and researching what was happening, because there have been a huge amount of amendments to the U.K. law which is why we are trying to identify why it is just these 8 amendments coming forward to see why and whether it is proportionate to Jersey. So it has documentation as to the details and why they lobbied for it, and also they would have received information back, so if it is helpful for you to just refer you to that area, because I have personally done quite a lot of research on this myself.
The Minister for Economic Development:
That would be extremely helpful because, as James pointed out, we have had only a very short time to give this consideration.
Deputy D.J. De Sousa:
How would you see a knock-on effect on businesses if this amendment to the law was implemented?
The Minister for Economic Development:
Quite simply it would be, I would expect, a cost implication, but it is almost impossible at this stage to quantify that.
Deputy D.J. De Sousa:
Is that the only implication that you see?
The Minister for Economic Development:
Well, I think that is probably the most relevant one, yes.
Director, Finance Industry Development:
I think when we talk about costs obviously the costs can be made up of a number of different components and that is time by paid employees to look at things and to work through things and to comply with requests and things like that, and then obviously so you have got your manpower costs and you have got other costs in terms of getting information together. Some of it may be held in electronic form which may be relatively easy to pass over, but bits may not be. So if you associate that as well with increased powers perhaps to seize equipment and things like that obviously you would want to be concerned about what the possible knock-on effects could be.
Deputy D.J. De Sousa:
Bearing in mind the main part of amendment 1 is that not just data controllers and processers can be questioned, it can be the ordinary person. Do you still perceive that the only implication is a cost implication?
The Minister for Economic Development:
Well it would be because of course companies would then have a responsibility to ensure that all members of staff were appropriately trained and aware of the requirements. Again it comes back to cost.
Director, Finance Industry Development:
But obviously as well on top of that if you are looking at the individual, I mean we are talking very much from a department's perspective because obviously we are concerned with developing the economy and the businesses on the Island, but you have also got potential criminal sanctions as well which could influence obviously people and result in more time being spent on things than are perhaps strictly necessary because people obviously are going to be very concerned about that. Speaking in a more general area, it is not something which is really our remit to do, but clearly looking at individuals then you could see that the whole weighing up of the human rights dimension is something that is quite important.
Deputy D.J. De Sousa:
Would there be concerns about increased penalties from the business fraternity with the prison sanction?
The Minister for Economic Development:
I would imagine there would probably be so, yes.
Deputy T.A. Vallois:
Say for example if there was a case that the data controller had breached data protection by information being released and the employer had released that information but now they were no longer employed by that company, that company is still liable for that information being breached anyway, but this person who has had the information and moved to another company could not be touched by law. So how would you see that in the case that at the moment in order to get that information the Data Protection Commissioner as she states in her report would have to be heavy- handed by going to the police and obtaining that information and this law would seek for her to be able to just go and ask with an information notice to provide that information?
The Minister for Economic Development:
I would suggest that the current system, although cumbersome and perhaps described as heavy-handed, has the necessary checks and balances in place to be appropriate and perhaps reasonably balanced. I would say from a business point of view of course I suspect it may be an insurable risk. Of course that would have an impact on premiums and so on, but that opens up a whole ambit of potential issues.
Director, Finance Industry Development:
The nice thing about the data protection law at present is that it clearly places responsibility on an entity. Once you start then spreading that around as employees move throughout the business community then they are not only imposing costs on that one business but potentially other businesses as well, and so that is why as drafted at present it works quite neatly. Once you start going beyond that then obviously there are further concerns which have to be thought about.
Deputy T.A. Vallois:
Moving on to the next amendment we have got here with regards to the penalty, the maximum penalty which is amendment 3, would there be concerns about increased penalties from the business side of things?
Director, Finance Industry Development: What is the existing penalty, please?
Deputy T.A. Vallois: It is a fine.
Director, Finance Industry Development: So it is moving it from a fine to imprisonment?
Mrs. H. Ruelle: Yes.
Deputy T.A. Vallois:
A maximum of 2 years' imprisonment.
The Minister for Economic Development:
What is the maximum penalty at the moment in terms of the fine?
Mrs. H. Ruelle:
I do not know what scale it is. I think it is level 4, which would be £5,000 I believe.
The Minister for Economic Development:
A law to be effective has to have again an appropriate sanction otherwise it is going to be open for abuse. I mean the level of financial penalty is probably more appropriate, I think. An imprisonment or potential imprisonment is quite a heavy sanction.
[12:15]
Deputy T.A. Vallois:
Okay, but in the case of say for example in the U.K. we have seen telecoms companies selling data, well, it was India, was it not, selling data to people, individuals, breaching the data protection law intentionally. Large amounts of data, this affecting people's lives on a daily basis. Do you not believe that would serve to have a penalty?
The Minister for Economic Development: A penalty, yes.
Deputy T.A. Vallois: Prison?
The Minister for Economic Development:
I think it just needs to be proportional and I would have said that an effective financial penalty is probably appropriate.
Deputy T.A. Vallois:
But if they are making a fortune from, say, selling each bit of data for £50,000 and they get fined a level 4 of £5,000 do you think that is appropriate? Do you think that would deter them from doing it again?
The Minister for Economic Development:
I do not think a level 4 of £5,000 is appropriate, no.
Deputy T.A. Vallois:
But if this penalty was put in for a maximum of 2 years' imprisonment do you believe that in that respect in particular where people are intentionally selling data that that is effectively a good deterrent in the law and it makes the data protection law much stronger in what it is trying to achieve?
The Minister for Economic Development:
It would certainly give the law the necessary teeth, I would accept that and it is important, as I said at the beginning, that whatever laws that are introduced have appropriate sanctions otherwise they are not going to be effective.
Director, Finance Industry Development:
Yes. I think as the Minister said it is a question of getting the right balance and working out what is appropriate. Now clearly the data which people collect is increasing all the time and it may be as you said that examples of abuse are possibly becoming on a larger scale now and if that is the case then it may well be proportionate to increase the penalty. But the key thing I think as the Minister said is that it is a proportionate increase in order to give the law the teeth that it needs and that is really the right balance which has to be struck.
Deputy T.A. Vallois:
Do you think that would affect businesses in any way, having this additional sanction on there?
Director, Finance Industry Development:
To be perfectly honest, people should be complying with the law at the moment and therefore it should not put too much of additional problem in the place of businesses having a law which can be enforced properly, and then you trust the courts to interpret the law and to put in place the proportionate sentence. So hopefully that should be taken care of. It is more the concerns about extending the remit of the law which I think is the principal concern that we have.
Deputy D.J. De Sousa:
Amendment 8 is about amending the provision relating to the notification fee for charities. Do you feel that there is a need for equity between charities and small firms, i.e. the small plumbing firm with just 2 employees?
Director, Finance Industry Development:
Well here I am not sure what the basis was for lobbying for charities to be exempt. I would imagine that the number of charities on the Island compared to the number of businesses will be relatively small, so looking at it on that basis it could well be the case and I am sure you have done the research that waiving a fee for charities would not reduce the overall costs which are raised by a great deal and therefore you are not talking about something which overall affects the scheme in any great form. However of course once you introduce certain exemptions you can then often point to other situations and say, well, is it fair that this other person has to pay whereas a charity, perhaps you have got a charity which is a large charity employing perhaps 100 people and they are exempt and yet a small firm with only 2 people is not exempt. So I think that is the overall problem, once you come to exemptions, is that you can always point to areas where it does not seem to be fair. Subject to that, if you accept that it is sensible to have an amendment for charities and exempt them then overall it should not seem to cost too much and result in businesses bearing much of an additional burden, I would have thought, because of the numbers. I do not know, Minister, whether you want to add anything to that?
The Minister for Economic Development:
I think James has probably summarised quite well. I would not really add anything to that.
Deputy T.A. Vallois:
Another one in particular with regards to businesses being affected was amendment 4 where they are looking to amend it for the power of seizure to include equipment found on the premises of a data controller. Would you expect a backlash from firms losing computers for months, or years, as a result of investigations related to current or former staff actions?
The Minister for Economic Development:
Is this bringing it in line with the U.K. currently?
Mrs. H. Ruelle:
Yes, but it is worded differently. The principle is the same in both the U.K. and the proposed amendments for Jersey.
The Minister for Economic Development:
I mean again from a proportionality point of view within Jersey it would be interesting to know the level of occasions when there would have been a need to seize such equipment. Is the current law not deemed to be as effective as it is because it has not got that provision?
Deputy T.A. Vallois:
Okay, because it has been said by previous witnesses it is bringing it back into line with the 21st century really. Because at the moment they can only retrieve documentation in regards to their investigation. Think how many businesses now use computers so I mean previous witnesses have said it is bringing it into the 21st century but then again it is that effect as well that it may have for the business, especially if they solely count on equipment to do their business. I suppose I am answering the question for you. [Laughter]
The Minister for Economic Development: You put a fairly compelling case forward, yes.
Director, Finance Industry Development:
It is clearly very difficult balancing a different party's rights here. Clearly anything which takes essential equipment away from a business so that they cannot use it is going to have a dramatic effect on that business, therefore you have to balance up whether the need to obtain that equipment is proportionate to the need to find out what that business has been doing to abuse data, and the real question here is probably about the checks and balances which are in force rather than whether the Data Protection Commissioner is able to access that information. Clearly they have got to be able to access that information, but I think there will be very large concerns from the business community, because if for example a warrant is used to seize equipment which is, let us go back to the example of a small plumbing firm who perhaps has one person who is managing the accounts and everything on one computer which has all the data they need in order to run that business, if that is then taken away from them how are they going to operate? So you can see there are very real concerns about both checks in the law but also how it would be implemented in practise and whether removal of equipment is limited to those circumstances where it has to be and whether there is for example time constraints on the length of time it can then be had in order to access the information, or whether it is something where for example it can just be taken away and returned many years later, which obviously could decimate a business entirely. So those are the concerns. Clearly if it is bringing it in line with the U.K. and bringing it into the 21st century that is something which has to be done to some degree but as everything it is a question of degree and it is not just that one provision, it is all the provisions around that which are really critical in this case. I think there are quite a few examples I can think of where we brought in laws and perhaps substantive clauses the same as the U.K. but we lack the safeguards surrounding it. So that is something where we really do have to be very careful.
Senator S.C. Ferguson:
Yes, because even your BlackBerry would be subject to this.
The Minister for Economic Development: Exactly, it would be subject to this.
Senator S.C. Ferguson:
Could a Minister operate without his BlackBerry? [Laughter]
The Minister for Economic Development: There is a question.
Deputy D.J. De Sousa:
Following on along those lines bearing in mind that E.D.D. (Economic Development Department) as a department have promoted EcoActive which encourages businesses to cut down on their carbon footprint, so therefore encourages them to keep more data on electronic devices rather than paper, do you envisage that there would be any financial impact on businesses as a direct result of this amendment?
The Minister for Economic Development:
Only if they had equipment taken away from them.
Deputy D.J. De Sousa:
That is what I am saying. That is what the amendment is, to take it away.
The Minister for Economic Development:
Yes, indeed. But I think to get a sense it would be interesting to know the number of occasions when if this power had been in place that the Data Commissioner would have seized the equipment.
Deputy D.J. De Sousa:
We will go on from there. You have been within the department for a number of years now, because you were previously an Assistant Minister and now you are the Minister for. Are you aware of any instances that the Data Protection Commissioner has had to come to your department and say: "We need to have this information because of a case"?
The Minister for Economic Development:
No, and I do not think that the Data Protection Commissioner would come to the department particularly. There would be no need for her to do so. It is very difficult to give you any meaningful information on the question that you are asking. It is almost impossible to assess the impact other than if there is some perhaps data in the U.K. that would be relevant the number of times computer equipment has been seized it might give some indication of the quantum but I suspect the impact on business is quite relatively small.
Director, Finance Industry Development:
That is speaking generally and what we would like to do is have a better idea of how often this is used, but clearly if it is used, which is the circumstances which the Minister has not really spoken about there, then it could be potentially devastating for a business and it could cause a business to fold or go under. So it is a real concern in that regard.
The Minister for Economic Development:
It goes back to the point about the number of small businesses we have, 80 per cent of businesses employing 5 or less individuals, so probably only having a limited number of computers and so on, yes, it would have a massive impact.
Deputy D.J. De Sousa:
What I do find very interesting is the fact that we have had Chamber of Commerce in previously and going through all the amendments the overall consensus was that there did not seem to be a problem with any of the amendments, and they deal with businesses large and small, whereas the Ministry of big and small businesses does find an issue with quite a few of the amendments. So I do find that very interesting because you deal with a lot of the same people.
The Minister for Economic Development:
I would not say it is so much of an issue that we find, I think we are just raising some concerns that seem reasonable and so on to us, just from the information that we have seen to date. Clearly the chamber have a view, they are representative of a certain section of the business community and their opinion is obviously valuable but nevertheless it is appropriate that we give our views as to the likely impact. There are many other groups representing businesses which I am sure you will also be talking to and their view and opinion is also of value.
Senator S.C. Ferguson:
With so much regulation by the Data Protection Commissioner should regulation not come under your department?
The Minister for Economic Development:
Rather than the Chief Minister? From a data protection point of view?
Deputy T.A. Vallois: Treasury and Resources.
The Minister for Economic Development: Correct, absolutely.
Senator S.C. Ferguson:
I thought I would just throw it in. Because you have got all the regulatory authorities, you have power of direction to them all.
The Minister for Economic Development:
Yes, you raise an interesting point. In many respects it is a conflicting position from our point of view in terms of economic growth and supporting business and helping them to expand and prosper. We should be looking at deregulating as much as we possibly can, reducing the level of bureaucracy and red tape and effectively removing government as much as possible from the equation to allow business to get on and do what they are supposed to be doing, which is delivering economic growth. I think sometimes we forget that it is not government that delivers economic growth, it is businesses. So by giving us the additional responsibility of further regulatory matters is not something that I would particularly welcome.
Deputy T.A. Vallois:
But I think it could be argued that with the data protection law some people would say that it was imposed upon people from the European Parliament because of the E.U. (European Union) directives that were put in place. Just thinking the way that your department in particular operates with regards to J.F.S.C. (Jersey Financial Services Commission) which is an independent, they regulate God knows how many laws with regards to finance and things like that, so I am just thinking that was the first thing that I thought about when I saw these amendments come up was why if the Data Protection Commissioner is so independent, I understand that she has to administratively go through the Treasury and Resources, however could she not do that through Economic Development as I would imagine the J.S.F.C. would have to do with financial laws et cetera, but they have somebody there administratively and also that does the same thing for other independent bodies?
[12:30]
The Minister for Economic Development:
What would you be trying to achieve by doing that versus the way it functions through Treasury and Resources at the moment? What would be the additional benefit?
Deputy T.A. Vallois:
Well I think the fact that you have a director of regulation in your department and the fact that people would be aware of the set-up and how it works. I think it is about accountability and transparency as well, more than anything else.
The Minister for Economic Development:
It is not a position that I would welcome from an Economic Development point of view. As I said a moment ago I would prefer to have less regulatory control if you like. The J.F.S.C. that you mentioned, they are effectively independent as indeed the Data Protection Commissioner is and her department. I think that is appropriate. I am not of the opinion that that should probably change.
Director, Finance Industry Development:
I suppose the big issue here is if you have got laws which span not only the business community but far wider than that should they be covered by Economic Development? I suppose that is where for example looking at the Charities Commission that is being handled by Chief Ministers and when you have got laws which are of a much wider remit generally they do not tend to come to a department which is focused on business so I imagine that is why it has been dealt with elsewhere and that is the rationale for it. But as you say you can see why there are arguments for placing things in different places.
Deputy T.A. Vallois:
But just pointing out the fact that you just said about putting it in a department which deals with businesses, the data protection law as I understand it the data controllers, the majority of them, are from businesses, so would that not make sense?
The Minister for Economic Development:
In one respect I understand where your argument is coming from but I think as I was saying a moment ago it conflicts with what our primary aim is, which is the development of business and economic growth.
Deputy T.A. Vallois:
Thank you very much. We appreciate your time.
Mrs. H. Ruelle:
Before you go, we were talking about amendment number 4, which is the seizure of equipment. I just wanted to let you know that I have just been looking at the U.K. law while we were talking. I cannot see the amendment to the U.K. law that does bring in equipment, but I believe the view in the U.K. and I will double check this is because of the wording it is probably covered, because it talks about other materials. So it does not specifically say equipment but it is probably covered by the generic term "other materials", so I think that is the view that has been taken.
The Minister for Economic Development:
That is interesting. I would still be interested further to know whether or not any equipment has been seized as part of ...
Mrs. H. Ruelle:
Absolutely, but I just wanted to clarify that for you.
No, that is helpful. Thank you.
Deputy T.A. Vallois: Thank you very much.
Senator S.C. Ferguson: Thank you.
The Minister for Economic Development: Thank you.
[12:33]