Data protection registration in Guernsey from January 2021

The Office of the Data Protection Authority in Guernsey (ODPA) will introduce a new registration and levy regime from January 2021 which has been approved by the States of Guernsey. This new regime requires all entities, including local organisations, businesses and sole-traders established in the Bailiwick of Guernsey who process personal data to register with the ODPA. Processing refers to anything a controller or processor does with personal data including collecting, storing, organising, using, altering, disclosing, erasing and destroying the data. Personal data is anything about, or related to, an identified or identifiable living person including names, addresses, medical records, CCTV footage, social media activity, internet browsing history, emails which include content about individuals and political views. Currently some entities, mostly small businesses, may be exempt from registration with the ODPA but these exemptions will end on 31 December 2020. The only remaining exception will be for domestic or household purposes.

Entities who process personal data will need to complete an annual return during January – February of each year and pay an annual levy to the ODPA. The ODPA has ensured that its funding model be as cost effective as possible and have created a two-tier cost structure comprising of:

• £2,000 per year for organisations with 50 or more full-time equivalent staff; or
• £50 per year for all other organisations.

Registered charities and not-for-profit organisations are required to register with the ODPA and renew their registration annually but are not required to pay an annual fee.

These changes to the regime are a result of the Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law) (as amended by The Data Protection (General Provisions) (Bailiwick of Guernsey) (Amendment No.2) Regulations, 2020 which came into operation on 1 October 2020) which created an independent regulator. The States of Guernsey decided that the ODPA should be self-funded to ensure full independence – the new registration and levy regime enables this. The new fees regime will allow the ODPA to move towards self-funding status, giving it full financial independence from the States of Guernsey. Independent status for the ODPA is both a political and legal requirement.

Entities need to be aware that the simple act of registering with the ODPA does not make them compliant with the Law and it is instead how they process personal data which determines that. Compliance with legal duties under the Law benefits entities directly as it helps them build trust and confidence with their customers, service users, staff and any other people whose data they use in anyway and ensures that ultimately no lives, careers or reputations are damaged as a result of misuse of data. The ODPA will be registering new entities in January to February 2021 and will be fully supporting them in this process and helping them to understand and engage positively with their legal duties under the Law.  

Should you wish to discuss any of this further, or need assistance with the registration process, please do not hesitate to get in touch with us.

For further details, please visit here

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice