Guernsey data protection authority announces extension to exemption registration

The Office of the Data Protection Authority in Guernsey (ODPA) has announced that anyone who is currently exempt from the legal requirement to register with the ODPA will now continue to be exempt until January 2021.

Every controller and processor of data (including business, charity, organisation and in some circumstances individual) is required to work with and comply with the Data Protection (Bailiwick of Guernsey) Law, 2017 (the DP Law), however, certain exemptions mean that currently there is no need for some data controllers or processors to register with the ODPA.

In broad terms, these exemptions apply to the following three groups:

1. those that only process data that is for accounts and record-keeping for core business purposes for staff administration and to market their own goods or services;
2. those who only process data under instructions given by another entity (processors) ; and
3. those who have charity or not-for-profit status.

Any local entity (such as a small business or a sole trader) which currently meets the exemption criteria under the DP Law will not need to register with the ODPA until the beginning of 2021, extending the deadline for registration from 31 December 2019, which itself, had been extended in October 2019.

The ODPA has explained that the extensions have been granted due to the fact that it has taken longer than expected for the States of Guernsey and the ODPA to reach agreement on the method of funding the ODPA .

If not further extended, as from 1 January 2021, all exemptions to registering with the ODPA under the DP Law will end, and all previously exempt local entities that are processing or controlling personal data will be legally obliged to register with the ODPA for the first time and pay a small annual fee that will contribute towards the ODPA’s operational activity. While the ODPA has not confirmed what the annual fee will be, they have indicated that it will be low (between £25 to £50 per year, per entity).

The Bailiwick’s Data Protection Commissioner, Emma Martins, previously commented on the extension: "For the past year we have been working hard to try to reach agreement with the States of Guernsey on how the ODPA’s operational activities are funded. Above all else, we want to ensure that we agree on a fair, low-cost, low-admin model that allows local businesses to concentrate their efforts on running their businesses well, rather than filling in bureaucratic forms. We continue to pursue that goal."

Should you wish to discuss the ODPA extension and/or the DP Law in Guernsey, please do not hesitate to get in touch with us.