Guernsey Data Protection Legislation
-
Upload
jonbarclay -
Category
Documents
-
view
912 -
download
2
description
Transcript of Guernsey Data Protection Legislation
DATA PROTECTION
Wednesday, 8 October 2008Friday, 10 October 2008
Monday, 13 October 2008
An Overview of Data Protection Legislation in
Guernsey
Jon Barclay, Advocate
AO Hall Advocates
Background: The EC Directive
● Sets out uniform standards for good data handling practice.
● Implemented in UK by Data Protection Act 1998.
● Not binding on Guernsey, but implemented here for business reasons.
● The Data Protection (Bailiwick of Guernsey) Law, 2001 is modelled on the 1998 Act.
● European Commission Decision of 21 November 2003: Guernsey has “adequate” data protection.
Main Features -
● Notification Requirements for Data
Controllers
● Data Subject Rights
● Good Data Handling Practices
● Supervision and Enforcement Procedures
Guernsey’s Data Protection Law
Definitions
● “Data” – information stored or processed electronically,
or manually if stored on a “relevant filing system”.
● “Relevant Filing System” – a set of information which
is structured, either by reference to individuals or by
reference to criteria related to individuals, in such a way that
specific information relating to a particular individual is
readily accessible.
Definitions continued…
● “Personal Data” – must relate to a living individual
who can be identified from those data or from those
data and other information which is in possession of the
data controller.
● “Data Controller” – a person who determines the
manner in which personal data is processed.
● “Data Processor” – any person other than an
employee who holds data on behalf of the data controller.
Definitions continued…
● “Data Subject” – a living individual who is the subject
of personal data.
● “Processing” – obtaining, recording or holding the data
or information and carrying out any operation in relation to it.
● “Sensitive Personal Data” – personal data which
consists of information about the subject’s racial or ethnic
origin, political opinions, religious beliefs, trade union affiliation,
physical or mental health, sex life, criminal activities or
criminal record.
Scope
● All data controllers in the Bailiwick.
● All personal data.
● Foreign controllers who process data here.
● Focus on privacy.
● There is no Freedom of Information legislation in Guernsey.
Personal Data
● Email and other addresses
● Telephone subscriber details
● Credit record
● Banking details
● Employment references
● Criminal convictions
● Biometric data
● Medical data
● CCTV footage
● Records of personal telephone calls
● Recorded expressions of personal opinion
● etc
Notification Requirement
● Annual notification unless exempt
● Public register
● Transparency and openness
Notification Details
● Contact details
● General purposes of processing
● Types of data subject
● Types of data
● Potential recipients
● Other jurisdictions
● Security measures
Useful addresses
• www.dpr.gov.gg
• www.gov.gg
Data Subject Rights
● Subject access
● Rectification, blocking, erasure and destruction
● To prevent processing likely to cause distress
● To prevent processing for direct marketing
purposes
● Compensation
● Automated decision-making
● Request for an assessment
Subject Access Requests
Individuals are entitled to request a data controller to provide
them with -
● a description of any data which is being processed by
reference to them
● a description of the purposes for which it is being
processed
● a description of any potential recipients of the data
● information as to the source of the data
Exemptions
● Public Security
● Investigation of Crime
● Regulatory Activity
● etc
Conflict of Subject Rights and Controller Duties
• STRs
• Third party privacy
• etc
Automated Decision Making
• Significant?
Objections to Data Processing
• Damage or distress
• Direct Marketing – Preference Services
Other Rights
• Rectification, blocking, erasure and destruction
• Compensation
• Assessments
Data controllers: duty to follow good data handling practices
• All data controllers must observe the Data Protection Principles
• Even if exempt from notification
The Data Protection Principles
Personal data must be :
1. processed fairly and lawfully
2. obtained for specified and lawful purposes only
3. adequate, relevant and not excessive
4. accurate and kept up to date
5. kept for no longer than is necessary
6. processed in accordance with the rights of data subjects
7. kept secure
8. transferred to third countries only if they ensure an adequate level of data protection
First and Second Principles: “Lawful”?
● Breach of Privacy
● Hacking
● Breach of Confidentiality
● Rehabilitation of Offenders
● Theft
● Obtaining by Deception (“Blagging”)
● Unlawful Interception of Communications
First and Second Principles: “Fair”?
Consider:
● The method by which the data was obtained
● Statutory authority or requirement
● Informed consent
Also:
● Is a Schedule 2 condition met?
● Sensitive personal data: Is a Schedule 3
condition met?
Quality Standards
Third Principle: relevant, adequate and not
excessive.
Fourth Principle: accurate and kept up to
date.
Fifth Principle: kept for no longer than is
necessary.
Sixth Principle: Data Subject Rights
● Subject access rights
● Privacy
● Security
Seventh Principle: Security
Security Measures –
● Passwords (which should be changed regularly)
● Careful location of computer screens
● Procedures to verify caller identity
● Clear, written data protection procedures
● Making breach of data protection procedures a disciplinary
offence
● Use of encryption
● Other technical and operational measures
Eighth Principle: Data export
• EEA• “Adequate” Countries• Elsewhere
•Data Transfer Agreements•Model Clauses
Enforcement Authorities
•The Commissioner•The Police•The Courts
The Data Protection Commissioner
● Role
● Enforcement Powers
● Requests for Assessment
Offences
• Failure to notify• Unauthorised disclosure, selling or obtaining• Failure to comply with a notice• Blagging• Unsolicited communications• Enforced SARs
The Commissioner’s Role
• Promote good information handling practices• Encourage respect for privacy• Enforce the legislation• Inform and direct policy
The Commissioner’s Powers
• Limited• Enforcement notices• Encouragement and Education rather than
coersion
Requests for Assessment
• Unverified• Verified• Enforcement Notices• Information Notices and Warrants
An Overview of Data Protection Legislation in
Guernsey
Jon Barclay, Advocate
AO Hall Advocates
DATA PROTECTION
Wednesday, 8 October 2008Friday, 10 October 2008
Monday, 13 October 2008