Data protection registration from January 2021

Definitions
Exemptions
Registration and levy
Compliance

From January 2021, the Office of the Data Protection Authority (ODPA) will introduce a new registration and levy regime which has been approved by the States of Guernsey.(1) This new regime requires all entities which process personal data, including local organisations, businesses and sole-traders established in the Bailiwick of Guernsey, to register with the ODPA.

Definitions

'Processing' refers to anything that a controller or processor does with personal data, including collecting, storing, organising, using, altering, disclosing, erasing and destroying the data. 'Personal data' is anything about, or related to, an identified or identifiable living person, including:

• names;
• addresses;
• medical records;
• CCTV footage;
• social media activity;
• internet browsing history;
• emails which include content about individuals; and
• political views.

Exemptions

Some entities, mostly small businesses, are currently exempt from registration with the ODPA, but these exemptions will end on 31 December 2020. The only remaining exception will be for domestic or household purposes.

Registration and levy

Entities which process personal data will need to complete an annual return during January to February of each year and pay an annual levy to the ODPA. The ODPA has ensured that its funding model be as cost effective as possible and has created a two-tier cost structure comprising of:

• £2,000 per year for organisations with 50 or more full-time equivalent staff; or
• £50 per year for all other organisations.

Registered charities and not-for-profit organisations are required to register with the ODPA and renew their registration annually but are not required to pay an annual fee.

These changes to the regime are a result of the Data Protection (Bailiwick of Guernsey) Law 2017 (as amended by the Data Protection (General Provisions) (Bailiwick of Guernsey) (Amendment No 2) Regulations 2020, which came into operation on 1 October 2020), which created an independent regulator. The States of Guernsey decided that the ODPA should be self-funded to ensure full independence – the new registration and levy regime enables this. The new fees regime will allow the ODPA to move towards self-funding status, giving it full financial independence from the States of Guernsey. Independent status for the ODPA is both a political and legal requirement.

Compliance

Entities must be aware that the simple act of registering with the ODPA does not make them compliant with the Data Protection (Bailiwick of Guernsey) Law 2017; instead, compliance depends on how personal data is processed. Compliance with legal duties under the Data Protection (Bailiwick of Guernsey) Law 2017 benefits entities directly as it:

• helps them to build trust and confidence with their customers, service users, staff and any other people whose data they use in any way; and
• ensures that, ultimately, no lives, careers or reputations are damaged as a result of data misuse.

The ODPA will be registering new entities in January to February 2021 and will be fully supporting them in this process and helping them to understand and engage positively with their legal duties under the Data Protection (Bailiwick of Guernsey) Law 2017.

For further information on this topic please contact Michelle Watson Bunn at Ogier by telephone (+44 1481 721 672) or email (michelle.watsonbunn@ogier.com). The Ogier website can be accessed at www.ogier.com.

Endnotes

(1) Further information is available here.