The UK Data Protection Act 1998 became fully operational on 24 October 2001 and imposed new requirements on all Bailiwick based organisations who have personal data processed for them in the UK. Similar legislation has been enacted throughout the European Economic Area (i.e. the the European Union plus Norway, Iceland and Liechtenstein) and in Switzerland, Jersey and the Isle of Man.
The Data Protection (Bailiwick of Guernsey) Law, 2001 is a close copy of the UK Act and organisations that are compliant either with the Act or the Law can be assured that they are compliant with both
The Law and the legislative environment in the Bailiwick has been assessed by the European Commission as providing adequate protection for personal data transferred to the Bailiwick from any EU state, so there should be no Data Protection impediments to the export and processing of personal data locally.
In particular, there is no requirement for standard contractual clauses to be applied to the export of data to Guernsey.
However, if you have personal data processed for you in the UK or elsewhere in the EEA it is recommended that you take the following actions:-
- Ensure that a contract or agreement exists between you and the UK/EEA based organisation that is processing the data and that it provides sufficient authority to show that they are processing the data on your behalf; and
- Provide confirmation to the UK/EEA organisation processing the data, that your organisation is in compliance with the Data Protection (Bailiwick of Guernsey) Law, 2001 and that the Bailiwick of Guernsey has been assessed as providing adequate protection by the European Commission
All organisations located in the Bailiwick are reminded that it is an offence to process, or have processed on your behalf, personal data without having Notified such processing unless a valid exemption applies. Information about Notification is available on this site by clicking on the link at the foot of this page.
In general, provided that a data controller established in the Bailiwick has Notified their processing to the Guernsey Data Protection Office, there should be no need to notify in the UK, unless they have a separately established business in the UK.
Comprehensive advice on your existing compliance status and other requirements can be obtained by telephoning (01481) 742074, by E-mailing us at: firstname.lastname@example.org or consulting the Guidance Notes available on this site.
Extensive information on the UK Act is available from the Information Commissioner's web site: www.ico.gov.uk.