Data Protection
(International Co-operation) (Jersey) Regulations 2005
THE STATES, in pursuance of Articles 54
and 67 of the Data Protection (Jersey) Law 2005, have made the following
Regulations –
Commencement [see endnotes]
1 Interpretation
(1) In these Regulations –
“Convention” means the Convention for the Protection of
Individuals with regard to Automatic Processing of Personal Data, which was
opened for signature on 28th January 1981;
“foreign designated authority” means an authority
designated for the purposes of Article 13 of the Convention by a party bound
by the Convention, but does not include the Authority;
“Law” means the Data Protection (Jersey) Law 2018.[1]
(2) The functions of the Authority
set out in these Regulations are functions to be performed by the Authority as
the designated authority in Jersey for the purposes of Article 13 of the
Convention.[2]
2 Co-operation
between the Authority and foreign designated authorities[3]
(1) The Authority shall, at
the request of a foreign designated authority and for the purposes of Article 13(3)(a)
of the Convention, furnish to that foreign designated authority such
information on the law and administrative practice in the field of data
protection in Jersey as is the subject of the request.[4]
(2) The Authority shall, at
the request of a foreign designated authority and for the purposes of Article 13(3)(b)
of the Convention, take, in conformity with the law of Jersey and for the sole
purpose of protection of privacy, all appropriate measures for furnishing
factual information relating to specific automatic processing carried out in the
territory of Jersey, with the exception however of the personal data being
processed.[5]
(3) A function of the Authority
is to request a foreign designated authority to furnish the Authority with or,
as the case may be, to take appropriate measures for furnishing the Authority with,
the information referred to in Article 13(3) of the Convention.[6]
3 Persons
resident outside Jersey
(1) This Regulation applies
if a person resident outside Jersey makes a valid request to the Authority
under Article 14 of the Convention (whether directly or through a foreign
designated authority) seeking assistance in exercising any of the rights under
Article 8 of the Convention.[7]
(2) A request is a valid
request for the purposes of paragraph (1) if it states –
(a) the
name and address of the person making the request;
(b) particulars
that identify the personal data to which the request relates;
(c) the
rights under Article 8 of the Convention to which the request relates; and
(d) the
reasons why the request has been made.
(3) If the request –
(a) seeks
assistance in exercising the rights under Article 28 of the Law; and
(b) does
not indicate that the relevant data controller has failed, contrary to that
Article, to comply with the same request on a previous occasion,
the Authority shall notify the person who made the request of the
data controller’s address for the receipt of notices from data subjects
exercising their rights under that Article and of such other information as the
Authority considers necessary to enable that person to exercise his or her
rights under that Article.[8]
(4) If the request
indicates that a data protection principle has been contravened by a data
controller the Authority shall –
(a) except
if sub-paragraph (b) applies, notify the person who made the request of
the rights of data subjects and the remedies available to them under Part 6
of the Law together with such particulars as are contained in the data
controller’s entry in the register as are necessary to enable the person
to avail himself or herself of those remedies; or
(b) if
the Authority considers that notification in accordance with sub-paragraph (a)
would not assist the requesting person or would, for any other reason, be
inappropriate, treat the request as if it were a request for an assessment
under Article 21 of the Authority Law.[9]
(5) The Authority shall not
be required, in response to a request that comes within paragraph (3) or
(4), to supply to the person who made the request a duly certified copy in
writing of the particulars contained in an entry made in the register other
than on payment of such fee as is specified for the purposes of Article 17(3)(a)
of the Authority Law.[10]
4 Persons
resident in Jersey
(1) If a request for
assistance in exercising, in a country or territory outside Jersey, any of the
rights referred to in Article 8 of the Convention is made by a person
resident in Jersey and submitted to the Authority under Article 14(2) of
the Convention, the Authority shall, if satisfied that the request contains all
necessary particulars referred to in Article 14(3) of the Convention, send
it to the foreign designated authority in the specified country or territory.[11]
(2) If the Authority
decides that he or she is not required to comply with paragraph (1) in
respect of a request he or she shall, if practicable, notify the person who
made the request of the reasons for the decision.[12]
5 Restrictions
on use of information
If the Authority receives information from a foreign designated
authority as a result of –
(a) a request by the Authority
referred to in Regulation 2(3); or
(b) a request received by the
Authority under Regulation 2(2) or 3,
the Authority shall not use the information except for the purposes
specified in the request.[13]
6 Citation
These Regulations may be cited as the Data Protection
(International Co‑operation) (Jersey) Regulations 2005.