Data Protection
(International Co-operation) (Jersey) Regulations 2005
THE STATES, in pursuance of Articles 54 and
67 of the Data Protection (Jersey) Law 2005[1], have made the following
Regulations –
Commencement
[see endnotes]
1 Interpretation
(1) In
these Regulations –
“Convention” means the Convention for the Protection of
Individuals with regard to Automatic Processing of Personal Data, which was
opened for signature on 28th January 1981;
“foreign designated authority” means an authority
designated for the purposes of Article 13 of the Convention by a party bound by
the Convention, but does not include the Authority;
“Law” means the Data Protection (Jersey) Law 2018[2].[3]
(2) The
functions of the Authority set out in these Regulations are functions to be
performed by the Authority as the designated authority in Jersey for the
purposes of Article 13 of the Convention.[4]
2 Co-operation
between the Authority and foreign designated authorities[5]
(1) The
Authority shall, at the request of a foreign designated authority and for the
purposes of Article 13(3)(a) of the Convention,
furnish to that foreign designated authority such information on the law and
administrative practice in the field of data protection in Jersey as is the
subject of the request.[6]
(2) The
Authority shall, at the request of a foreign designated authority and for the
purposes of Article 13(3)(b) of the Convention, take,
in conformity with the law of Jersey and for the sole purpose of protection of
privacy, all appropriate measures for furnishing factual information relating
to specific automatic processing carried out in the territory of Jersey, with
the exception however of the personal data being processed.[7]
(3) A
function of the Authority is to request a foreign designated authority to
furnish the Authority with or, as the case may be, to take appropriate measures
for furnishing the Authority with, the information referred to in Article 13(3)
of the Convention.[8]
3 Persons
resident outside Jersey
(1) This
Regulation applies if a person resident outside Jersey makes a valid request to
the Authority under Article 14 of the Convention (whether directly or through a
foreign designated authority) seeking assistance in exercising any of the
rights under Article 8 of the Convention.[9]
(2) A
request is a valid request for the purposes of paragraph (1) if it
states –
(a) the name and address of the person making the request;
(b) particulars that identify the personal data to which the
request relates;
(c) the rights under Article 8 of the Convention to which the
request relates; and
(d) the reasons why the request has been made.
(3) If
the request –
(a) seeks assistance in exercising the rights under Article 28
of the Law; and
(b) does not indicate that the relevant data controller has
failed, contrary to that Article, to comply with the same request on a previous
occasion,
the Authority shall
notify the person who made the request of the data controller’s address
for the receipt of notices from data subjects exercising their rights under
that Article and of such other information as the Authority considers necessary
to enable that person to exercise his or her rights under that Article.[10]
(4) If
the request indicates that a data protection principle has been contravened by
a data controller the Authority shall –
(a) except
if sub-paragraph (b) applies, notify the person who made the request of the
rights of data subjects and the remedies available to them under Part 6 of the
Law together with such particulars as are contained in the data
controller’s entry in the register as are necessary to enable the person
to avail himself or herself of those remedies; or
(b) if the Authority considers that notification in accordance
with sub-paragraph (a) would not assist the requesting person or would, for any
other reason, be inappropriate, treat the request as if it were a request for
an assessment under Article 21 of the Authority Law.[11]
(5) The
Authority shall not be required, in response to a request that comes within
paragraph (3) or (4), to supply to the person who made the request a duly
certified copy in writing of the particulars contained in an entry made in the
register other than on payment of such fee as is specified for the purposes of
Article 17(3)(a) of the Authority Law.[12]
4 Persons
resident in Jersey
(1) If
a request for assistance in exercising, in a country or territory outside
Jersey, any of the rights referred to in Article 8 of the Convention is made by
a person resident in Jersey and submitted to the Authority under Article 14(2)
of the Convention, the Authority shall, if satisfied that the request contains
all necessary particulars referred to in Article 14(3) of the Convention, send
it to the foreign designated authority in the specified country or territory.[13]
(2) If
the Authority decides that he or she is not required to comply with
paragraph (1) in respect of a request he or she shall, if practicable,
notify the person who made the request of the reasons for the decision.[14]
5 Restrictions
on use of information
If the Authority receives information from a foreign designated
authority as a result of –
(a) a request by the Authority referred to in Regulation 2(3);
or
(b) a request received by the Authority under Regulation 2(2) or
3,
the Authority shall
not use the information except for the purposes specified in the request.[15]
6 Citation
These Regulations may be cited as the Data Protection (International
Co-operation) (Jersey) Regulations 2005.