Data Protection
(International Co-operation) (Jersey) Regulations 2005
THE STATES, in pursuance of Articles 54 and
67 of the Data Protection (Jersey) Law 2005[1], have made the following
Regulations –
Commencement
[see endnotes]
1 Interpretation
(1) In
these Regulations –
“Convention” means the Convention for the Protection of
Individuals with regard to Automatic Processing of Personal Data, which was
opened for signature on 28th January 1981;
“foreign designated authority” means an authority
designated for the purposes of Article 13 of the Convention by a party bound by
the Convention, but does not include the Commissioner;
“Law” means the Data Protection (Jersey) Law 2005[2].
(2) The
functions of the Commissioner set out in these Regulations are functions to be
performed by the Commissioner as the designated authority in Jersey for the
purposes of Article 13 of the Convention.
2 Co-operation
between the Commissioner and foreign designated authorities
(1) The
Commissioner shall, at the request of a foreign designated authority and for
the purposes of Article 13(3)(a) of the Convention, furnish to that foreign
designated authority such information on the law and administrative practice in
the field of data protection in Jersey as is the subject of the request.
(2) The
Commissioner shall, at the request of a foreign designated authority and for
the purposes of Article 13(3)(b) of the Convention, take, in conformity with the
law of Jersey and for the sole purpose of protection of privacy, all
appropriate measures for furnishing factual information relating to specific
automatic processing carried out in the territory of Jersey, with the exception
however of the personal data being processed.
(3) A
function of the Commissioner is to request a foreign designated authority to
furnish the Commissioner with or, as the case may be, to take appropriate
measures for furnishing the Commissioner with, the information referred to in
Article 13(3) of the Convention.
3 Persons
resident outside Jersey
(1) This
Regulation applies if a person resident outside Jersey makes a valid request to
the Commissioner under Article 14 of the Convention (whether directly or through
a foreign designated authority) seeking assistance in exercising any of the
rights under Article 8 of the Convention.
(2) A
request is a valid request for the purposes of paragraph (1) if it
states –
(a) the
name and address of the person making the request;
(b) particulars
that identify the personal data to which the request relates;
(c) the
rights under Article 8 of the Convention to which the request relates; and
(d) the
reasons why the request has been made.
(3) If
the request –
(a) seeks
assistance in exercising the rights under Article 7 of the Law; and
(b) does
not indicate that the relevant data controller has failed, contrary to that
Article, to comply with the same request on a previous occasion,
the Commissioner shall notify the person who made the request of the
data controller’s address for the receipt of notices from data subjects
exercising their rights under that Article and of such other information as the
Commissioner considers necessary to enable that person to exercise his or her
rights under that Article.
(4) If
the request indicates that a data protection principle has been contravened by
a data controller the Commissioner shall –
(a) except
if sub-paragraph (b) applies, notify the person who made the request of the
rights of data subjects and the remedies available to them under Part 2 of the
Law together with such particulars as are contained in the data
controller’s entry in the register as are necessary to enable the person
to avail himself or herself of those remedies; or
(b) if
the Commissioner considers that notification in accordance with sub-paragraph
(a) would not assist the requesting person or would, for any other reason, be
inappropriate, treat the request as if it were a request for an assessment
under Article 42 of the Law.
(5) The
Commissioner shall not be required, in response to a request that comes within
paragraph (3) or (4), to supply to the person who made the request a duly
certified copy in writing of the particulars contained in an entry made in the
register other than on payment of such fee as is prescribed for the purposes of
Article 19(7) of the Law.
4 Persons
resident in Jersey
(1) If
a request for assistance in exercising, in a country or territory outside
Jersey, any of the rights referred to in Article 8 of the Convention is made by
a person resident in Jersey and submitted to the Commissioner under Article
14(2) of the Convention, the Commissioner shall, if satisfied that the request
contains all necessary particulars referred to in Article 14(3) of the
Convention, send it to the foreign designated authority in the specified
country or territory.
(2) If
the Commissioner decides that he or she is not required to comply with
paragraph (1) in respect of a request he or she shall, if practicable,
notify the person who made the request of the reasons for the decision.
5 Restrictions
on use of information
If the Commissioner receives information from a foreign designated
authority as a result of –
(a) a
request by the Commissioner referred to in Regulation 2(3); or
(b) a
request received by the Commissioner under Regulation 2(2) or 3,
the Commissioner shall not use the information except for the
purposes specified in the request.
6 Citation
These Regulations may be cited as the Data Protection (International
Co-operation) (Jersey) Regulations 2005.