Data Protection (Notification) (Jersey) Regulations 2005

Revised Edition

15.240.30

Showing the law as at 1 January 2006

This is a revised edition of the law



Data Protection (Notification) (Jersey) Regulations 2005

Arrangement

Regulation

1             Interpretation. 5

2             Processing without need for registration: Article 17(5) 5

3             Form for notifying particulars and changes to them: Articles 18(3) and 20(3) 5

4             Notification by partnership: Article 18(4)(a) 6

5             Notification by school: Article 18(4)(b) 6

6             Fee to accompany notification under Article 18(6) 6

7             Date of entry in the register: Article 19(3) 6

8             Confirmation of register entries. 7

9             Additional information in register entries: Article 19(2)(b) 7

10           Duty to notify changes to matters previously notified: Article 20. 7

11           Duty to notify changes - persons registered under old Law: paragraph 2(8) of Schedule 12  8

12           Annual fee for retention of register entries: Article 19(4) 9

13           Retention of register entries - transitional provisions: paragraph 2(9) of Schedule 12  9

14           Citation. 9

PROCESSING TO WHICH ARTICLE 17(1) DOES NOT APPLY   10

1             Interpretation. 10

2             Staff administration. 10

3             Accounts and records. 11

4             Non profit-making organizations. 11

5             Company registers and certificates. 12

 

Supporting Documents

Table of Legislation History. 13

Table of Renumbered Provisions. 13

Table of Endnote References. 13

 


Data Protection (Notification) (Jersey) Regulations 2005

THE STATES, in pursuance of Articles 17(5), 18, 19, 20, 22 and 67, and Schedule 12, of the Data Protection (Jersey) Law 2005[1], have made the following Regulations –

Commencement [see endnotes]

1        Interpretation

In these Regulations, “Law” means the Data Protection (Jersey) Law 2005[2].

2        Processing without need for registration: Article 17(5)

The following descriptions of processing are prescribed as processing to which Article 17(1) of the Law shall not apply –

(a)     a class of processing (other than processing (if any) prescribed as assessable processing under Article 22 of the Law) specified in any of paragraphs 2 – 5 of the Schedule;

(b)     processing that falls within none of those classes only because the processing takes the form of disclosure that is contrary to paragraph 2(d), 3(d) or 4(e) of the Schedule and the disclosure –

(i)      is required by or under an enactment, by any law or by an order of a court, or

(ii)      may be made by virtue of an exemption from the non-disclosure provisions.

3        Form for notifying particulars and changes to them: Articles 18(3) and 20(3)

(1)     The Commissioner shall determine the form in which the registrable particulars referred to in Article 16(1)(c) – (f) of the Law and the description referred to in Article 18(2)(b) of the Law are to be specified by a data controller who gives notification under Article 18 of the Law.

(2)     The Commissioner shall determine the form in which a notification under Regulation 10 or 11 is to be given.

4        Notification by partnership: Article 18(4)(a)

(1)     In any case in which 2 or more persons carrying on a business in partnership are the data controllers in respect of any personal data for the purposes of that business, a notification under Article 18 of the Law or under Regulation 10 may be given in respect of those persons in the name of the partnership.

(2)     If a notification is given in the name of a partnership –

(a)     the name to be specified for the purposes of Article 16(1)(a) of the Law is the name of the partnership; and

(b)     the address to be specified for the purposes of Article 16(1)(a) of the Law is the address of the partnership’s principal place of business.

5        Notification by school: Article 18(4)(b)

(1)     If the proprietor, governor, governing body, director or manager of, and principal or head teacher at, a school (or any 2 or more of those persons) are, in those capacities, the data controllers in respect of any personal data, a notification under Article 18 of the Law or under Regulation 10 may be given in respect of those data controllers in the name of the school.

(2)     If a notification is given in the name of a school, the name and address to be specified for the purposes of Article 16(1)(a) of the Law are those of the school.

6        Fee to accompany notification under Article 18(6)

(1)     The prescribed fee to accompany a notification by a data controller (including a notification given in the name of a partnership in accordance with Regulation 4 or of a school in accordance with Regulation 5) is £50.

(2)     A fee that accompanies a notification shall be refunded if paid in mistake or (as the case requires) in the proportion in which it has been paid in mistake.

7        Date of entry in the register: Article 19(3)

An entry in respect of a data controller, being an entry based on a notification made in accordance with Article 18 of the Law and with these Regulations, shall be treated for the purposes of Article 17 of the Law as having been included in the register at the following time –

(a)     in the case of a notification given by sending it properly addressed by certified post or the recorded delivery service, the day after the day on which the notification is accepted for dispatch by the post office; or

(b)     in the case of a notification given by some other means, the day on which the notification is received by the Commissioner.

8        Confirmation of register entries

(1)     The Commissioner shall, as soon as practicable and in any event within 28 days after making an entry in the register under Article 19(1)(b) of the Law or amending an entry in the register under Article 20(4) of the Law, give the data controller to whom the register entry relates notice confirming the register entry.

(2)     The notice shall include a statement of –

(a)     the date on which the entry was included in the register or amended;

(b)     the particulars included in the register, or the amendment made, in pursuance of the notification; and

(c)     in the case of an entry made under Article 19(1)(b) of the Law, the date by which the fee payable under Article 19(4) of the Law shall be paid.

9        Additional information in register entries: Article 19(2)(b)

The Commissioner is authorized to include the following information in an entry in the register –

(a)     a registration number issued by the Commissioner in respect of that entry;

(b)     in the case of a notification under Article 18 of the Law, the date on which the entry is treated, by virtue of Regulation 7, as having been included in the register;

(c)     the date falling after the day of the deadline for the payment under Article 19(4) of the Law of a retention fee for the entry; and

(d)     information that may assist persons consulting the register to communicate with any data controller to whom the entry relates concerning matters relating to the processing of personal data.

10      Duty to notify changes to matters previously notified: Article 20

(1)     This Regulation applies if the registrable particulars in relation to a data controller and the general description of measures taken by the data controller for the purpose of complying with the seventh data protection principle, as those particulars and measures were notified to the Commissioner and were the subject of further notifications (if any) under this Regulation, no longer reflect the current particulars and measures for the data controller.

(2)     The data controller shall notify the Commissioner of the changes that would allow the notified particulars and measures to reflect what is current as soon as practicable and in any event within a period of 28 days from the date when those particulars and measures no longer reflect what is current.

11      Duty to notify changes - persons registered under old Law: paragraph 2(8) of Schedule 12

(1)     In the case of a person in respect of whom an entry in the register has been made under paragraph 2(6) of Schedule 12 to the Law and is still in force, the duty referred to in Article 20(1) of the Law shall be modified so that Regulation 10 shall not apply, but paragraphs (2) – (4) shall apply instead.

(2)     A person in respect of whom an entry is for the time being included in the register is under a duty to give the Commissioner a notification specifying the following –

(a)     the person’s current name and address, if the name and address in the entry in the register in respect of the person are not the current name and address;

(b)     to the extent to which the entry relates to eligible data –

(i)      a description of any eligible data being or to be processed by the person or on the person’s behalf, if the processing is or is to be of personal data of a description not included in that entry,

(ii)      a description of the categories of data subject to which the eligible data relate or are to relate, if the categories are or are to be of a description not included in that entry,

(iii)     a description of the purposes for which eligible data are being or are to be processed, if the processing is or is to be for purposes of a description not included in that entry,

(iv)     a description of the sources from which the person intends to obtain eligible data, if the obtaining would be from sources of a description not included in that entry,

(v)     a description of any recipients to whom the person intends to disclose eligible data, if the disclosure would be to recipients of a description not included in that entry, or

(vi)     the names, or a description, of any countries or territories outside Jersey to which the person transfers, or intends to transfer, eligible data directly or indirectly, if the transfer is or would be to countries or territories not named or described in that entry; or

(c)     to the extent to which the entry relates to other personal data, any respect in which the entry is inaccurate or incomplete as –

(i)      a statement of the person’s current registrable particulars referred to in Article 16(1)(c), (d) and (e) of the Law;

(ii)      a description of the sources from which the person intends to obtain personal data; or

(iii)     a statement of the names, or a description, of any countries or territories outside Jersey to which the person intends to transfer personal data directly or indirectly,

and the changes that need to be made to that entry in order to make it accurate and complete in that respect.

(3)     The person shall give the notification as soon as practicable and in any event within a period of 28 days from the date on which –

(a)     in the case of a notification under paragraph (2)(a), the name or address has changed;

(b)     in the case of a notification under paragraph (2)(b), the description of the practice (actual, future or intended), or intentions, specified in the entry does not accord with that practice or those intentions; or

(c)     in the case of a notification under paragraph (2)(c), the entry is inaccurate or incomplete in the particulars mentioned there.

(4)     In this Regulation, “eligible data” has the same meaning as in Schedule 8 to the Law.

12      Annual fee for retention of register entries: Article 19(4)

The prescribed fee for retention of an entry in the register in respect of a data controller is £50.

13      Retention of register entries - transitional provisions: paragraph 2(9) of Schedule 12

(1)     In the case of a person in respect of whom an entry in the register has been made under paragraph 2(6) of Schedule 12 to the Law and is still in force, Article 19(4) and (5) of the Law apply to the entry subject to the modifications in paragraph (2).

(2)     Article 19(4) and (5) of the Law shall be modified to read as follows –

“(4)    No entry shall be retained in the register after the first of the following –

(a)     the end of the registration period,

(b)     the end of the first transitional period, or

(c)     the date on which the data controller gives a notification under Article 18 of the Law.

(5)     In paragraph (4), “the registration period” has the same meaning as in paragraph 2(2) of Schedule 12.”.

14      Citation

These Regulations may be cited as the Data Protection (Notification) (Jersey) Regulations 2005.

 


SCHEDULE

(Regulation 2(a))

PROCESSING TO WHICH ARTICLE 17(1) DOES NOT APPLY

1        Interpretation

In this Schedule, “staff” includes persons employed within the meaning of the Employment (Jersey) Law 2003[3] and volunteers.

2        Staff administration

Processing that –

(a)     is for any one or more of the purposes, in relation to the staff of the data controller, of appointment, removal, pay, discipline, superannuation, work management and any other personnel matter;

(b)     is of personal data in respect of which the data subject is –

(i)      a past, existing or prospective member of staff of the data controller, or

(ii)      any person the processing of whose personal data is necessary for any of the purposes referred to in sub-paragraph (a);

(c)     is of personal data consisting of any one or more of the following in respect of the data subject –

(i)      name,

(ii)      address,

(iii)     other identifiers,

(iv)     information as to qualifications,

(v)     information as to work experience,

(vi)     information as to pay,

(vii)    information as to any other matter the processing of which is necessary for any of the purposes referred to in sub-paragraph (a);

(d)     does not involve disclosure of the personal data to a third party otherwise than –

(i)      with the consent of the data subject, or

(ii)      in a case where it is necessary to make such disclosure for any of those purposes; and

(e)     does not involve keeping the personal data after the relationship between the data controller and the data subject ends, except for so long as it is necessary to do so for any of those purposes.

3        Accounts and records

Processing that –

(a)     is for any one or more of the following purposes so far as they relate to the conduct of any business or activity carried on by the data controller –

(i)      keeping accounts,

(ii)      deciding whether to accept any person as a customer or supplier,

(iii)     keeping records of purchases, sales or other transactions in order to ensure that the requisite payments or deliveries are made or services provided by or to the data controller in respect of those purchases, sales or other transactions,

(iv)     making financial or management forecasts;

(b)     is of personal data in respect of which the data subject is –

(i)      a past, existing or prospective customer, or supplier, of the data controller, or

(ii)      a person the processing of whose personal data is necessary for any of the purposes referred to in sub-paragraph (a);

(c)     is of personal data (other than personal data processed by or obtained from a credit reference agency) consisting of any one or more of the following in respect of the data subject –

(i)      name,

(ii)      address,

(iii)     other identifiers,

(iv)     information as to financial standing;

(v)     information as to any other matter the processing of which is necessary for any of the purposes referred to in sub-paragraph (a);

(d)     does not involve disclosure of the personal data to a third party otherwise than –

(i)      with the consent of the data subject, or

(ii)      in a case where it is necessary to make the disclosure for any of those purposes; and

(e)     does not involve keeping the personal data after the relationship between the data controller and the data subject ends, except for so long as it is necessary to do so for any of those purposes.

4        Non profit-making organizations

Processing that –

(a)     is carried out by a data controller that is a body or association that is not established or conducted for profit;

(b)     is for any one or more of the purposes of establishing or maintaining membership of or support for the body or association or providing or administering activities for individuals who are either members of the body or association or have regular contact with it;

(c)     is of personal data in respect of which the data subject is –

(i)      a past, existing or prospective member of the body or association,

(ii)      a person who has regular contact with the body or association in connection with any of the purposes referred to in sub-paragraph (b), or

(iii)     a person the processing of whose personal data is necessary for any of those purposes;

(d)     is of personal data consisting of any one or more of the following in respect of the data subject –

(i)      name,

(ii)      address,

(iii)     other identifiers,

(iv)     information as to eligibility for membership of the body or association,

(v)     information as to any other matter the processing of which is necessary for any of the purposes referred to in sub-paragraph (b);

(e)     does not involve disclosure of the personal data to a third party other than –

(i)      with the consent of the data subject, or

(ii)      in a case where it is necessary to make the disclosure for any of those purposes; and

(f)      does not involve keeping the personal data after the relationship between the data controller and data subject ends, except for so long as it is necessary to do so for any of those purposes.

5        Company registers and certificates

Processing that is for the purposes of keeping a register required by Part 9 of the Companies (Jersey) Law 1991 or for doing anything else required or permitted under that Part.

 


Endnotes

Table of Legislation History

Legislation

Year and No

Commencement

Data Protection (Notification) (Jersey) Regulations 2005

R&O.139/2005

1 December 2005

Table of Renumbered Provisions

Original

Current

None

 

Table of Endnote References



[1]                                    chapter 15.240

[2]                                    chapter 15.240

[3]                                    chapter 05.255


Page Last Updated: 03 Apr 2018