Data Protection
(Subject Access Miscellaneous) (Jersey) Regulations 2005
THE STATES, in pursuance of Articles 7(4),
(5) and (11), 8(1) and 67 of the Data Protection (Jersey) Law 2005[1], have made the following
Regulations –
Commencement
[see endnotes]
1 Interpretation
In these Regulations “Law” means
the Data Protection (Jersey) Law 2005[2].
2 Extent
of subject access requests
(1) A
request for information under any provision of Article 7(1) and (2) of the Law
is to be treated as extending to information under the other provisions of those
paragraphs.
(2) A
request for information under any provision of those paragraphs is to be
treated as extending to information under the provisions of Article 7(3) of the
Law if the request shows an express intention to that effect.
(3) A
request for information under the provisions of Article 7(3) of the Law is to
be treated as extending also to information under any provision of Article 7(1)
and (2) if the request shows an express intention to that effect.
3 Maximum
subject access fee
For the purposes of Article 7(4)(b) of the Law, the prescribed
maximum fee is £10, except as otherwise provided by Regulation 4, 5, 6 or
7.
4 Requests
for subject access if data controller is credit reference agency
(1) In
any case in which a request under Article 7 of the Law has been made to a data
controller who is a credit reference agency, and has been limited, or by virtue
of Article 9(2) of the Law is taken to have been limited, to personal data
relevant to an individual’s financial standing –
(a) for
the purposes of Article 7(4)(b) of the Law, the prescribed maximum fee in
respect of the request is £2; and
(b) for
the purposes of Article 7(11) of the Law the prescribed period is 7 working
days.
(2) In
this Regulation, “working day” means a day other than Christmas Day
or Good Friday, and other than a Saturday, Sunday, bank holiday or public
holiday.
5 Requests
for subject access if data held on Police National Computer
In any case in which a request under Article 7 of the Law has been
made to the Chief Officer of the States of Jersey Police Force as data
controller in respect of personal data that are held on the Police National
Computer the prescribed maximum fee in respect of the request is £20.
6 Requests
for subject access if data held by school
In any case in which a request under Article 7 of the Law has been
made to a school as data controller in respect of personal data that are held by
the school the prescribed maximum fee in respect of the request is £30.
7 Certain
subject access requests in respect of health records – transitional
provisions
(1) This
Regulation applies only in the case of a request made under Article 7 of
the Law that –
(a) relates
wholly or partly to personal data forming part of a health record;
(b) does
not relate exclusively to data within paragraphs (a) and (b) of the definition
of data in Article 1(1) of the Law; and
(c) is
made before the end of the first transitional period.
(2) If
the obligation imposed by Article 7(2)(a) of the Law is to be complied with by
supplying the data subject with a copy of some or all of the information in
permanent form, for the purposes of Article 7(4)(b) of the Law the prescribed
maximum fee in respect of the relevant request is £50.
(3) In
any other case to which this Regulation applies, a data controller shall not
require a fee if the relevant request relates solely to personal data that –
(a) are
a health record some of which was made after the beginning of the period of 40 days
immediately preceding the date of the request; and
(b) do
not fall within paragraph (a) or (b) of the definition of data in Article 1(1)
of the Law.
(4) In
the case of a request in any case to which this Regulation applies, an
individual making the request may specify that it is limited to personal data
of the description set out in paragraph (3).
8 Citation
These Regulations may be cited as the Data Protection (Subject
Access Miscellaneous) (Jersey) Regulations 2005.