En Voyage_Issue#11_Flickbook

Data protection laws already
exist to protect our personal
data in basic ways but they are
outdated and have not kept up
with society’s reliance upon email,
social media, mobile apps and the
internet. The purpose of the EU’s
European General Data Protection
Regulation 2016/679 (“GDPR”) is to
modernise personal data laws to
give individuals more protection
and control over their personal
data and to raise the standard of
data protection laws. Similarly, the
EU’s Law Enforcement Directive
(EU 2016/680) (“LED”) protects
citizens’ rights to data protection
when their data is processed by
law enforcement authorities.
It is crucial for the international
finance industry in Guernsey, a
non-EU jurisdiction, to be able to
collect information from clients
and share it with affiliates and
service providers across the UK
and the European Union without
delay or regulatory barriers.
For that reason, Guernsey
has been one of only 11 non-
EU jurisdictions (called “third
countries”) whose data protection
regimes have benefited from
an adequacy decision of the EU
Commission. This means that
the EU has judged Guernsey to
have equivalent data protection
standards to those in the EU,
thereby allowing data to flow
between the Bailiwick and Europe.
Therefore it came as no surprise
that in April 2017 the States of
Guernsey announced that it
was committed to introducing
legislation that implements the
GDPR and LED. On 29 November
2017 the States approved the
draft Data Protection (Bailiwick of
Guernsey) Law 2017 (the “DPL”)
to implement the GDPR and
LED. The DPL now requires Royal
Assent. It is expected to come into
force on or around 25 May 2018,
at the same time that the GDPR
comes into effect across the EU.
WHAT ARE SOME OF THE
MOST IMPORTANT CHANGES
IN THE NEW LAW?
Strengthens the rights
of data subjects
The DPL confers a raft of new
rights on the people to whom
the personal data relates (data
subjects), such as the right to be
forgotten and the right to data
portability (i.e., being able to
switch service providers, such
as mobile phone companies,
without losing data). New civil
actions can be brought by data
subjects for breach of statutory
duties against data controllers
(those who decide how and
why data is processed) and data
processors (those who process the
personal data) when the breach
causes damage. “Damage” is
defined widely to include financial
loss, distress, inconvenience
and other adverse effects.
Heavier duties on data controllers
and new duties on data processors
The DPL will impose much
wider duties on data controllers
and creates new duties for
data processors. For example,
data controllers will need to
have written agreements with
all of their data processors
and sufficient guarantees from
processors that they will meet
the DPL’s requirements; while
data processors will be required
by law to delete or return all data
after finishing their services.
A more independent and
more powerful regulator
Once the DPL is in force,
the Guernsey Data Protection
Commissioner will be called the
Data Protection Authority and will
be given far more independence
and power than the Commissioner
presently enjoys. Data processors,
as well as data controllers, will
need to register with the Authority
and pay a fee. The Authority’s
greater powers will include the
ability to give tougher penalties
for breach of data protection
law, reaching up to as much as
10% of global annual turnover
with a limit of £10 million.
Guernsey businesses need
to prepare now for the DPL
coming into force in May 2018.
Babbé LLP can assist with your
business’ preparations, no
matter how large or small.
90 En Voyage | Aurigny’s Magazine