Data Protection – Frequently asked questions

Data protections has been in Jersey since 1987, however it was in 1995 that the landscape properly changed and the first set of legislation was introduced.

The landscape of our lives has changed dramatically over the past 30 years such that technology and data is much more sophisticated and prolific. Social media and the many devices that people use on a daily basis are leaving a digital footprint about our lives. The volume and type of data this is now being created needs to be much better regulated so that the people who use, collect and access this data use it properly and for the right reasons ensuring that you as a citizen are better protected.

Any business that collect, handles and stores personal information must register with the information commissioner regardless of its size, however, if you are a freelancer, very small business or charity you’ll pay a different fee from larger organisations, and in some cases, no fee at all.

It is more important to think about the type of information that you are holding rather than how big you are as an organisation. Consider how sensitive the data is, what you do with it and what you need to do to keep it secure. Adopt a sensible approach to making sure that you are handling the data properly and sometimes it’s the simple things, such as putting password protection on individual documents that work best.

Your business, as a data controller, is responsible for the personal data it holds so all your employees need to understand what the business expects of them in terms of using and sharing data, however, as the owner of the business you are ultimately responsible. Employee training is a vital part of making sure all your staff know what their obligations are & don’t share information unwisely. Historically staff are the biggest risk area when it comes to data breaches so this is worth spending time on and perhaps having written policies in a staff handbook.

When you are selling your product you need to be transparent with your customer and set out at the beginning that you’re sharing their data with the company that is providing the warranty. But, as with every other supplier, you do need to make sure that you’re happy that the company giving the warranty is handling the data properly. Part of your due diligence is to make sure that your suppliers are compliant – if they are based in the EU then they too will be subject to this legislation.

If a client asks you to perform a task for them that requires you to share some of their information with a 3rd party, for example if you are getting quotes on behalf of your client, ideally you’ll get this request in writing but if it’s a verbal request then just keep a note that they have asked you to do this.

No, you have the same obligations for paper or digital information. Remember it’s about transparency and being sensible so think about how you can prove that you are holding the data securely and doing the right thing with it. Also think about the obligations you have to an industry or other regulatory body that might set parameters on what information you need to keep about your business activities.

One of the obligations of the legislation is that you must hold personal data securely so you need to have software, physical security and policies in place to do this. Each business will have a different solution depending on the type of data that you hold and the infrastructure that you have in your business. Remember that you need to be able to evidence what you have done to protect your data that includes all the places where you hold data including your computer. There is more help on keeping your systems secure on these pages.

You need to be satisfied that any online provider you use is compliant with the data protection legislation so ask them about their security policies and make sure that you are comfortable that they are adequate. Many of these platforms will have a security policy statement that you can access through your subscription, but if you can’t find this then send them an email request. One of the things to confirm is the physical location of the server that the data is sitting on as this will influence the regulations under which you data is held and be aware that US companies do not work under GDPR although they have a voluntary scheme called the US Privacy Shield which is compliant with EU legislation. If you are not happy with the policies that your provider has in place then look for another!

The regulator won’t mandate the systems or security that you use to keep your data secure but your customers or suppliers might do so.

If you are sharing personal information with your suppliers then you need to be satisfied that they are also compliant with data protection legislation so see what agreement you already have in place. If you don’t think these are adequate than revise them are introduce new ones if there is nothing in place.

If you want to keep data about clients so you can tell them about other services then you need to ask them if that’s ok. If they are happy to keep hearing from you then you can keep them on a mailing list.

The view in Jersey is that reconsenting is not necessary if people consented to being on your database when they originally signed up. However, one thing you will need to do is to make sure that your evidence of consent is compliant and that you update the information you hold about people so a recommendation is to do an annual review of your mailing lists to make sure that the people on your database are still happy to receive your mailing and that the information you have is accurate.

Firstly, establish that you obtained the information you have on the list lawfully, that is, from the individuals themselves, so if you have data about them collected by other means, buying a mailing list for example, you will need to go back to them and check they are happy for you to continue holding/using their data. Then you need to check they have all consented to being on your mailing list. How have they interacted with you? What are their expectations on how you use their data?