Ignoring data protection may cause Jersey to 'lose our economy'

Jersey's Information Commissioner is warning businesses and organisations that are not taking data protection seriously that the 'time for excuses is long gone'.

In an update to industry this week, Paul Vane said his office will take prompt enforcement action for data protection breaches because enough time has passed for organisations to get to grips with the data protection law.

The updated legislation has been in place for eight years, during which time the JOIC has been helping the island adjust to new expectations.

Despite this, a survey conducted late last year suggests many organisations are still neglecting to keep information safe or detail how they are doing so.

Mr Vane says privacy is a fundamental human right.

"This is about the processes, policies and procedures that sit within the organisation that set the controls of what they can and can't do with information.

"For example, their privacy policies - which should be displayed on their websites - make customers aware of what sort of data they have about them and what they do with it."

In other cases where sensitive types of information are being handled, there will be a data protection impact assessment in most cases to minimise risks of breaches.

The commissioner says that this just is not happening as frequently as it should be in Jersey, and when there is a high risk, the office should be consulted, and again business and organisations are not taking these additional steps.

Paul Vane says that data protection is not being taken seriously.

"One of the statistics that came out of our survey 40% of organisations responded saying that they didn't have time to undertake any data protection training.

"It means there's a large number of organisations out there that are not getting the level of training and awareness that they should be to be able to deal with data handling issues appropriately."

When it comes to enforcement options, the office holds a wide range of powers.

This ranges from entry into premises to assess policies and procedures to see how data is being handled, to offering guidance and support to employees, through to reprimand and order, all the way at the other end of the scale, which includes issuing fines.

Jersey's Information Commissioner says, despite compliance not being exactly where he would like it to be, there are benefits to the size of Jersey as a jurisdiction.

When data protection issues are discovered, it is 'very easy' to get the relevant people around the table quickly to solve the problem.

Another benefit is that Jersey usually does not see the same level of breaches often reported in the national media.

"The big entities like the Metas, TikToks, Microsofts, or big corporates aren't located in Jersey.

"That's not to say that on a more microlevel they're not happening because they are, and we deal with those appropriately, but it's a different environment here compared to the UK and other jurisdictions."

If organisations continue not to take data protection seriously, it could put our status of 'adequacy' from the European Commission - which allows the secure flow of personal data between Jersey and EEA countries, at risk.

Paul Vane says if it were withdrawn, it would be devastating.

"A lot of organisations here rely on data flows and trade corridors to do business. There's not much you can do directly in Jersey, especially if you're multinational or a large corporation, without having to transfer data overseas."

The adequacy assessments show that Jersey's data protection regime is up to scratch.

However, the EC's monitoring of it is ongoing, and if there are concerns and the status is withdrawn, it could mean organisations may struggle to transfer data to other countries.

"It's a position we never want to be in."

Setting out the JOIC's three year roadmap, Mr Vane said there will be a focus on children's privacy.

Not only will the office educate young islanders on how to keep themselves safe online, but there will be a focus on the technologies being used in schools.

There will be a responsibility placed on schools to research the platforms they use and the providers, and to make sure that the correct processes and controls are in place to protect pupils' information and that it is compliant with the law.

"You have no idea what your child is exposed to online, you have no idea what tools there might be available to protect them and navigate an online world safely.

"One of the things that we want to do is involve children in the conversation and find out what protections they feel they need."