The Data Protection (Jersey) Law 2005 seeks to strike a balance between the rights of individuals and the sometimes competing interests of those with legitimate reasons for using personal information.

The DPL gives individuals certain rights regarding information held about them. It places obligations on those who process information (data controllers) while giving rights to those who are the subject of that data (data subjects). Personal information covers both facts and opinions about the individual.

Anyone processing personal information must notify the Data Protection Commissioner’s Office that they are doing so, unless their processing is exempt. Notification costs £50 per year.

Anyone processing personal information must comply with eight enforceable principles of good information handling practice.

These say that data must be:

1. fairly and lawfully processed

2. processed for limited purposes

3. adequate, relevant and not excessive

4. accurate and up to date

5. not kept longer than necessary

6. processed in accordance with the individual’s rights

7. secure

8. not transferred to countries outside European Economic area unless country has adequate protection for the individual

At least one of the following conditions must be met for personal information to be considered fairly processed:

1. the individual has consented to the processing

2. processing is necessary for the performance of a contract with the individual

3. processing is required under a legal obligation (other than one imposed by the contract)

4. processing is necessary to protect the vital interests of the individual

5. processing is necessary to carry out public functions, e.g. administration of justice

6. processing is necessary in order to pursue the legitimate interests of the data controller or third parties (unless it could unjustifiably prejudice the interests of the individual)

A number of criminal offences are created by the DPL and include:

This is where processing is being undertaken by a data controller who has not notified the Commissioner either of the processing being undertaken or of any changes that have been made to that processing.

It is an offence to knowingly or recklessly obtain, disclose or procure the disclosure of personal information without the consent of the data controller. There are some exceptions to this – for example, where such obtaining or disclosure was necessary for crime prevention/detection. If a person has obtained personal information illegally it is an offence to offer or to sell personal information.

Unsolicited marketing calls should not be made to individual subscribers who have opted out either directly or by registering with the central stop-list, the Telephone Preference Service (TPS), or to corporate subscribers (e.g. companies) who have objected either directly or by registering on the Corporate TPS.

Unsolicited marketing faxes should not be sent to individuals without their prior consent or to any subscriber who has objected, either directly or by registering on the Fax Preference Service (FPS).

Unsolicited marketing emails or SMS should not be sent to any individual subscriber who has not consented unless the email address or phone number was collected in the context of a commercial relationship.

The Data Protection Commissioner has specific responsibilities for the promotion and enforcement of the DPL.

Under the Data protection Law