Babbé Partner Nicholas Robison and Senior Associate Bryan de Verneuil-Smith look at how the GDPR and the UK’s Data Protection Bill will affect Guernsey
The GDPR is EU legislation that will become directly applicable in the entire EU on 25 May 2018. As the United Kingdom will still be a member of the EU on that date, the GDPR will apply in the UK from that date forward.
The Data Protection Bill, which deals with the GDPR and the Law Enforcement Directive (EU 2016/680), had its first reading in the House of Lords on 13 September. It had its second reading and debate in the House of Lords 10 October and was further debated in the House of Commons on 12 October.
The Bill will ensure that the GDPR and its standards will continue to apply in the UK after exiting the EU. The GDPR will also be incorporated into the UK’s domestic law under the European Union (Withdrawal) Bill.
The States of Guernsey is drafting new data protection legislation, which will replace the current Data Protection (Bailiwick of Guernsey) Law 2001 and will implement the GDPR. Its content will take into account the Bill, which reflects how the UK has aligned itself with the GDPR and the Law Enforcement Directive.
The content of this new Guernsey legislation could have a major impact on the way Guernsey organisations control or process EU personal data. The Bill gives Guernsey businesses a useful early indication of the lines upon which the Guernsey legislation may be drafted. The draft Guernsey legislation has not yet been published but a first draft is expected within the next three to four months.
In 2003, Guernsey’s existing data protection regime was given white list status by the EU, enabling organisations to transfer personal data freely between the EU and Guernsey without additional regulatory requirements. Steps to update Guernsey’s regime will need to be undertaken before the EU reassesses the adequacy of third countries’ data protection regimes, which will occur within four years of the implementation of the GDPR.
Guernsey businesses dealing with EU personal data should start implementing changes to their systems and procedures now in preparation for Guernsey’s implementation of the GDPR in 2018.