Guernsey’s regime has also been moving at pace, with significant engagement programmes from the regulator (ODPA), regulatory sanctions and the establishment of a forum for practitioners (the Bailiwick of Guernsey Data Protection Association). Most recently, there has been an overhaul of the registration system and the introduction of the Levy Collection Agent (LCA) regime as part of the ODPA’s move towards a self-funding model.

Registration requirements and the LCA process have both been well-publicised, though with the run-up to Christmas 2020 and the current “lockdown”, businesses may be forgiven for some of these matters remaining on the “to do” list. We have been engaging with a wide range of businesses from different sectors to assist them in understanding their obligations, and foresee a continued number of instructions in the run-up to the deadline at the end of February 2021.

Whilst registration for Controllers and Processors has been a requirement for a number of years, the increasing profile and importance of data protection in today’s digital (global) marketplace has caused some to re-evaluate their approach to entities which they administer. Whilst the process itself is straightforward (registering via the portal takes a matter of minutes), the groundwork involved in assessing the status of a given structure/entity and its processing operations is often more complex. This is especially the case for overseas entities, administered and/or managed from Guernsey.

Oscar Wilde wrote that “What seems to us as bitter trials are often blessings in disguise.” This could be applied to any form of regulatory change which brings with it additional work. However, in this instance, there are real benefits, including a greater understanding of data protection obligations generally and the ability to build trust with clients through safeguarding of their data. The reputational and economic backlash that arises when things go wrong demonstrate that the “blessings” are not necessarily that well disguised.

On 1 October 2020, the Data Protection (General Provisions) (Bailiwick of Guernsey) (Amendment No. 2) Regulations, 2020 (the Amendment Regulations) came into force, amending Part 1 of the Data Protection (General Provisions) (Bailiwick of Guernsey) Regulations, 2018 (the Principal Regulations).

The Amendment Regulations ultimately seek to regulate a new registration and levy regime which is in place from 2021. This regime firstly requires all controllers and processors established in the Bailiwick who process personal data (and who are not exempt in accordance with the Amendment Regulations) to complete an annual return during January-February of each year (as opposed to at any point during the year) and pay an annual levy. Secondly, it enables controllers and processors to either pay the annual levy to the ODPA directly, or through a LCA.

Each controller/processor is also required to file a return for 2021 (in effect re-registering if already registered). This is a one-off requirement to establish a picture of the regulated market and ensure that data on the market is current.

Established in Bailiwick

The key question is whether you are “established in the Bailiwick” – for most businesses this is easy – Guernsey entities and structures carrying on business here will fall within the definition. The more complex issues arise for overseas entities (such as funds) managed and/or administered from Guernsey. It is important to consider this question in detail, as assessing whether an entity falls within scope is rarely straightforward.

Registration from January 2021 and Registration fee

The previous exemptions from registration expired in December 2020; the Amendment Regulations now require that you register with the Authority in January/February 2021 and pay a registration fee. The registration fee will be £2,000 if you have 50 or more “full-time equivalent” employees and £50 otherwise (including if you are a non-profit organisation or are required to designate a data protection officer under the Law, for example).

Failure to register with the ODPA is an offence and may lead to criminal or civil sanctions, including a possible penalty of up to £5,000,000, though a penalty at that level is unlikely in the current climate.

LCA’s and the levy regime

LCAs have been introduced to make the payment of levies for administered entities in particular easier to handle. LCAs may register with or pay the annual levy to the ODPA on behalf of a number of organisations.

Your organisation can operate as a LCA if it is licensed or certified by the GFSC, for example. Before operating as a LCA, the LCA must first register as a controller/processor and declare their intention to act as LCA. LCAs cannot act for an organisation with 50 or more “full-time equivalent” employees, those required to designate a Data Protection Officer under the Law, another LCA or charities/not-for-profit organisations. Once the LCA has registered its “client” entities and paid the levy/registration fees, the LCA will then issue each of the “client” entities with Certificates of Exemption, which must be presented to the ODPA upon request as evidence of compliance.

Exemptions

Unless your organisation is exempt from the Amendment Regulations, your organisation will be required to register and pay an annual levy to the ODPA. There are intentionally very limited grounds to claim exemption. Not-for-profits and charities are still required to register, for example, but will not pay fees. Most, if not all, trading businesses with individuals as clients, customers or employees, will be covered by the regime.

Failure to pay the annual levy is also an offence under the law and may attract sanctions including a financial penalty.

The way forward

All organisations should be aware of the new regime and where it sits in the wider data governance and regulatory framework for the Bailiwick. A helpful Q&A has been produced by the ODPA and can be accessed here.

For many, the new regime will be straightforward and their assessments of their processing activities similarly clear. However for others, particularly those administering overseas structures, the questions are significantly more complex as to whether those structures fall within the regime. Careful analysis of the position is required, so do let us know if we can assist with turning your “bitter trials” into “blessings”.

Key Contacts

Richard Field

Partner: Guernsey

T +44 (0)1481 755 610
E Email Richard

Richard Sheldon

Managing Group Partner*: Guernsey, Jersey

T +44 (0)1481 755 904
E Email Richard

Share
Twitter LinkedIn Email Save as PDF
More Publications
26 Jan 2024

Fund Finance Laws and Regulations 2024 – Guernsey

Guernsey is a leading funds domicile with a proven track record of more than 50 years as an internat...

10 Jan 2024

The Global – your offshore corporate law questions answered

The Global is Appleby’s quarterly collection of expert insights and analysis on the latest develop...

22 Sep 2023

Discrimination law in Guernsey: The Same but Different

The Prevention of Discrimination (Guernsey) Ordinance 2022 (“Ordinance”) will come into force on...

22 Sep 2023

Financial platforms and intermediation

The Lending, Credit and Finance (Bailiwick of Guernsey) Law 2022, (LCF Law) came into effect 1 July ...

19 Sep 2023

Regulation of Financial Firm Business

The Lending, Credit and Finance (Bailiwick of Guernsey) Law 2022, (LCF Law) came into effect 1 July ...

15 Sep 2023

Carer Status: Guernsey boldly goes where the UK and no other Crown Dependency has gone before

When the Prevention of Discrimination (Guernsey) Ordinance 2022 (“Ordinance”) comes into force o...

3 Jul 2023

Regulation of Financial Firm Business and Virtual Asset Service Providers

The Lending, Credit and Finance (Bailiwick of Guernsey) Law 2022, (LCF Law) came into effect on 1 Ju...

20 Apr 2023

The Guernsey Regulators FAQs on Part II Licences under the LCF Law

The new Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 (LCF Law)  will come into ful...

6 Apr 2023

Consumer Credit and the Provision of Services Ancillary to Credit under the new LCF regime

The new Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 (LCF Law)  will come into ful...

30 Mar 2023

ESG Series Part II: ’Social’ and ‘Governance’ – dynamic issues requiring adept thinking

In the second of a four-part series on ‘ESG’, Advocate and Partner Anthony Williams and Senior A...