Data protection – changes to ODPA registration requirements

Data controllers and processors established in the Bailiwick of Guernsey are required to register with the ODPA and pay an annual levy from January 2021, either directly or via a levy collection agent where available.

A recent amendment to Guernsey's data protection regime, effective from 1 January 2021, will change the registration requirements for handlers of personal data in the Bailiwick and introduces a new levy collection scheme for entities administered by a licensed corporate services provider.

Introduction

A recent amendment to Guernsey's data protection regime, effective from 1 January 2021, will change the registration requirements for handlers of personal data in the Bailiwick.

The new data protection regulations (the Regulations) introduce:

• a requirement for data controllers/processors to pay an annual fee and submit annual returns from January 2021; and

• a new levy collection scheme which allows certain entities to appoint a levy collection agent (LCA) to deal with their registration requirements as an alternative to submitting these directly with the Office of the Data Protection Authority (the ODPA).

The levy collection scheme may prove useful for entities who have to date relied on one of the exemptions from the requirement to register and which are administered by a Guernsey licensed corporate service provider (CSP).

Registration and filing requirements

Under the Data Protection (Bailiwick of Guernsey) Law, 2017, (the Data Protection Law) all entities established in the Bailiwick who act as either a data controller or data processor are required to register with the ODPA unless they are otherwise exempt.

The current exemptions expire on 31 December 2020 and, after that time, all data controllers/processors established in the Bailiwick will need to register with the ODPA. Organisations can register either directly with the ODPA or via the new levy collection scheme where available.

From 1 January 2021, registered data controllers and processors established in the Bailiwick (or their LCA on their behalf) will also be required to provide an annual return to the ODPA each year and, with the exception of non-profit organisations and public entities, pay an annual fee:

• £2,000 a year for those with 50 or more full time equivalent staff; or

• £50 a year for all other entities.

The ODPA has confirmed that Guernsey entities will be presented with a link to the ODPA's online registration process as a reminder when submitting an online annual validation with the Guernsey Registry.

Levy collection scheme

The levy collection scheme allows entities who are registered and/or regulated by the GFSC to register with the ODPA to become a LCA. LCAs are able to register other entities with the ODPA and pay the levies on their behalf, but do not take on any of the entities other data protection obligations. The scheme is intended to give LCAs a straightforward way to carry out a 'bulk registration' for entities managed.

Organisations are able to take advantage of the levy collection scheme and appoint a LCA unless they:

• employ more than 50 full time equivalent staff;

• are required by law to appoint a Data Protection Officer;

• are themselves a LCA; or

• are a non-profit organisation.

Organisations looking to make use of a LCA should reach out to their CSP directly, and LCAs will furnish administered entities with a certificate exempting them from the need to register directly.

While some may recall guidance under the previous data protection regime which provided that no registration was necessary for administered entities where their CSP was responsible for data processing, this was not replaced following the introduction of the Data Protection Law and these changes make it clear that it is no longer possible to rely on that approach.