Guernsey Retains Its EU Adequacy ' As Expected

• Published date: 25 March 2024
• Subject Matter: Government, Public Sector, Privacy, Data Protection, Human Rights
• Law Firm: Appleby
• Author: Mr Richard Field and Koketso Mathebula

The post-Brexit regulatory landscape continues to throw up challenges and jurisdictional arbitrage, but there are some areas where consistency and stability are welcome. The recent confirmation from the European Commission that 11 jurisdictions had retained their "adequacy" status from a data protection perspective has left many breathing a (long anticipated) sigh of relief. All three of the Crown Dependencies (Guernsey, Jersey and the Isle of Man) have retained the coveted status.

First published in Privacy Laws & Business, March 2024

International data transfers remain a source of concern, as risk assessments are often required, plus there has been uncertainty as to the efficacy of certain safeguards used previously. The "adequacy" status provides a good degree of comfort, as data flows to those jurisdictions can continue as they have done for years, without additional requirements.

The term "adequate" always seems slightly underwhelming, given the variety of superlative terms available to describe success - it feels akin to "could do better". However, in the data protection world, "adequate" or more specifically "adequacy" is a much sought-after status afforded to a small, but growing number of jurisdictions.

The news that Guernsey had its "adequacy" status confirmed¹ by virtue of the European Commission (Commission) report of 15 January 2024 (including the Commission Staff Working Document) (Report) on the functioning of the existing "adequacy" decisions adopted under Directive 95/46/EC was therefore welcomed and celebrated in equal measure. Alongside our fellow Crown Dependencies of Jersey and the Isle of Man, the Report means that the flows of personal data required to facilitate business in today's digital economy can continue as they have done for many years, without additional requirements. It also follows the UK government's decision of 7 July 2023 confirming Guernsey's "adequacy" status for law enforcement data transfer purposes², the first of its kind issued by the UK government.

WHY ADEQUACY IS VITAL FOR GUERNSEY

Guernsey has a long history as an offshore international financial centre, known for its stability, robust approach to compliance and good governance. The financial services industry contributes significantly to the island's GDP and is the major employing industry outside of the public sector. Guernsey's ability to service a global client base in an increasingly digital marketplace is vital to maintaining its success, alongside facilitating the flow of capital across the globe. As such, there is no sense of underachievement, rather that this is a validation of the high standards being implemented and recognition that "trust" plays a vital part in today's remote economy.

Importantly, it is also recognition of the hard work carried out by the States of Guernsey's team (led by the Head of Data Protection, Callie Loveridge) and the collaborative approach adopted through liaison with industry working groups to develop and finalise evolutionary legislation in a challenging timeframe.

Since the final text of the EU General Data Protection Regulation (GDPR) was adopted in 2016, Guernsey's authorities worked quickly and efficiently to develop and debate policy and create the framework for legislation "essentially equivalent" to GDPR. This led to the Data Protection (Bailiwick of Guernsey) Law, 2017 (Law) coming into force on the same day GDPR began to be enforced, 25 May 2018. Guernsey's previous legislation dated back to 2001 and as such required supplementing to meet the GDPR standards, albeit the fundamental principles remained the same. The new enforcement powers of the local regulator in particular provided "teeth" to the requirements under the Law.

As a piece of legislation touching all aspects of...