Levies, Registration And All That Jazz

• Published date: 30 January 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: Appleby
• Author: Mr Richard Field and Jarrad Knoetze

Regulatory markets evolve at various speeds and the data protection regime is one example of a market developing at an exponential pace. From BA, to Experian and now Grindr, the path to compliance has been littered with good and bad practices, eye-watering fines and examples of real-world harms being exposed. World Data Protection Day (28th January for the un-initiated) is a good opportunity to reflect on that progress.

Guernsey's regime has also been moving at pace, with significant engagement programmes from the regulator (ODPA), regulatory sanctions and the establishment of a forum for practitioners (the Bailiwick of Guernsey Data Protection Association). Most recently, there has been an overhaul of the registration system and the introduction of the Levy Collection Agent (LCA) regime as part of the ODPA's move towards a self-funding model.

Registration requirements and the LCA process have both been well-publicised, though with the run-up to Christmas 2020 and the current "lockdown", businesses may be forgiven for some of these matters remaining on the "to do" list. We have been engaging with a wide range of businesses from different sectors to assist them in understanding their obligations, and foresee a continued number of instructions in the run-up to the deadline at the end of February 2021.

Whilst registration for Controllers and Processors has been a requirement for a number of years, the increasing profile and importance of data protection in today's digital (global) marketplace has caused some to re-evaluate their approach to entities which they administer. Whilst the process itself is straightforward (registering via the portal takes a matter of minutes), the groundwork involved in assessing the status of a given structure/entity and its processing operations is often more complex. This is especially the case for overseas entities, administered and/or managed from Guernsey.

Oscar Wilde wrote that "What seems to us as bitter trials are often blessings in disguise." This could be applied to any form of regulatory change which brings with it additional work. However, in this instance, there are real benefits, including a greater understanding of data protection obligations generally and the ability to build trust with clients through safeguarding of their data. The reputational and economic backlash that arises when things go wrong demonstrate that the "blessings" are not necessarily that well disguised.

On 1 October 2020, the Data Protection...