Data Protection Law to start in 2019

(CNS): The Cabinet has set January 2019 as the implementation date for the Data Protection Law which was passed in the Legislative Assembly earlier this year. Over the next 18 months, a newly formed working group will develop the necessary regulations to complete the legislation and allow the law to come into effect. The current acting information commissioner, Jan Liebaers, who led the last working group that drew up the law, will also chair the new panel of experts shaping the regulations aimed at preventing the misuse of data by both government and the private sector. 

In a government release, officials said that local attorney Peter Broadhurst, who also worked with Liebaers as part of the previous group, will return to the new line-up along with offshore finance experts Tim Dawson from Maples, Peter Colegate of Appleby, Garfield Ellison and Nadira Lord from the Cabinet Office and J Paul Morgan from the utilities regulator OfReg.

Once the law comes into force, however, the new office of the supra-ombudsman will enforce the legislation. The merger of the information commissioner, the complaints commissioner, a new police complaints function and data protection will happen when government appoints the new ombudsman. The recruitment process began earlier this year with a deadline of 30 April but there has been no news yet on filling the latest top public sector job. It is understood, however, that Liebaers will become the deputy ombudsman who will deal with data protection alongside his existing portfolio of freedom of information.

The Data Protection Law (2017) was passed in the LA in March after a mix-up over the previous drafts presented during meetings in September and October last year. The final draft was presented by the attorney general, days before the end of the last parliament, against objections from the opposition benches. The law had previously raised concerns in the wider community too as business and the legal profession had bemoaned the cost of implementation.

According to officials, the law protects the fundamental right to private and family life of individuals in line with the 2009 constitution and the bill of rights. It is modelled on current European Union legislation and aims to meet the “adequate protection” requirements in relation to the international transfer of personal data. Under the new law, any “data controller” in the public or private sector who collects and processes information that can identify an individual will be expected, amongst other things, to reveal upfront the purpose of using the information.

They will also need to ensure the information is relevant and not excessive for the purpose it is used for. With certain exemptions, the law grants individuals the right to access their own personal data, and demand that general processing, as well as that for direct marketing purposes, cease.