THE island has been warned that its data protection system is too lax. Stephen John, who teaches law at the Guernsey Business School, said that the Channel Islands could be operating outside a European Commission directive on data protection.
His comments followed a report in the Financial Times this month that claimed UK ministers might have to toughen the much-criticised act after a formal letter of warning from the EC.
‘The Guernsey data protection law effectively copies the essence of UK law,’ said Mr John.
‘This means that if the EC finds the UK has strayed out of the 1995 directive, then Guernsey’s interpretation of the law is also out of compliance.’
A change in the law could impose greater pressure on businesses by widening the definition of what counts as personal data.
Mr John said the question of personal data was called into question recently in the Durrant UK Court of Appeal case last year.
‘It was all about the right of an individual to access their personal data.
‘There’s a wide view and a narrow view.
‘The wide view says that if a company has information on me, then I should be able to ask for it whether it comes from me or another source.’
Last year’s case took a narrow view.
Mr John said it highlighted an inconsistency that the EU was now investigating.
Guernsey, he added, was in particular danger because data protection commissioner Dr Peter Harris took an even more restrictive view on what constituted personal data.
Dr Harris, for example, refutes the suggestion that an e-mail such as joe.bloggs@bigbank.com is personal data.
He said that it became personal data only when accompanied by other available information about Mr Bloggs.
Mr John disagreed and said it was personal data because it gave biographic information that Mr Bloggs worked at Big Bank. The law is open to interpretation.
‘There seems to be a very general feeling that more people are pro the wider approach than the narrow,’ he said, adding that the Court of Appeal case was the ‘last straw’ for the EC.
‘The implication of this is that the rest of Europe can impede the flow of information from the Channel Islands due to the EC’s interpretation of personal data. When you think of Guernsey, it’s all personal data.
‘It’s not going to stop overnight but a client or supplier in Europe might not supply information because we’re not complying with the directive.’
But Dr Harris said there was no cause for alarm.
He felt concerns had been stirred up by law firms in the UK in relation to the case.
He added that the UK - and consequently Guernsey - had not been singled out by the EC in its criticism of data protection laws.
Other countries have also been investigated.
‘The fact that the letter comes after the Durrant case is incidental.
‘If anything does happen from the commission, it wouldn’t change things very quickly.
‘Guernsey has the advantage that the EC looked at our law and deemed it adequate in October last year.
‘European businesses can’t use a data protection argument for failing to do business with Guernsey.’
He added that his interpretation of the law was pragmatic. If the UK were to change the law then Guernsey has the autonomy to do the same.
‘We have very strict policies and controls on the transfer of data abroad.
‘They are accompanied by contracts and businesses are coming to me all the time about the circumstances of transferring information out of Guernsey. We haven’t found it a problem to date.’
* Information for individuals and businesses on Guernsey’s data protection law can be found by visiting www.dataprotection.gov.gg
Article posted on 4th August, 2004 - 12.00am
Loading ...
Most Commented: