New data protection legislation comes into force
Published On:Wednesday, August 1, 2018
The new data protection legislation comes into force today, 1 August 2018, and, with the exception of a transitional provision for Part 3 (Notification by data controllers), repeals the Data Protection Act 2002.
The new law brings the Island into line with other jurisdictions that have implemented equivalent legislation to the EU GDPR which came into full force in EU Member States on 25 May 2018.
The new law:
- Applies to controllers and processors (in certain respects)
- Obliges controllers to demonstrate how they comply with the law and be accountable for that compliance
- Provides stronger rights for individuals in respect of the processing of their personal data
- Requires suitable records of processing, data protection policies etc. to be maintained in many cases
- Includes new sanctions, penalties, fines and custodial sentences
- Contains revised registration requirements - some businesses and organisations that were previously exempt from the need to register, including processors, should check whether they remain exempt
Every business and organisation that processes personal data therefore needs to understand its new obligations.
The legislation does contain some transitional arrangements which provide further time for businesses and organisations to adapt to the new legislation. In particular, there are transitional arrangements until 1 February 2019 for registration renewals and until 25 May 2019 in respect of compliance with the new transparency and consent requirements.
The Information Commissioner’s website www.inforights.im has been updated to provide some specific guidance on the new law and the transitional arrangements; this is in addition to guidance already published about the EU GDPR. As yet, not all guidance has been updated; further updates will be published as soon as possible, as resources permit. In the interim, guidance published under the 2002 Act remains available from the document library.
Some of the guidance already published is available below.