British Virgin Islands Data Protection Law: Doing Business in Jurisdiction

The factor of Doing Business in Jurisdiction is used in determining the law's applicability by considering whether an organization has a commercial presence or engages in economic activities within the British Virgin Islands (BVI), regardless of where the processing takes place.

Text of Relevant Provisions

BVI DPA. Art. 4 (4)(d)(ii):

"(4) For the purposes of subsections (2) and (3), each of the following shall be treated as established in the Virgin Islands: (d) a person who does not fall within paragraph (a), (b) or (c) but maintains in Virgin Islands (ii) a regular professional practice."

BVI DPA. Art. 4 (2)(b):

"(2) Subject to subsection (1), this Act applies to a person in respect of personal data of (b) the person is not established in the Virgin Islands, but uses equipment in the Virgin Islands for processing personal data otherwise than for the purposes of transit through Virgin Islands."

Analysis of Provisions

The BVI Data Protection Act (DPA) specifies that the law applies to data controllers that are established in the BVI and process personal data, as well as to data controllers that are not established in the BVI but use equipment in the BVI for processing personal data (Art. 4(2)(b)). Additionally, the law treats as established in the BVI any person who maintains a regular professional practice in the BVI (Art. 4(4)(d)(ii)).

These provisions indicate that the law's applicability is based on the presence of a commercial entity within the BVI or the use of means situated in the BVI for data processing. This means that any organization that has a place of business in the BVI or uses means situated in the BVI for data processing would be subject to the law.

Implications

The inclusion of this factor has significant implications for businesses operating in the BVI. For example, a company that has a branch office in the BVI would be subject to the law, regardless of where the data processing takes place. Similarly, a company that uses data centers or servers located in the BVI for data processing would also be subject to the law.

Conversely, a company that does not have a place of business in the BVI and does not use means situated in the BVI for data processing would not be subject to the law.

For instance, a foreign company that processes personal data of BVI residents but does not have a presence in the BVI and does not use BVI-based data centers or servers would not be subject to the law. However, if the same company were to establish a branch office in the BVI or use BVI-based data centers or servers for data processing, it would be subject to the law.