The Data Protection (Bailiwick of Guernsey) Law, 2017 applies to the processing of personal data of Bailiwick residents when their behavior is monitored within the Bailiwick, even if the controller or processor is not established in Guernsey.

Text of Relevant Provisions

Data Protection Law Art.2(3)(b)(ii):

*"(3) Condition B is that – *

• (b) the personal data is that of a Bailiwick resident, and it is processed in the context of – *

(ii) the monitoring of the resident's behaviour in the Bailiwick."

Analysis of Provisions

The Data Protection Law extends its applicability to situations where personal data of Bailiwick residents is processed in the context of "monitoring of the resident's behaviour in the Bailiwick". This provision is significant as it expands the territorial scope of the law beyond controllers and processors established in Guernsey.

The key elements of this provision are:

1. The data subject must be a "Bailiwick resident"
2. The processing must involve "monitoring" of the resident's behavior
3. The monitored behavior must occur "in the Bailiwick"

This provision aims to protect Guernsey residents from potentially intrusive monitoring activities, regardless of where the entity conducting the monitoring is located. It reflects the principle that data protection laws should follow the data subject rather than being limited by the geographical location of the data controller or processor.

Implications

This provision has several important implications for businesses:

1. Extra-territorial application: Companies outside Guernsey that monitor the behavior of Guernsey residents within the Bailiwick may be subject to Guernsey's data protection law, even if they have no physical presence in Guernsey.
2. Online activities: The provision likely covers various forms of online tracking and profiling of Guernsey residents' internet activities while they are physically present in Guernsey.
3. IoT and smart devices: Companies offering Internet of Things (IoT) devices or smart home technologies that monitor user behavior in Guernsey may fall under this provision.
4. Location-based services: Mobile apps or services that track the physical movements or activities of Guernsey residents within the Bailiwick would likely be covered.
5. Customer profiling: Businesses that analyze the purchasing patterns or preferences of Guernsey residents based on their behavior within Guernsey may need to comply with the Data Protection Law.
6. Compliance obligations: Non-Guernsey entities engaging in such monitoring activities may need to appoint a representative in Guernsey, register with the Data Protection Authority, and comply with all other relevant provisions of the Data Protection Law.
7. Risk assessment: Companies operating globally should assess whether their data processing activities involve monitoring Guernsey residents' behavior within the Bailiwick and adjust their data protection practices accordingly.