The Data Protection (Bailiwick of Guernsey) Law, 2017, as amended ('the Data Protection Law') applies to the processing of personal data in the context of offering goods or services to Bailiwick residents.

Text of Relevant Provisions

Data Protection Law Art.2(3)(b)(i):

*"(3) Condition B is that – * *(b) the personal data is that of a Bailiwick resident, and it is processed in the context of – *

• (i) the offering of goods or services (whether or not for payment) to the resident, or "*

Analysis of Provisions

The Data Protection Law extends its applicability to situations where personal data of Bailiwick residents is processed in the context of offering goods or services to those residents. This provision is significant as it captures data processing activities that may occur outside the Bailiwick of Guernsey but are directed at its residents.

Key elements of this provision include:

1. "personal data is that of a Bailiwick resident": The law specifically protects data of individuals residing in the Bailiwick of Guernsey.
2. "processed in the context of": This phrase indicates that the processing must be directly related to the offering of goods or services.
3. "the offering of goods or services": This covers a wide range of commercial and non-commercial activities.
4. "whether or not for payment": The provision applies regardless of whether the goods or services are provided for free or for a fee.
5. "to the resident": The offering must be specifically directed at Bailiwick residents.

This provision aims to ensure that Guernsey residents' personal data is protected even when they engage with entities or businesses that may not be physically present in the Bailiwick. It reflects the modern reality of cross-border commerce and digital services, where data processing often occurs in jurisdictions different from where the data subject resides.

Implications

The inclusion of this factor in the Data Protection Law has several implications for businesses and organizations:

1. Extraterritorial reach: Companies outside Guernsey that offer goods or services to Guernsey residents must comply with the Data Protection Law, even if they have no physical presence in the Bailiwick.
2. Broad application: The law applies to both commercial and non-commercial offerings, capturing a wide range of activities including e-commerce, digital services, and free online platforms.
3. Targeted offerings: Businesses need to assess whether their activities specifically target Guernsey residents. Factors that might indicate targeting could include:
   • Use of local currency (Guernsey pound)
   • Offering services in languages predominantly used in Guernsey
   • References to Guernsey customers or users
4. Data protection measures: Organizations offering goods or services to Guernsey residents must implement appropriate data protection measures compliant with the Data Protection Law.
5. Potential compliance burden: Non-Guernsey businesses may need to adapt their data processing practices to comply with Guernsey's data protection requirements, potentially leading to additional compliance costs.
6. Consumer protection: Guernsey residents benefit from consistent data protection standards regardless of whether they engage with local or foreign entities.