Registration

Registration

Q: What is Registration? A: Registration is the process by which data controllers and data processors (organisations that process personal data on behalf of controllers) inform the Authority of certain details relating to their organisation. These details are used to make an entry in a Register, elements of which are available for inspection by the public via the online Registry.

The principal purpose of registration is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is processing their personal information.

The online Registry will not contain any detailed information about information processed by a controller or processor. If an individual wants this information, they will need to contact the relevant controller or processor.

Who is required to register?

All data controllers and processors established in Jersey are required to register with the Authority and may not process personal data unless they are registered, unless an exemption applies: "A controller or processor established in Jersey must not cause or permit personal data to be processed without being registered as a controller or processor…"¹

You do not need to register if:

1. The information you hold is not "personal data"²;
2. You are holding information as a natural person for purely personal or domestic purposes; or
3. You process data (as a controller or processor) purely for the purpose of safeguarding national security³.

Any data processor established in Jersey processing data on behalf of a data controller must also register.

How do I register?

You can register online and all registrations will be provided a registration number at the point of registration, together with a security number, which must be quoted each time you contact us about your registration. You should keep this number and security code safe. You will also need to create an account with Kinde when you register for the first time as this is how you log in to access your registration.

Once you have completed the online registration process, your registration will become searchable on the Registry shortly afterwards.

When do I renew the registration?

You need to renew your registration every year. Registrations will expire on 31 December each year. The renewal window will open on 1 January and all renewals must be completed by the last day of February. If you fail to renew your registration by this deadline, your registration will expire.

During the renewal window, between 1 January and the last day of February, you will receive various automatic emails reminding you that the registration is available for renewal, until the registration renewal process has been completed.

Reminders will be sent to the correspondence email address provided by you. If this email address changes for any reason (e.g. the person whose email address it is leaves the organisation), please ensure it is updated as soon as possible (and, in any event within the 28 days as mandated by law) so that you continue to receive all relevant reminders and registration related correspondence. Updates can be made online by logging into the registration portal.

During the renewal process, you will have the opportunity to review, and make any necessary updates, to the organisation name, address, contact and Data Protection Officer/lead details.

What if I need to update the registration at any point?

You must advise us of any changes to registration details as soon as possible. Updates can be made online by logging into the registration portal and using the ‘Update’ button. You must do this within 28 days of the change as required by the DPAJL. Failure to keep your registration entry up-to-date is a criminal offence. Changes can be made free of charge.

If the registration is no longer required, you must inform us as soon as possible and at the latest within 28 days of the change. To deregister, please log into the registration portal, click on ‘Options +’ located next to the registration and then click on the ‘Deregister’ button and complete the deregistration request form. (Note: If you are keeping any accounts and records (that include personal data) as required by law after ceasing to conduct business, you must remain registered but may be exempt from charges.) If the company is still active on the JFSC registry and not yet dissolved, it cannot be deregistered and must be renewed. Once dissolved, a deregistration request can be submitted.

What happens if I don't register?

Failure to register with the Authority where you are required to do so is a criminal offence.

What if the person responsible for managing the registration changes?

You can transfer management of a registration from one person to another. When there is a change, you must share the registration number and security code with the new person responsible and make any necessary updates to the registration details as soon as possible and at the latest within 28 days of the change. The new person responsible must log into the registration portal and link to the registration using the registration number and security code. Once linked, you can request that you are delinked from the registration by emailing enquiries@jerseyoic.org

Is the Register published?

Yes, elements of the Register are published on our website in the online Registry. The online Registry only publishes the organisation’s name, their registration number and the expiry date of the registration (or the status of the registration if not yet paid) together with any registered business names. You will not be sent a copy of the details submitted for the registration, but you will be able to download a registration certificate from the registration portal.

Charges

Under the 2018 Regulations, registered controllers and processors must pay a charge to the Authority, unless they are exempt. The cost of the registration charge depends on the number of full-time equivalent employees, turnover and the categories of personal data processed.

Certain types of controllers/processors do not have to pay a registration charge. These organisations are set out at Schedule 2 of the 2018 Regulations. They are:

• Public authorities;
• Candidates for election (namely a controller who has been admitted as a candidate for public election as an officer in a constituency under Art.18 of the Public Elections (Jersey) Law 2002);
• Provided schools (a school listed at Schedule 1, Part 1 of the Education (Jersey) Law 1999);
• Organisations who have ceased to conduct business and whose only processing activity is retaining personal data; and
• Non-profit organisations.

How much is the registration charge?

The annual charge is calculated based on a number of factors:

1. the number of full-time equivalent employees (FTE);
2. its revenue from the preceding year;
3. whether it is registered with the Jersey Financial Services Commission and is carrying on a financial services business as specified in Schedule 2 of the Proceeds of Crime (Jersey) Law 1999 (other than in paragraphs 6, 8 and 10 of Part B);
4. Whether the organisation processes special category data (charge only applies if also registered with the Jersey Financial Services Commission (JFSC) and has a past-year revenue of at least £100,000).

*The special category data charge only applies if the controller/processor is also registered with the Jersey Financial Services Commission (JFSC) and the past-year revenue is more than £100k.

A FTE means a person employed for more than 27 hours a week;

1. If an individual is working no more than 9 hours a week, they are treated as 25% of a FTE employee;
2. If an individual is working more than 9 hours but no more than 18 hours a week, they are treated as 50% of a FTE employee; and
3. If an individual is working more than 18 hours but not more than 27 hours a week, they are treated as 75% of a FTE employee.

The number of FTE(s) is calculated on the basis of the highest number of posts existing at any time during the past 12 months, ignoring any vacancies. It is not calculated as at the date of registration.

The lowest charge payable (unless an administered registration as detailed below) is £70 and the highest is £1,600.

If you are an organisation that provides “trust company businesses” or “fund services businesses” as defined by Art.1(1) of the Financial Services (Jersey) Law 1998 and provides such services to administered entities, these can be registered as administered and will attract an additional £50 registration charge per administered entity. Please refer to the Guidance for Administered Controllers and Processors for more details.

When does the registration charge need to be paid?

For renewing registrations, the registration charge is due by the last day of February each year.

For new registrations, the registration charge is due one month after the registration is submitted.

Payment can be made online at the end of the registration process. If you do not wish to pay online, you can request an invoice which will be sent to the billing contact detailed during the registration submission and all relevant offline payment details will be included on the invoice.

What happens if the registration charge is not paid?

Reg.7(b) of the 2018 Regulations allows the Authority to remove an entry from the Register if the relevant data controller or data processor fails to pay the relevant charge.

Following the February payment deadline for renewals or one month following submission deadline for new registrations, if the charge remains unpaid the Authority will write to the data controller or processor advising that the relevant entry will be removed from the Registry and reminding it that it is a criminal offence to process personal data without being registered with the Authority.

Definitions

Q: What is a data controller?

A: The data controller determines the purposes for which and the means by which personal data is processed. If you, your company/organisation decides ‘why’ and ‘how’ the personal data should be processed it is a data controller.

Q: What is a data processor?

A: The data processor processes personal data only on behalf of and in accordance with the specific written instructions of the controller. The data processor is usually a third party external to the controller, often an outsourced service e.g. an external IT service provider, outsourced payroll services.

Q: What is an Appointed DPO?

A: An appointed Data Protection Officer refers to someone who has been appointed to that role as per Article 24 of the Data Protection (Jersey) Law 2018.

Q: What is a Data Protection Lead?

A: If you are not required to have an Appointed DPO, you will need to have a Data Protection Lead who will be the person who has day-to-day responsibility for data protection matters and is someone we can contact should we have any data protection related queries. *Did you know we have a Let’s Go DPO newsletter mailing list? If you’re not already signed up, click here to register and we’ll stay in touch!

Q: Class of Processing - What is a Public Authority?

A: Public Authority means:

• the States Assembly including the States Greffe;
• a Minister;
• a committee or other body established by a resolution of the States or by, or in accordance with, standing orders of the States Assembly;
• an administration of the States;
• a Department referred to in Article 1 of the Departments of the Judiciary and the Legislature (Jersey) Law 1965;
• any court or tribunal;
• the States of Jersey Police Force;
• a parish;
• the holder of a public office;
• in relation to any country other than Jersey, any person exercising or performing functions or holding any office similar or comparable to any of the persons described in sub-paragraphs (a) to (i); and any other person or body (whether incorporated or unincorporated) that exercises functions of a public nature.

Q: Class of Processing - What is a Candidate for Election?

A: Candidate for Election means an individual who has been admitted as a candidate for a public election of an officer in a constituency under Article 18 of the Public Elections (Jersey) Law 2002.

Q: Class of Processing - What is a Provided School?

A: Provided School means a school listed at Schedule 1, Part 1 of the Education (Jersey) Law 1999. This does not include dance schools, driving schools, childminders, music schools etc.

Q: Class of Processing - What is a business that has ceased trading?

A: An organisation that has ceased to conduct business but continues to retain any accounts and records (that include personal data) as required by law, after ceasing to conduct business. If a company, this only applies if the company has been dissolved. If it is still live on the Jersey Financial Services Commission registry, this exemption will not apply.

Q: Class of Processing - What is a non-profit association?

A: Non-Profit Association means any body, or association that is not established or conducted for profit.

Q: What is an FTE?

A: The base registration charge is calculated by the number of full-time equivalent employees (FTE) of the 'payer' (the individual/organisation being registered).

For the purpose of determining the number of FTEs of a payer – (a) a person employed for no more than 9 hours a week is treated as 25% of a FTE employee; (b) a person employed for more than 9 hours but no more than 18 hours a week is treated as 50% of a FTE employee; (c) a person employed for more than 18 hours but not more than 27 hours a week is treated as 75% of a FTE employee; and (d) a person employed for more than 27 hours a week is treated as a FTE employee.

The determination of FTEs must be calculated on the basis of the highest number of posts existing at any time during the past 12 months, ignoring any vacancies.

Please note: this means all individuals who are considered employed/have a contractual employment relationship with the 'payer', regardless of what jurisdiction they live or work in. For example, if a UK company is registering with JOIC, this includes all employees employed by the UK company, not just those working from Jersey, on behalf of the UK company. Therefore, any employees who are contractually employed by the ‘payer’ must be counted for the purpose of correctly calculating the registration charges.

Q: What is past-year revenue?

A: Past-year revenues means a payer’s (the individual/organisation being registered) gross revenues for the year before the year to which an annual charge relates.

Please note: this means the total past-year revenue generated by the 'payer', not just the revenue generated in Jersey or by Jersey employees. For example, if a UK company is registering with JOIC, the past-year revenue relates to all past-year revenue generated by the UK company, regardless of where the revenue was generated. Therefore, all past-year revenue relating to the ‘payer’ must be included for the purpose of correctly calculating the registration charges.

Q: Who is subject to Proceeds of Crime (Jersey) Law 1999?

A: An organisation that is registered with the Jersey Financial Services Commission and is carrying on a financial services business as specified in Schedule 2 to the Proceeds of Crime (Jersey) Law 1999 (other than in paragraphs 6, 8 and 10 of Part B) which includes (subject to any exemptions that may apply) such as:

• Business that is regulated by the Jersey Financial Services Commission under regulatory laws;
• Lawyers;
• Accountants;
• Estate agents;
• High value dealers;
• Casinos;
• Acceptance of deposits and other repayable funds from the public;
• Lending, including consumer credit, mortgage credit, factoring, financing of commercial transactions;
• Financial leasing;
• Issuing and administering means of payment;
• Guarantees and commitments;
• Trading for the account of third parties in money market instruments, foreign exchange, futures and options, exchange, interest rate and index instruments, transferable securities;
• Participation in securities issues;
• Advice to undertakings on capital structure, industrial strategy and related questions and advice as well as services relating to mergers and the purchase of undertakings;
• Money broking;
• Portfolio management and advice;
• Safekeeping and administration of securities;
• Safe custody services;
• Otherwise investing, administering or managing funds or money on behalf of third parties; and
• Virtual currency exchange

Q: Is the person/organisation registered with the Jersey Financial Services Commission (JFSC)?

A: This refers to the person or organisation being registered with the JFSC, not just those who are regulated. The following types of individuals and organisations must be registered with the JFSC; registered business names, companies, foundations, incorporated limited partnerships, limited liability partnerships, limited partnerships and continuances and separate limited partnerships. To find out if the person or organisation is registered, please click on this link to search the JFSC registry.

Q: What is special category data?

A: Special category data means:

• data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
• genetic or biometric data that is processed for the purpose of uniquely identifying a natural person;
• data concerning health;
• data concerning a natural person’s sex life or sexual orientation; or
• data relating to a natural person’s criminal record or alleged criminal activity.

This may include the processing of special category data relating to employees/volunteers/clients/members such as sickness absence records, copies of passports, accident report books, allergies, health declarations, criminal record checks, finger prints for ID purposes etc.

Q: What does “established” mean?

A: The Data Protection (Jersey) Law 2018 defines “established” as follows:

(4) For the purposes of paragraphs (2) and (3), each of the following is to be treated as established in Jersey –

(a) a natural person who is ordinarily resident in Jersey;

(b) a body incorporated under the law of Jersey;

(c) a partnership or other unincorporated association formed under the law of Jersey;

(d) any person who does not fall within sub-paragraph (a), (b) or (c) but maintains in Jersey –

(i) an office, branch or agency through which the person carries on any processing of personal data, or

(ii) a regular practice that carries on any processing of personal data; or

(e) any person engaging in effective and real processing activities through stable arrangements in Jersey.

Q: Is the organisation a “trust company business” or a “fund services business” that administers controllers / processors?

A: A “trust company business” and “fund services business” are as defined in the Financial Services (Jersey) Law 1998 as follows:

Article 1 “trust company business” has, subject to any Order under Article 4, the meaning given to that expression by Article 2(3);

Article 2(3) A person carries on trust company business if the person carries on a business that involves –

(a) the provision of company administration services;

(b) the provision of trustee or fiduciary services;

(c) the provision of services to foundations; or

(d) the provision of services to partnerships not being services described in sub-paragraph (a), (b) or (c),

Article 1 “fund services business” has, subject to any Order under Article 4, the meaning given to that expression by Article 2;

Article 2(10) A person carries on fund services business if by way of business the person is –

(a) a manager, manager of a managed entity, administrator, registrar, investment manager or investment adviser;

(b) a distributor, subscription agent, redemption agent, premium receiving agent, policy proceeds paying agent, purchase agent or repurchase agent;

(c) a trustee, custodian or depositary; or

(d) a member (except a limited partner) of a partnership, including a partnership constituted under the law of a country or territory outside Jersey, in relation to an unclassified fund or an unregulated fund.[32]

Q: How do I know if I need to include the names of the controllers/processors established in Jersey being administered by the “trust company business” or “fund services business”?

A: Controllers/processors are only required to be registered once. For example, you do not need to register the controller/processor as being administered by you if they have already completed their own registration. Therefore, please ensure the controller/processor being administered is not already registered. You should check whose responsibility it is to register the controller/processor.