Information Commissioner issues Statement following Credit Reference Agencies announcement

Jersey Information Commissioner Paul Vane has issued the following statement following the announcement Islanders’ personal information will be securely shared with United Kingdom Credit Reference Agencies (CRAs) from the end of this month.

Personal information automatically provided to the CRAs will be Jersey residents’ name, residential address and date of birth. The sharing of this personal information is not compulsory and Islanders are able to opt out.

Jersey Information Commissioner Paul Vane said: “It has long been an issue in Jersey whereby local citizens have been disadvantaged in terms of securing credit, whether that be for a loan, a mortgage or access to credit facilities, purely on the basis of where they live. Unlike the UK, where it is permissible for Credit Reference Agencies (CRAs) to access the electoral register to verify a person is who they say they are, similar provisions in Jersey have not existed up until now. That meant that CRAs could not verify Jersey applicant address details, because they did not have access to the Jersey electoral register. As a result, Jersey residents were often refused credit because the CRA criteria for verifying the individual could not be satisfied.

The amendment passed by the States Assembly in January this year changes that, and whilst access to the electoral register by CRAs is still not permissible, basic personal information about citizens held in the Population Register can now be shared for this specific purpose.

The sharing of personal data with certain specified UK CRAs is governed by the Data Protection (Jersey) Law 2018. This means that Jersey’s Government must ensure they comply with the Data Protection Principles, particularly in terms of ensuring that any disclosure is limited only to what is necessary for the purpose of verifying identity for credit purposes. They must also have a lawful basis for sharing and must have a robust data sharing agreement in place with each of the CRAs to which personal data is to be shared. Those data sharing agreements set out strict rules as to how citizen’s personal data is shared, handled and kept secure. Individual rights under the Data Protection (Jersey) Law 2018 still apply, and any individual concerned about how their data has been handled can lodge a complaint, firstly with the Government of Jersey, and if not satisfied with the outcome, with my office.”