While most of Guernsey's new data protection law took effect last year, there were a few parts that that had a grace period until 25 May 2019. Vicky Pratt, of Walkers Employment team, sets out below the last headline points that HR professionals should keep in mind to make sure that the business stays on the right side of the data protection law.
- By 25 May 2019 make sure privacy notices have gone to all staff, not just new joiners.
- From 25 May 2019 nearly all consents given by employees under the old law will fall away and cannot be relied on. Instead the business must be able to point another ground that allows it to process employees' data (this should not be hard).
- By 25 May 2019 the employer must have completed data protection impact assessments for its use of employees' special category data and any other data protection impact assessments that are required because of the way the employer collects and/or uses staff data.
- If the employer is a joint-controller with another entity (possibly a group company) then by 25 May 2019 the joint controllers' respective obligations must be decided and recorded and the necessary notifications must have been sent to all staff.
- By 25 May 2019, make sure contracts with all processors are in place and those agreements include the statutory requirements.
For fuller information about staff data and the end of the data protection transitional period in Guernsey please click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.