THE STATES, in pursuance of Article 67, and paragraph 10 of Schedule 3, of the Data Protection (Jersey) Law 2005, have made the following Regulations:　

1.- Interpretation

In these Regulations :

“Law” means the Data Protection (Jersey) Law 2005;

“research purposes” includes statistical and historical purposes.

2.- Additional circumstances for processing sensitive personal data

For the purposes of paragraph 10 of Schedule 3 to the Law, prescribed circumstances for the processing of sensitive personal data are the set of circumstances set out in any one of Regulations 3–11.

3.- Prevention of unlawful acts

The processing of the personal data :

(a) is in the substantial public interest;

(b) is necessary for the purposes of the prevention or detection of any unlawful act or unlawful omission; and

(c) must, in order not to prejudice those purposes, be carried out without the data controller’s seeking the explicit consent of the data subject.

4.- Protection against malpractice and mismanagement

The processing of the personal data:

(a) is in the substantial public interest;

(b) is necessary for the discharge of any function that is designed for protecting members of the public against :

(i) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person, or

(ii) mismanagement in the administration of, or failures in services provided by, any body or association; and

(c) must, in order not to prejudice the discharge of that function, be carried out without the data controller’s seeking the explicit consent of the data subject.

5.- Publication about malpractice and mismanagement

(1) The processing of the personal data :

(a) takes the form of disclosure;

(b) is in the substantial public interest;

(c) is in connection with :

(i) the commission by any person of any unlawful act, or unlawful omission, whether alleged or established,

(ii) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person, whether alleged or established, or

(iii) mismanagement in the administration of, or failures in services provided by, any body or association, whether the mismanagement or failures are alleged or established;

(d) is for the special purposes; and

(e) is made with a view to the publication of those data by any person.

(2) The person who is the data controller in relation to the processing reasonably believes that the publication would be in the public interest.

6.- Counselling

(1) The processing of the personal data :

(a) is in the substantial public interest; and

(b) is necessary for the discharge of any function designed for the provision of confidential counselling, confidential advice, confidential support or a similar confidential service.

(2) One or more of the following conditions is satisfied :

(a) the data subject cannot give consent to the processing;

(b) the data controller cannot reasonably be expected to obtain the consent of the data subject to the processing; or

(c) the processing must, in order not to prejudice the discharge of the function referred to in paragraph (1)(b), be carried out without the data controller’s seeking the explicit consent of the data subject.

7.- Insurance and pensions: general determinations

(1) The processing of the personal data :

(a) is necessary for the purpose of :

(i) carrying on insurance business falling within Class 1, 3 or 4 of Part 1 of Schedule 1 to the Insurance Business (Jersey) Law 1996, or within Class 1 or 2 of Part 2 of that Schedule, or

(ii) making determinations in connection with eligibility for, or benefits payable under, an occupational pension scheme, being a scheme, or arrangement, that is constituted in one or more instruments or agreements and has, or is capable of having, effect in relation to one or more descriptions or categories of employments so as to provide benefits, in the form of pensions or otherwise, payable on termination of service, or on death or retirement, to or in respect of earners with qualifying service in an employment of any such description or category; and

(b) does not support measures or decisions that relate in particular to the person who is the data subject in respect of the personal data.

(2) The data controller cannot reasonably be expected to obtain the explicit consent of that data subject to the processing and the data controller is not aware of the data subject’s withholding his or her consent to the processing.

(3) The personal data consists of information falling within Article　2(e) of the Law and relates to a data subject who is the parent, grandparent, great-grandparent or sibling of : 　

(a) in the case of processing for the purpose referred to in paragraph (1)(a)(i), a person insured (or seeking to be insured) in the course of the insurance business; or

(b) in the case of processing for the purpose referred to in paragraph (1)(b), a person who is a member of the scheme or seeking to become a member of the scheme.

8.- Insurance and pensions: current processing

(1) The processing of the personal data :

(a) was already under way in relation to the same data subject and by or on behalf of the same data controller immediately before the coming into force of these Regulations; and

(b) is necessary for the purpose of :

(i) carrying on insurance business falling within Class 1, 3 or 4 of Part 1 of Schedule 1 to the Insurance Business (Jersey) Law 1996, or

(ii) establishing or administering an occupational pension scheme, being a scheme, or arrangement, that is constituted in one or more instruments or agreements and has, or is capable of having, effect in relation to one or more descriptions or categories of employments so as to provide benefits, in the form of pensions or otherwise, payable on termination of service, or on death or retirement, to or in respect of earners with qualifying service in an employment of any such description or category.

(2) One or both of the following conditions is satisfied :

(a) the data controller cannot reasonably be expected to obtain the explicit consent of the data subject to the processing and has not been informed by the data subject that the latter refuses consent to the processing;

(b) the processing must, in order not to prejudice the purpose referred to in paragraph　(1)(b), be carried out without the data controller’s seeking the explicit consent of the data subject.

9.- Positive discrimination

(1) The processing of the personal data :

(a) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons :

(i) holding different religious beliefs or other beliefs of a similar nature, or

(ii) of different states of physical or mental health or different physical or mental conditions, with a view to enabling such equality to be promoted or maintained;

(b) does not support measures or decisions with respect to any particular data subject otherwise than with the explicit consent of the data subject; and

(c) does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person.

(2) The personal data consists of information falling within Article 2(c) of the Law (in the case of processing referred to in paragraph (1)(a)(i)) or within Article 2(e) of the Law (in the case of processing referred to in paragraph (1)(a)(ii)).

(3) The processing is not contrary to any notice in writing that an individual has given to the data controller requiring that data controller to cease processing personal data in respect of which the individual is the data subject.

10.- Research

The processing of the personal data :

(a) is in the substantial public interest;

(b) is necessary for research purposes;

(c) does not support measures or decisions with respect to any particular data subject otherwise than with the explicit consent of the data subject; and

(d) does not cause, nor is likely to cause, substantial damage or substantial distress to the data subject or any other person.

11.- Functions of a police officer

The processing is necessary for the exercise of any function conferred on a police officer by or under any enactment or other law.

12.- Period of notice under Regulation 9(3)

A notice under Regulation 9(3) takes effect for the purpose of that Regulation at the end of a period that is reasonable in the circumstances unless the notice specifies a longer period, in which case it takes effect at the end of that longer period.

13.- Citation

These Regulations may be cited as the Data Protection (Sensitive Personal Data) (Jersey) Regulations 2005.