Data Subject Access Request

The Data Protection (Jersey) Law 2018 provides individuals with personal data rights including how organisations process their personal data. The most commonly used is the right of subject access.

Individuals will use this right, to understand what personal information an organisation processes about them. A data subject access request allows you to exercise this right and you are entitled to be:

  • told whether any personal data is being processed;
  • given a description of the personal data, the reasons it’s being processed, and whether it will be given to any other organisations or people;
  • given the information contained in personal data; and the details of the source of the data (where available).

You also have rights to:

  • request rectification, erasure, restriction of processing (under certain circumstances)
  • object to processing on the basis of direct marketing, legitimate interest or public function
  • request for your data to be provided in a structured machine-readable format in order to transmit to another data controller (portability)
  • complain to the Jersey Office of the Information Commissioner (JOIC)

Information you are entitled to

You are entitled to request personal data Ports of Jersey processes about yourself, or someone you have the authority to act on behalf of, such as someone with parental responsibility or guardianship, a person appointed by a court to manage someone else’s affairs, a solicitor acting on their client’s instructions.

You can ask:

  • if your personal data is being processed by Ports of Jersey
  • the purposes for which your data is being or is to be processed
  • the types of personal data processed
  • Who your data may be disclosed to
  • how long your data is likely to be processed
  • where the data was collected from
  • about any automated decision making about your personal data and the rationale behind it
  • about safeguards in place where data is transferred to a third country or any international organisation

If the information you’re requesting is not about yourself or someone you have a right to make a request on behalf of, your request will be refused.

Redactions and Exemptions

There is some information that we cannot disclose, these exemptions are:

  • personal data relating to other people
  • information which is subject to ongoing court proceedings
  • information which would disclose managerial information or other confidential business information

Retention

Not all information is preserved permanently, although some is kept for a very long period. Ports of Jersey keep a list of the data they need to retain and the duration for which they must do so.

These are kept up to date in accordance with any laws and guidelines relating to the information, such as those that require the preservation of employee records for legal reasons. Moreover, Jersey Archive is given some data for storage or preservation, in line with the Public Records (Jersey) Law 2002.

How much it costs

It will not cost you anything to submit a DSAR, however, if you request more than one copy, we may charge an administration fee.

The process

The Data Protection Team are authorised to process the personal data you supply, which may include sensitive information, in accordance with the Data Protection (Jersey) Law 2018, for all functions connected to the processing of requests. This includes keeping track of communications with you to ensure compliance.

Your request may be shared (along with the personal data you submitted) with the business unit(s) that may hold the necessary data in order to answer your request. We won’t disclose any personal information to anyone outside of Ports of Jersey.

The relevant departments will gather the data and, where necessary, apply any redactions or exemptions. When all the information is ready, a data protection team member will contact you.

Your information will be supplied in a secure way, which will be agreed at the time of release.

Submit a DSAR

Please email the data protection team to submit your request or contact us by post:

Data Protection Officer
Subject Access Request
Ports of Jersey
Jersey Airport
St Peter
JE1 1BY

When making your request please ensure you provide your full name, a contact address (email address and or a postal address) and a clear description of the information you’re requesting, and the time periods covered.

This will help us understand what you’re looking for, identify the information you want and process and source your request more efficiently

You may be asked to provide proof of your identity before the information is sourced and before it’s released.

Timescales

The Data Protection (Jersey) Law 2018 states that the information should be provided without undue delay and within 28 days of receipt of the request. This may be extended by a further 8 weeks in some circumstances, where the information you request is:

  • complex
  • large in volume
  • includes a large timeframe

If this is the case, we will get in touch with you within 28 days of receiving your request to inform you that it will take longer to process. We’ll make every effort to get you your information as quickly as we can.

In order for us to answer more promptly, we may get in touch with you to assist you clarify or improve your information request.

Comments and complaints

If you have a question or a complaint about a DSAR you have made, please email data protection team

Alternatively, you have the right to make a complaint to the JOIC.