The DPJL (Article 67) provides that data controllers and processors may only transfer personal data out of the European Economic Area if one of the following conditions are met:

• The transfer is to a jurisdiction which has been held by the European Commission to provide an adequate level of protection for personal data.
• The transfer is made subject to ‘appropriate safeguards’ (Article 68 DPJL), which may include:
  • A legally binding and enforceable instrument between public authorities
  • Binding corporate rules approved by Jersey's Information Commissioner or another competent supervisory authority under the GDPR (or equivalent statutory provisions), or
  • Standard data protection clauses adopted by the Authority or by a competent supervisory authority and approved by the European Commission. It should be noted that the EDPB approved a new set of standard contractual clauses in June 2021, which have now been approved for use in Jersey (subject to also using a Jersey law addendum).  It should be noted that the UK International Data Transfer Agreement has not yet been approved for use in Jersey.
• An exemption applies, the most commonly utilized of which are as follows:
  • The transfer is specifically required by a Jersey court
  • The data subject explicitly consents
  • The transfer is necessary for the performance of a contract to which the data subject is party or the implementation of pre-contractual measures taken at the data subject’s request
  • The transfer is necessary to carry out a contract between the data controller and a third party if the contract serves the data subject’s interests
  • The transfer:
    • Is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings)
    • Is necessary for the purpose of obtaining legal advice, or
    • Is otherwise necessary for the purposes of establishing, exercising or defending legal rights
  • The transfer protects the data subject’s vital interests where:
    • The data subject is physically or legally incapable of giving consent
    • The data subject has unreasonably withheld consent, or
    • The controller or processor cannot reasonably be expected to obtain the explicit consent of the data subject

Transfers post Schrems II

The burden on Jersey controllers and processors of transferring personal data to unauthorised jurisdictions has increased following the CJEU's Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems and intervening parties ("Schrems II").

Following Schrems II, where Standard Contractual Clauses ("SCCs") are used, controllers (and where applicable processors) must ensure that they have considered their transfers and taken any steps appropriate to ensure that they are lawful.

However, the guidance does not provide any assistance as to what steps need to be taken in order to ensure that the chosen safeguards are appropriate. The required approach has since been clarified by the European Data Protection Board which published Recommendations 01/2020 in June 2021 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (see below). There is also local Jersey guidance which broadly tracks (and cross refers to) the EDPB guidance.

The emphasis is on controllers / processors to satisfy themselves that the transfers to unauthorised jurisdictions are properly assessed (taking into account the law and practice of the recipient jurisdiction) and, as appropriate, put in place supplementary measures.

CJEU jurisprudence is not binding in Jersey, as Jersey is not an EU member state. However, it is likely to be persuasive (as is the EDPB guidance noted above).

The EDPB guidance referenced above recommends a 6 step process in relation to international transfers.

1. Know your transfers. Be aware of where the personal data so you know the level of protection provided there. Make sure the data you transfer is adequate, relevant and limited to what is necessary.
2. Verify the transfer tool your transfer relies on.
3. Assess if there is anything in the law and / or practices of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on, in the context of your specific transfer.
4. Identify and adopt supplementary measures necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence. This step is only necessary if your assessment has revealed issues with the third party country's safeguards. If no supplementary measure is suitable, the exporter must avoid, suspend or terminate the transfer.
5. Take any formal procedural steps the adoption of your supplementary measure may require.
6. Re-evaluate at appropriate intervals the level of protection afforded to the personal data you transfer to third countries and monitor if there have been or there will be any developments that may affect it. This is an ongoing duty.

In practice, the above requires a detailed and documented transfer impact assessment ("TIA").

Transfers between Jersey and the USA

The replacement of the Privacy Shield transfer scheme (invalidated by Schrems II) by the EU-US Privacy Data Privacy Framework means that Jersey controllers and processors are in principle able to utilise the new Framework for data transfers. However, the US Department of Commerce is yet to extend the scope of the Framework to cover Jersey and accordingly it is recommended that Jersey controllers and processors continue to utilise standard contractual clauses in respect of transfers between Jersey and the US.

What about the UK?

The European Commission has now recognised the UK as an adequate jurisdiction for the purposes of international data transfer and the UK has in turn recognised Jersey as an adequate jurisdiction for the purposes of the UK GDPR  meaning that transfers to and from the UK and Jersey may continue without restriction.

Jersey controllers and processors who are subject to the UK GDPR by virtue of its extra territoriality provisions will also need to consider whether they may need to continue using the existing standard contractual clauses or the UK International Data Transfer Agreement.