I am grateful to Stewart and Laura, of PL&B, for inviting me to reflect on my three years as Jersey Information Commissioner implementing GDPR-based data protection laws in a small jurisdiction. The time has flown by, and I certainly have enjoyed my experience on this unique and remarkable island. I hope that an account of my experience will illustrate the challenges and opportunities that smaller jurisdictions face in establishing an effective data protection regime that meets the world’s highest standard.

As I stated in the September 2018 issue of this publication, my priorities were to meet the data protection goals of the Jersey Data Protection Authority, which reflected the needs of the Jersey community. Jersey implemented GDPR-based data protection laws to ensure a level of data protection equal to Europe, the UK and other Crown Dependencies and to maintain the free flow of personal data with these jurisdictions. For the Jersey Office of the Information Commissioner, this meant building our capacity and capability to meet GDPR requirements for supervisory authorities; ensuring that the Jersey data protection regime meets European standards to maintain the free flow of personal data; and harmonising the regulatory approach to data protection across the Crown dependencies, the UK and European Union.