The Challenge
The Government of Jersey (GoJ) sought to protect its citizens from COVID-19. Calligo was asked to ensure the data used in testing and tracing was legally compliant.
The Government of Jersey (GoJ) is responsible for the safety, wellbeing, and security of approximately 100,000 citizens. Located in the Channel Islands, Jersey is a British Crown dependency which is not part of the United Kingdom, nor the EU.
When the global COVID-19 pandemic struck in March 2020, the GoJ needed to act quickly to protect its population. This required new processes – performed at speed and using sensitive data in ways never previously considered nor provisioned for. The GoJ chose to adopt a policy whereby the three key data sources (personal data, medical data and PCR test results) would be kept distinct but integrated.
With the data architecture deployed, the GoJ turned to Calligo to ensure that its practical use in the field was as respectful of data subjects’ rights as its intended design.
The Action
Calligo was appointed as the outsourced DPO by the GoJ during the COVID-19 crisis to ensure personal data protection.
Early in the COVID-19 crisis, Calligo was appointed as the GoJ’s outsourced Data Protection Officer (DPO) to ensure its immediate and ongoing use of personal data adhered to all pertinent obligations.
We used its mix of legal, data governance, security, and technical expertise to guarantee the continuous protection of the personal data of Jersey citizens and visitors in a variety of unprecedented situations.
Our response to COVID-19 was a once in a lifetime challenge of data collection, access, security, privacy and speed……. We needed a team that was experienced enough to appreciate the reasoning behind our data architecture, skilled enough to augment the approach, and then able to help us deploy initiatives off it into the public domain professionally, rapidly, responsibly and ethically – a team like Calligo.
John Quinn
Chief Operating Officer, Government of Jersey
Calligo advised and represented the data subjects’ interests during the COVID-19 response, including the Test and Trace scheme, and worked with the States of Jersey Police and industry associations to define legal frameworks and technical measures to access data while protecting data subjects’ rights.
As the public protection programs evolved, Calligo’s team acted as internal advisor and scrutineer of processes, representing data subjects’ interests throughout the COVID-19 response (including the Test and Trace scheme). In the interests of expediency and public assurance, we actively brought the Jersey Office of the Information Commissioner (JOIC) on board throughout the process, explaining in advance all intentions, reasoning, and risk mitigation. This collaboration led to faster creation of stronger protections of data subjects’ rights.
Sharing data with the States of Jersey Police
In consultation with the JOIC and the States of Jersey Police, our team defined a strict legal framework and Technical and Organizational Measures (TOMs) for its access. This enabled the police to access the GoJ data under well-defined mutually agreed circumstances, supporting their mission to keep the public safe but without infringing the rights of the data subjects.
Cooperation with industry
We worked closely with venues and industry associations to find ways of providing the GoJ with the information required for the tracing scheme, without placing excessive obligations on businesses or unduly affecting their customers’ experience whilst ensuring data subjects’ rights were suitably protected and JOIC approval was retained. We subsequently drafted the official guidance and explanatory materials on behalf of the GoJ, resulting in policies that were legally robust, easily comprehensible, and workable.
Back