Guidance On Disclosures Of Personal Data To Law Enforcement And Other Competent Authorities
The Gibraltar Regulatory Authority has today published a Guidance Note which aims to provide organisations with information and guidance on the disclosure of personal data to authorities who are are discharging their statutory law enforcement functions.
A statement from the GRA follows below:
The Gibraltar General Data Protection Regulation (“Gibraltar GDPR”) and the Data Protection Act 2004 (“DPA”) allow for this type of sharing where it is reasonable, necessary and proportionate.
The document provides detailed guidance regarding the requirements that must be considered by an organisation before it decides to disclose personal data to a competent authority. This includes identifying a lawful basis under Article 6 of the Gibraltar GDPR for the sharing of data, as well as conditions for the sharing of special category data or data relating to criminal convictions and offences. Guidance is also provided in relation to compliance with the data protection principles at Article 5 of the Gibraltar GDPR, the rights of individuals, and relevant exemptions under the DPA that may be relied on by an organisation for the disclosure of personal data.
The Guidance Note is intended to serve as a reference document, to be consulted as and when necessary, alongside relevant legislation. Organisations are responsible for assessing compliance, and for introducing reasonable and appropriate measures, as applicable.
The Guidance Note is available to download from the GRA’s website: https://www.gra.gi/data-protection/guidance
