JerseyMe digital ID privacy statement

The JerseyMe Digital ID is a Government of Jersey (GoJ) owned digital identification service which enables you to register and access one.gov.je (GOJ online portal). Online services are delivered to you by the Chief Minister's Department on behalf of all GOJ departments and the Parishes.

Jersey Post, through its digital division, Vaiie, has developed, deployed, and are providing technical support for the JerseyMe Digital ID service on behalf of the Government of Jersey. Jersey Post carry out the verification of your identity once you have submitted your information to the Government of Jersey through the portal. Your passport details and video are shared with Jersey Post for them to do this, however, all data is retained by the Government on the Government’s systems. If you ask for support using the JerseyMe online help form, the information in the form will also be shared with Jersey Post. See ‘Jersey Me online help form’ section below for further details.

The Chief Operating Office maintains the one.gov.je website and is registered as a 'Controller' under the Data Protection (Jersey) Law 2018, registration number 56087.

We collect information from you via this website. We process and hold your information to validate your identity on the basis that it is necessary for the exercise of public functions as a public authority. This notice explains how we collect, use, and share your information. Creating a Digital ID with JerseyMe is entirely voluntary so, if you do not wish to share your information with us, you do not have to. You can still access all our services in the usual way, by visiting or contacting the relevant department(s).

This privacy statement is subject to continual review and will be updated to reflect any changes in our services, following feedback from service users, and to comply with any changes to legislation.

For further reading, see the gov.je privacy policy.

What information we collect about you

We will use the information you provide in a manner that conforms to the Data Protection (Jersey) Law 2018. We will not be able to provide you with a JerseyMe Digital ID unless we have enough information or your permission to use that information.

During the process of creating a JerseyMe Digital ID we collect information to:

authenticate your details
check if you are an existing user
validate your passport as a real document
perform a test (known as a liveness test) which records a video selfie of you saying three randomly generated two-digit numbers
verify you are who you say you are by verifying that the information and video selfie you provide as part of the process matches the details on your passport
create your JerseyMe Digital ID

To create a onegov account using the JerseyMe Digital ID, we match the information you have provided for your JerseyMe Digital ID with the record we hold for you in People Directory. People Directory is the Government of Jersey's central repository that holds core and commonly processed data for all residents and non-residents who interact with the Government of Jersey.

People Directory

We update your contact details in People Directory with information you provided for your JerseyMe Digital ID, we may update other details such as your middle name and spelling of you name, where necessary. If you have existing contact details in People Directory this data will be over written. If you want to change your contact details in People Directory, you can use the 'Update your contact details' form on one.gov.je. You must provide your own mobile telephone number and email address and not someone else’s contact details.

Details of the types of information we will collect from you to authenticate your details and how each are used are set out in the table below:

Information collected	How it's used
Full name	To verify against the photograph of your passport you have taken during the JerseyMe registration process.
Date of birth	To verify against the photograph of your passport you have taken during the JerseyMe registration process and to verify that you are over 16.
Contact details (email address and mobile telephone number)	To authenticate we use the contact details to send you a one-time password (OTP) via email and SMS (text message). You therefore must provide your own mobile telephone number and email address and not someone else’s contact details. We also may need to use your contact details for the Government of Jersey’s Customer and Local Services department contact you if your details do not match the information held on People Directory. Email addresses are used to check if you are an existing JerseyMe user and are retained (in GoJ secure applications and in JerseyMe application to enable future logins to the onegov account, facilitate PIN resets and creation of new Digital IDs.
Video selfie	We need to perform a liveness check to make sure that you are a real person. We do this by a video selfie of you saying certain numbers. Three frames are extracted from the video, these are used to verify that the person in the video is the same person as the passport (using a process call biometrics). This data is deleted after the liveness check has been performed.
Passport	We need to validate that your passport is a real document and that it matches the information and video selfie you provided. For this verification we use: full name date of birth passport expiry date country of issue image of the document The image of your passport and data contained within it is deleted after it has been verified.
PIN	To authenticate we ask you to set up a 5-digit PIN, this is stored securely in the PIN safe. PINs are encrypted which is a security measure to protect the actual data.
JerseyMe customer support online help form: name email address contact number issue details	To assist you if you are experiencing an issue with setting up your JerseyMe Digital ID and you have completed the JerseyMe Customer online help form. All information entered in the help form will be sent to Jersey Post who will contact you to provide customer support for JerseyMe. All information entered will be deleted from the Government of Jersey systems at the end of each day once the data has been transferred to Jersey Post. Jersey Post will retain the personal data until it is no longer required to resolve your support issue.

Emails

If you email us, we may keep a record of your email address and a copy of the email, where required in accordance with the relevant retention schedule.

For security reasons we will not include any confidential information about you in any email we send to you. We would also suggest that you keep the amount of confidential information you send to us via email to a minimum or use our secure online services where possible or correspond with us by post.

We will not share your email address or your email contents unless we have your consent or it is necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.

Telephone calls

The Government of Jersey’s Digital Delivery Team do not record or monitor any telephone calls you make to us using recording equipment, although if you leave a message on our voicemail systems your message will be kept until we are able to return your call or make a note of your message. 

The Customer and Local Services department may record telephone conversations for training and monitoring purposes.

Customer and Local Services' privacy policies and retention schedules

File notes of when and why you called may be taken for record keeping purposes. We will not pass on the content of your telephone calls, unless it is necessary for us to do so; either to fulfil your request for a service; to comply with a legal obligation, or where permitted under other legislation.

Jersey Post may record telephone conversations for training and monitoring.

Jersey Post Data Protection

JerseyMe customer support online help form

The Government of Jersey automatically send all information in the JerseyMe customer support online help form to Jersey Post, who provide support for creating a JerseyMe Digital ID.

How long will information be kept for

We will endeavour to keep your information accurate and up-to-date and not keep it for longer than is necessary.

The photograph of your passport and selfie video will only be retained for the length of time necessary to complete the automatic or manual verification and then the passport and video selfie are deleted. Your name and date of birth provided on the form will be replaced with ***** on the evening of verification or after 7 days if the verification cannot be performed. Your JM number, email and mobile telephone number are retained (in GoJ secure applications and in the JerseyMe application) to allow subsequent registration and login checks and OTP to be performed.

If you stop the process of creating a JerseyMe Digital ID before the process is completed, all the information that you provided is retained for 7 days for service performance analysis. After 7 days the passport and video selfie are deleted, the data provided on the form is replaced with *****, email and mobile telephone number are deleted. It is not possible to resume the incomplete process.

In some instances, the law sets the length of time information must be kept. Ask to see our retention schedules for more detail about how long we retain your information.

How we share your information

We may need to pass your information to other GOJ departments or organisations to fulfil your request for a service. These departments and organisations are obliged to keep your details securely, and only use your information for the purposes of processing your service request. At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent. Although, from time to time, we may ask for your feedback on our services based on your experience, or ask you to rate our services, you do not need to give your feedback if you do not want to.

We will not pass any personal data on to anyone outside of the Government of Jersey, other than those who either process information on our behalf, or because of a legal requirement and we will only do so, where possible, after we have ensured that sufficient steps have been taken by the recipient to protect your personal data.

The JerseyMe service is hosted in Jersey, the UK and the EEA and your personal data will not be transferred outside of the European Economic Area/UK.

Automated decision making

The verification of your passport and video selfie will be performed automatically using strict matching criteria and thresholds. The service looks at the image quality and matches the data from the machine-readable zone in the passport (optical character recognition extracts words and information from the image of your passport into text) with the information provided in the application and the video selfie to determine whether the information is valid. The services also assess the audio quality of the video selfie to verify that a human being is reading the correct set of numbers. Any issues or inability to verify the data automatically will, however, be passed to authorised Jersey Post staff to manually review and no decision to reject an application will be made without human intervention.

Data processors

For the creation of a JerseyMe Digital ID, the Government of Jersey use Jersey Post and Vaiie (the Digital Division of Jersey Post) as authorised processors and Jersey Post use authorised sub processors, which are set out in the table below. All the processors are in the European Economic Area/UK.

Sub-processor name	Delegated processing activity
Ziggeo Inc	Performs a liveness test using video and speech to validate that the person being verified is a real person.
Amygdalab Limited	Provides the identity verification application that provides a means for verification of the Customer based on passport or other official documents. The application manages all the information and data required to authenticate the Customer for a purpose to prove they are who they say they are.
Amazon Web Services Rekognition	Compares the image in the passport to a selection of video stills of the person who is completing the verification process.
Regula Forensics UK Ltd	Provides optical character recognition of identity documents to extract words and information from images into text to capture and validate identity information. Regula also provides validation of the document as a real and valid document against a database of template.

The Government of Jersey engage with other third parties who provide service to us to process your personal data on our behalf so that they can provide those services. We have strict contracts in place with all our service providers to ensure they process your data only on our instructions and with appropriate security in place. The categories of third parties who the Government of Jersey engage and receive your personal data to provide us with a service in relation to JerseyMe are:

email and data storage providers such as Microsoft
IT support or security service providers such as Prosperity 24/7
automated SMS providers such as Phronesis

What choices you have

If you do not wish to create a JerseyMe Digital ID, you can still access online services using a Digital ID provided by Yoti. You can also access all our services in the usual way, by visiting or contacting the relevant department(s).

How we protect your information

We work to protect the security of your information by using Secure Sockets Layer (SSL) software, which encrypts information you provide. We maintain physical, electronic, and procedural safeguards in connection with the collection, storage, and disclosure of personally identifiable customer information.

Your rights

See the Government of Jersey website for details of your rights under the Data Protection Law and how to exercise them.

Complaints

You can complain to us about the way your information is being used

If you have an enquiry or concern regarding the processing of your personal data contact the Data Protection Team.

You can also complain to the Jersey Office of the Information Commissioner about the way your information is being used.

If you have questions about this privacy statement you can contact our Data Protection Officer.