Yoti digital identification application (FOI)

​Request

Pursuant to the Freedom of Information (Jersey) Law 2011, please could you provide information regarding the data processing of biometric data from Yoti digital ID apps by the States of Jersey.

Yoti digital ID

In particular, I wish to request a copy of documentation or communications (electronic version is acceptable - a ‘hard’ / paper copy is not necessary) relating to the measures applied, and safeguards in place, for the processing of children's biometric data by the entity Yoti and the States of Jersey, including personal data relating to persons and their documents issued in the EU (such as national identity cards), and to any biometric data collected, retained and / or processed of any EU citizens and residents.

In addition, please can you provide a copy of any documentation or communications relating to the transfer of children’s personal data for processing in India or any other jurisdictions outside Jersey, and the measures applied, and safeguards in place, for transferring such personal data of children to any other jurisdictions outside the States of Jersey.

Response

There is no data processing of biometric data from Yoti digital ID apps by the Government of Jersey. Yoti is a data controller in their own right.  

Yoti may be willing to provide a response to this question and further questions around data processing should be referred to them directly. As the information requested is not held by the Government of Jersey, Article 3 of the Freedom of Information (Jersey) Law 2011 applies. 

Due to the Government of Jersey having many different agreements in place covering the sharing of personal data, which includes children’s data, combined with the broadness of the request, it would not be possible to supply the individual documents and safeguards in place for all of the different arrangements in the timescale allowed under the Freedom of Information (Jersey) Law 2011. Article 16 of the Freedom of Information (Jersey) Law 2011 therefore applies. 

However, please see attached extraction of the Data Protection Impact Assessment template which covers the copy of documentation relating to the transfer of data and the measures applied.

Data Protection Impact Assessment template

The Government of Jersey is due to commence a piece of work to centralise these records, which will be considered for public release when this is complete. 

Articles applied 

Article 3 - Meaning of "information held by a public authority"

For the purposes of this Law, information is held by a public authority if –

(a) it is held by the authority, otherwise than on behalf of another person; or

(b) it is held by another person on behalf of the authority.

Article 16 - A scheduled public authority may refuse to supply information if cost excessive

(1) A scheduled public authority that has been requested to supply information may refuse to supply the information if it estimates that the cost of doing so would exceed an amount determined in the manner prescribed by Regulations.