Draft Cyber Security (Jersey) Law 202-

Contents

DRAFT CYBER SECURITY (JERSEY) LAW 202Contents
ArticlePART 1

4

INTERPRETATION

4

1Interpretation ................................................................................................................ 4

PART 2

7

ESTABLISHMENT OF COMMISSIONER

7

2
3
4
5
6
7
8
9
10
11
12
13
14

Office of Commissioner for Cyber Security established ................................................ 7
Establishment of Jersey Cyber Security Centre ............................................................. 7
Technical Advisory Councils ........................................................................................... 7
Advice provided by TAC ................................................................................................. 8
Codes of conduct ........................................................................................................... 8
Independence from the Minister and the States .......................................................... 9
Directions and guidance from the Minister ................................................................... 9
Annual report................................................................................................................. 9
Accounts and audit ...................................................................................................... 10
Strategic plan ............................................................................................................... 10
Annual assessment of funding by Minister ................................................................. 11
Limitation of liability .................................................................................................... 11
Fees .............................................................................................................................. 11

PART 3

12

OBJECTIVES AND FUNCTIONS OF COMMISSIONER

12

15
16
17
18
19
20
21
22
23

◊

Objectives of Commissioner ........................................................................................ 12
Functions of Commissioner: single point of contact ................................................... 12
Functions of JCSC as Commissioner’s office: computer security incident response
team ............................................................................................................................. 13
Functions of Commissioner: general ........................................................................... 14
Discharge of Commissioner’s functions by another person ........................................ 14Power to issue guidance in relation to cyber security ................................................. 14Power to set or adopt cyber security standards.......................................................... 15Power to assist in investigations.................................................................................. 15Power to amend this Part by Regulations ................................................................... 16

Page 1

Draft Cyber Security (Jersey) Law 202-

Contents

PART 416

OPERATORS OF ESSENTIAL SERVICES

16

24
25
26
27
28

Identification of OES .................................................................................................... 16
Information notices ..................................................................................................... 17
OES: nominated person to act in Jersey ...................................................................... 17
Review and revocation of designation as an OES ........................................................ 18
Right of appeal in relation to designation as OES........................................................ 19

PART 519

SECURITY DUTIES ON OPERATORS OF ESSENTIAL SERVICES

19

29
30
31
32
33
34
35

Duty to take security measures ................................................................................... 19
Duty to take specified security measures .................................................................... 20
Duty to notify the Commissioner of incidents ............................................................. 20
Duty to inform service users or networks users of incidents ...................................... 21
Duty to take specified security measures in response to incidents ............................ 21
Guidance in relation to this Part .................................................................................. 22Power to amend this Part by Regulations ................................................................... 22

PART 622

ADMINISTRATIVE PROVISIONS

22

36
37

Offences: false or misleading information .................................................................. 22
Information sharing by Commissioner ........................................................................ 23

PART 724

CLOSING PROVISIONS

24

38
39
40

Power to amend this Law by Regulations.................................................................... 24
Consequential amendments ........................................................................................ 24
Citation and commencement ...................................................................................... 24

SCHEDULE 1

25

CONSTITUTION OF JCSC

25

1
2
3
4
5

Appointment and tenure of Commissioner ................................................................. 25
Revocation of appointment of Commissioner ............................................................. 25
Disqualification for appointment, restrictions and exceptions ................................... 25
Appointment of acting Commissioner ......................................................................... 26
Remuneration and pension of Commissioner ............................................................. 26

SCHEDULE 2

27

CONSTITUTION OF TAC

27

1
2
3
4
5
6

◊

Application of Schedule 2 ............................................................................................ 27
Constitution of TAC ...................................................................................................... 27
Appointment of members ........................................................................................... 27
Disqualification for appointment................................................................................. 28
Code of conduct ........................................................................................................... 28
Revocation of appointment ......................................................................................... 28

Page 2

Draft Cyber Security (Jersey) Law 202-

7

Contents

Remuneration of members.......................................................................................... 28

SCHEDULE 3

29

ESSENTIAL SERVICES, CONDITIONS AND THRESHOLD REQUIREMENTS

29

PART 1: ENERGY SECTOR

29

1Electricity subsector..................................................................................................... 29
2
Oil and crude oil based fuel subsector ........................................................................ 29
3
Gas subsector............................................................................................................... 30
PART 2: TRANSPORT SECTOR
30
4
Sea transport subsector ............................................................................................... 30
5
Freight handling subsector .......................................................................................... 31
6Road transport and freight distribution subsector ...................................................... 31
PART 3: BANKING AND FINANCIAL SERVICES SECTOR
31
7Banking subsector ........................................................................................................ 31
8
Financial services ......................................................................................................... 31
PART 4: HEALTH SECTOR
31
9Medical services........................................................................................................... 31
PART 5: WATER SECTOR
31
10Drinking water supply subsector ................................................................................. 31
PART 6: DIGITAL SECTOR
32
11
Public communications subsector ............................................................................... 32
12Managed security service provider subsector ............................................................. 32
PART 7: POSTAL AND COURIER SERVICES SECTOR
33
13
Postal service ............................................................................................................... 33
14
Courier services ........................................................................................................... 33
15
Couriers of necessary supplies .................................................................................... 33
PART 8: FOOD SECTOR
33
16
Food production subsector.......................................................................................... 33
17
Food retail subsector ................................................................................................... 34
18
Food distribution ......................................................................................................... 35
PART 9: PUBLIC ADMINISTRATION SECTOR
35
19
20

Government services ................................................................................................... 35
Emergency services...................................................................................................... 35

SCHEDULE 4

36

CONSEQUENTIAL AMENDMENTS

36

1
2
3

◊

Employment of States of Jersey Employees (Jersey) Law 2005 .................................. 36
Public Employees (Pensions) (Jersey) Law 2014 .......................................................... 36
Telecommunications (Jersey) Law 2002 ...................................................................... 36

Page 3

Draft Cyber Security (Jersey) Law 202-

Article 1

DRAFT CYBER SECURITY (JERSEY) LAW 202A LAW to provide for the establishment and functions of the Jersey Cyber Security
Centre, and for connected purposes.
Adopted by the States
Sanctioned by Order of His Majesty in Council
Registered by the Royal Court
Coming into force[date to be inserted][date to be inserted][date to be inserted][date to be inserted]

THE STATES, subject to the sanction of His Most Excellent Majesty in Council, haveadopted the following Law –PART 1
INTERPRETATION
1Interpretation(1)

In this Law –“administration of the States” has the meaning given in Article 1 of the
Employment of States of Jersey Employees (Jersey) Law 2005;“Commissioner” means the person appointed to hold the office of Commissioner
for Cyber Security (see Article 2);“CSIRT” has the meaning given in Article 17(1);“CSIRTs network” means the network established under Article 12(1) of Directive(EU) 2016/1148 of the European Parliament and of the Council concerning
measures for a high common level of security of network and information systems
across the Union (L194/1);“cyber attack” means malicious or unauthorised activity that attempts to collect,disrupt, deny, degrade or destroy information system resources or the information
itself;“cyber security” means the activities necessary to protect network and information
systems, the users of those systems, and other persons affected by cyber threats;◊

Page 4

Draft Cyber Security (Jersey) Law 202-

Article 1“cyber threat” means any potential circumstance, event or action that could
damage, disrupt or otherwise adversely affect network and information systems,
the users of those systems and other persons;“electronic communications network” means –(a) a transmission system to convey, by the use of electrical, magnetic orelectro-magnetic energy, signals of any description;(b) any of the following that are used, by the person providing the system and inassociation with it, to convey the signals –(i)apparatus comprised in the system,(ii)

apparatus used for the switching or routing of the signals,(iii)

software and stored data,(iv) other resources, including network elements that are not active;“electronic communications service” means a service of any of the following types
provided by means of an electronic communications network, except so far as it isa content service –(a)an internet access service;

(b)
(c)

a number-based interpersonal communications service; andany other service consisting of, or having as its principal feature, theconveyance of signals, such as a transmission service used for machine tomachine services;“essential service” means –(a)the services specified in Schedule 3; and(b)

any other service which is essential for –(i)
the infrastructure of Jersey, or(ii) the maintenance of critical societal or economic activities in Jersey;“financial year” means the period beginning with the day on which this Law comes
into force and ending with 31st December of that year, and each subsequent periodof 12 months ending with 31st December;“incident” means an event compromising the availability, authenticity, integrity or
confidentiality of stored, transmitted or processed data or of the services offeredby, or accessible via, network and information systems;“JCSC” means the Jersey Cyber Security Centre established under Article 3;“Minister” means the Minister for Sustainable Economic Development;“network and information system” means –(a) an electronic communications network;(b)

any device or group of interconnected or related devices, of which at least
one performs automatic processing of digital data under a program; or(c)digital data stored, processed, retrieved or transmitted by the network or
device for the purposes of operation, use, protection and maintenance of the
network or device;“OES” means “operators of essential services” defined in Article 24(1);“public administration” means –◊(a)a Minister;(b)a parish of Jersey;
Page 5

Draft Cyber Security (Jersey) Law 202-

Article 1(c)(d)

an administration of the States (including a department of the States);a Department referred to in Article 1(1) of the Departments of the Judiciaryand the Legislature (Jersey) Law 1965; or(e)a body having functions under an enactment;“relevant law enforcement authorities” means –(a)the States of Jersey Police Force;(b)

the Honorary Police;(c)

the National Crime Agency of the United Kingdom;(d)a public authority not falling within sub-paragraphs (a) to (c) with functionsin any part of the British Islands which consist of or include the investigationof crimes or the charging of offenders;(e)a person with functions in a country or territory outside Jersey which –(i)correspond to those of a police force, or

(ii)

(f)

otherwise consist of or include the investigation of conduct contrary to
the law of that country or territory, or the apprehension of persons
guilty of such conduct; anda person with functions under an international agreement that consist of or
include the investigation of conduct, or the apprehension of persons guilty of
conduct, that is –(i)unlawful under the law of one or more places,

(ii)
(iii)

prohibited by an international agreement, or
contrary to international law;“risk” means the potential for loss or disruption caused by an incident, expressed as
a combination of the magnitude of the loss or disruption and the likelihood of
occurrence of the incident;“security of network and information systems” means the ability of network andinformation systems to resist, at a given level of confidence, any event that may
compromise the availability, authenticity, integrity or confidentiality of stored,transmitted or processed data or of the services offered by, or accessible through,those network and information systems;“SPOC” is the single point of contact defined in Article 16(1);“TAC” means a Technical Advisory Council set up under Article 4;“top-level domain name registry” or “TLD name registry” means an entity that, inrespect of a specific top-level domain –

(2)

◊

(a)

administers and operates the registration of internet domain names under thatdomain;(b)

operates the domain’s name servers;(c)maintains the databases of the domain; or(d)distributes the top-level domain zone files across name servers.

The Minister may by Order amend this Article to make alternative or
supplementary provision about the definitions of expressions used in this Law.

Page 6

Draft Cyber Security (Jersey) Law 202-

Article 2

PART 2ESTABLISHMENT OF COMMISSIONER
2

Office of Commissioner for Cyber Security established(1)

An office to be known as the Commissioner for Cyber Security is established.

(2)

The office of Commissioner is a corporation sole with perpetual succession.

(3)

The Commissioner is the chief executive officer of the JCSC.

(4)The Commissioner may –(a)enter into agreements;(b)acquire, hold and dispose of movable or immovable property;

(c)
(d)

sue and be sued in civil proceedings;
if charged with an offence, defend criminal proceedings;(e)determine and charge reasonable sums for anything done or provided by the
JCSC in the discharge of, or in connection with, the functions of theCommissioner (see Article 16); anddo anything reasonably necessary or expedient for or incidental to any of theCommissioner’s functions.

(f)

3

(5)

Schedule 1 makes further provision in respect of the Commissioner.

(6)

The States may by Regulations amend Schedule 1.

Establishment of Jersey Cyber Security Centre
(1)
(2)

(3)

4

There is established the Jersey Cyber Security Centre (“the JCSC”).
The function of the JCSC is to support the Commissioner in fulfilling theCommissioner’s duties and functions, and anyone working for the JCSC does sounder the full operational control of the Commissioner.
Employees of the JCSC, other than the Commissioner, are States’ employees
within the meaning of Article 2 of the Employment of States of Jersey Employees(Jersey) Law 2005 and any States’ employee provided to the Commissioner under
Article 12 who performs a function under the Commissioner’s direction is treatedas an employee of the JCSC.

Technical Advisory Councils
(1)

(2)
(3)

◊

A Technical Advisory Council (“TAC”) is a body established to advise theCommissioner in relation to matters which relate to –(a)the Commissioner’s responsibilities or functions under this Law;(b)cyber security in Jersey; or(c) cyber security matters outside Jersey that may affect Jersey.
The Commissioner must establish at least one TAC as soon as is practicable and nolater than 6 months after the commencement of this Law.
The first TAC established under this Article must be established for the purpose ofgeneral oversight of the work of the Commissioner.

Page 7

Draft Cyber Security (Jersey) Law 202-

5

(4)

The terms of reference for each TAC must –(a) contain the specific areas of cyber security for which that TAC is
responsible; and(b) be published on the JCSC website no later than 3 months after the TAC isestablished.

(5)

Schedule 2 makes further provision in relation to TACs.

Advice provided by TAC(1)

A TAC must provide advice when requested by the Commissioner to do so.

(2)

The advice must be provided in accordance with the terms of reference for that
TAC.

(3)

If the Commissioner decides not to follow the advice –(a)(b)

the Commissioner must give reasons, in writing, to the TAC; andthe TAC may provide the advice and the Commissioner’s reasons to the
Minister, if the TAC considers that the Commissioner’s decision is –
(i)

(4)

6

Article 5erroneous, and(ii) harmful to the interests of Jersey.
If the Commissioner considers that the advice is in the public interest, theCommissioner may use the advice to produce guidance under Article 35.

Codes of conduct(1)

The Commissioner must, no later than 3 months after the Commissioner’s
appointment, produce and publish on the JCSC website –(a) a code of conduct for employees of the JCSC (the “JCSC code of conduct”);
and

(2)

(b) a code of conduct for members of a TAC (the “TAC code of conduct”).
But a TAC code of conduct must not be published if, in the opinion of theCommissioner, its publication would jeopardise national security.

(3)

An employee of the JCSC must abide by the JCSC code of conduct.

(4)

In the event that the JCSC code of conduct is inconsistent with a code of practiceissued under Article 8 of the Employment of States of Jersey Employees (Jersey)
Law 2005, the JCSC code of conduct takes precedence.

(5)

A member of a TAC must abide by the TAC code of conduct and act in accordancewith the terms of reference for that TAC.
Before producing the JCSC code of conduct, the Commissioner must consult the
Minister and the employees of the JCSC.

(6)
(7)

Before producing a TAC code of conduct, the Commissioner must consult the
Minister and the members of the TAC.

(8)

When consulting on a code of conduct under paragraph (6) or (7), theCommissioner must allow 28 days, starting on the day of the consultation, for
responses.

◊

Page 8

Draft Cyber Security (Jersey) Law 202-7

Independence from the Minister and the States(1)

The Commissioner, the TACs and the JCSC are independent of the Minister andthe States.

(2)

In exercising the responsibilities and functions conferred under this Law, theCommissioner, the TACs and the JCSC must act independently and in a manner
free from direct or indirect influence, whether from a public administration, aMember of the States or any other person, unless the public administration or
person is acting under this Law.
The Commissioner, TACs and the JCSC, in exercising the responsibilities andfunctions under this Law, must act with professional independence.

(3)

8

9

Article 7

Directions and guidance from the Minister(1)

The Minister may give directions or guidance to the Commissioner if the Ministerconsiders that doing so is in the public interest and will not compromise theindependence of the Commissioner.

(2)

Before giving directions or guidance under this Article, the Minister must first
consult the Commissioner and any other person that the Minister considers
appropriate.

Annual report(1)

The Commissioner must produce a report on the exercise and performance of thefunctions of the Commissioner in relation to each financial year (an “annual
report”).

(2)

The annual report must include –(a)the annual accounts (as defined by Article 10);

(b)
(c)

a report on the activities of the JCSC in the preceding year;
a report setting out, in anonymised format, all mandatory incidents reported
to the JCSC under Article 31;(d)

a report from each TAC setting out the advice and reports given to theCommissioner during the preceding year; andany other statements or reports relevant to the exercise of the functions of theCommissioner that the Commissioner considers appropriate.

(e)
(3)

But the annual report must not include –
(a)
(b)

(c)
(4)

◊

confidential information;
information which may prejudice –(i)the security of those providing information,

(ii)
(iii)

the commercial interests of those providing information,
the prevention of crime, or(iv)

national security;

information that directly or indirectly identifies any individual.

The Commissioner must present the annual report to the Minister no later than
3 months after the end of the financial year to which it relates.

Page 9

Draft Cyber Security (Jersey) Law 202-

(5)
(6)
(7)

10

The Minister must present a copy of the annual report to the States no later than
2 months after receiving it.
The JCSC must publish each annual report as soon as reasonably practicable after
it has been presented to the Minister.
The Minister may by Order amend this Article and Article 10 to make further oralternative provision with regard to the annual report and accounts.

Accounts and audit(1)

The Commissioner must –(a)keep proper accounts and proper records in relation to those accounts;(b)

prepare accounts in respect of each financial year (“annual accounts”); and(c)ensure that the annual accounts are prepared in accordance with generally
accepted accounting minimum standards and show a true and fair view of –
(i)

(2)
(3)

11

Article 10

the profit or loss of the JCSC for the financial year to which they
relate, and(ii) the state of the JCSC’s affairs at the end of that financial year.
The Commissioner must appoint auditors who are approved by the Comptroller
and Auditor General to audit the annual accounts.
Paragraph (2) does not require the audit of the annual accounts if they are includedin the accounts of the States for a financial year, and the annual financial statement
in respect of the accounts of the States is audited under Article 12 of theComptroller and Auditor General (Jersey) Law 2014.

Strategic plan
(1)

(2)
(3)

The Commissioner must, in respect of each 3-year period, prepare a plan (a“strategic plan”) setting out how the Commissioner proposes to perform theirfunctions during the 3-year period.
The strategic plan must be presented to the Minister no later than 3 months before
the commencement of the 3-year period to which the plan relates.
The Commissioner may, at any time during a 3-year period, review the strategicplan for the period and present to the Minister a revised strategic plan.

(4)

A revised strategic plan must be presented to the Minister no later than 3 months
before the commencement of the 3-year period to which the revised strategic plan
relates.

(5)

If a new Commissioner is appointed within a 3-year period, that Commissioner
may present to the Minister a new strategic plan no later than 3 months after thedate of the Commissioner’s appointment, and the new strategic plan will haveeffect until the end of the 3-year period within which it is presented.
In the case of the first Commissioner appointed under this Law, that Commissioner
must present to the Minister the first strategic plan no later than 6 months after thisLaw comes into force.

(6)

(7)

A strategic plan prepared under this Article must be approved by the Minister andpublished no later than 2 months after it is approved.

(8)

In this Article “3-year period” means –◊Page 10

Draft Cyber Security (Jersey) Law 202-

12

(a)

in relation to the first strategic plan prepared under this Article, the period
from the date the plan is prepared 31st December in the year that is 3 years
after the date the plan is prepared; and(b)in relation to subsequent strategic plans, the period from the 1st January of
the first year of the plan to 31st December of the third year of the plan.

Annual assessment of funding by Minister(1)

The Minister must make an annual assessment of the funding required by theCommissioner and the JCSC.

(2)

In making an annual assessment, the Minister must consider the funding required
to ensure that the Commissioner has the financial and administrative resources, andother support including employees, services, equipment and accommodation,necessary to enable the Commissioner, the JCSC and the TACs to discharge theirfunctions under this Law effectively and efficiently.
Before the Minister submits an amount in respect of the Commissioner and the
JCSC to the Council of Ministers under Article 10(1)(d) of the Public Finances(Jersey) Law 2019, the Minister must consult the Commissioner.

(3)

(4)

13

The States may by Regulations amend this Article.

Limitation of liability(1)

The Commissioner, the employees of the JCSC or the members of a TAC are notliable in damages for any act done in the discharge, or purported discharge, of anyof their functions under this Law.

(2)Paragraph (1) does not apply –
(a)
(b)

14

Article 12

if it is shown that the act was done in bad faith; orto prevent an award of damages made in respect of an act on the grounds thatthe act was unlawful as a result of Article 7(1) of the Human Rights (Jersey)
Law 2000.

Fees
(1)

If the JCSC provides a service to a person, the Commissioner may charge a fee,
agreed between the Commissioner and the person, commensurate with the time or
cost expended by the JCSC in the provision of the service.

(2)

A fee charged under paragraph (1) must be paid in the manner specified by theCommissioner.
A fee required to be paid under this Article is recoverable as a civil debt due to theCommissioner.

(3)◊

Page 11

Draft Cyber Security (Jersey) Law 202-

Article 15

PART 3OBJECTIVES AND FUNCTIONS OF COMMISSIONER
15

Objectives of Commissioner
(1)
(2)

(3)

The objectives of the Commissioner are to prepare for, protect from, defend
against, and facilitate recovery from, cyber threats or cyber attacks affecting Jersey.
The Commissioner must so far as reasonably practicable administer the operationof this Law and exercise its functions in a way that –(a)is compatible with the Commissioner’s objectives; and(b)

the Commissioner considers most appropriate for the purposes of furthering
the objectives.

For the purposes of paragraph (1), a cyber threat or a cyber attack affects Jersey
if –
(a)

it affects –(i)

the States of Jersey,(ii)

an administration of the States,

(iii)
(iv)

(b)
(4)

In this Article –(a) “relevant person” means a person, other than an external entity, having aplace of business or address in Jersey;
(b)

(5)

16

a relevant person,
an operator of an essential service not otherwise falling within thissub-paragraph,(v) an individual present in Jersey not otherwise falling within this subparagraph, regardless of whether the individual is ordinarily resident
in Jersey; or
it results, or may result, in reputational, political, economic or wellbeingrisks to Jersey.

“external entity” means a person that –(i)

is not an individual,

(ii)
(iii)

has a place of business or an address outside Jersey, andhaving regard to the extent to which their business is carried on in andoutside Jersey, the Minister considers a cyber attack in respect of theperson would not be material to Jersey.

The Minister may by Order amend paragraphs (3) and (4).

Functions of Commissioner: single point of contact(1)

The Commissioner is the single point of contact (the “SPOC”) for Jersey on the
cyber security of network and information systems.

(2)

As the SPOC for Jersey, the Commissioner may –(a)◊consult and co-operate, as the Commissioner considers appropriate, with –(i)relevant law enforcement authorities, and(ii)

relevant regulatory bodies in Jersey;
Page 12Draft Cyber Security (Jersey) Law 202-(b)

co-operate with a designated competent authority to enable them to fulfil
their obligations under this Law;(c)

if the Commissioner considers it appropriate to do so, liaise with –(i)the relevant authorities in the United Kingdom, any member State of
the European Union, and any other country or territory,(ii)

the group established under Article 11(1) of Directive (EU) 2016/1148
of the European Parliament and of the Council concerning measures
for a high common level of security of networks and information
systems across the Union, and(iii)

the CSIRTs network.

(3)

Nothing in this Article affects a duty on a person to make a report under any otherenactment.

(4)

In paragraph (2)(b), “designated competent authority” means –
(a)
(a)

(5)

17

Article 17

a Minister designated as a competent authority under Article 4 of theEmergency Powers and Planning (Jersey) Law 1990; orthe Information Commissioner appointed under Article 5 of the Data
Protection Authority (Jersey) Law 2018.

In paragraph (2)(c), “relevant authority” –(a) in relation to the United Kingdom and a member State of the European
Union, means its SPOC, CSIRT and national competent authority;(b) in relation to any other country or territory, means its SPOC, CSIRT andnational competent authority, or any other body which appears to theCommissioner to perform a substantially similar function.

Functions of JCSC as Commissioner’s office: computer security incident
response team
(1)

The JCSC, as the office of the Commissioner, is the computer security incident
response team (the “CSIRT”) for Jersey, and as CSIRT has the functions describedin paragraphs (2) to (6).

(2)

The JCSC must, as far as is reasonably practicable –(a)monitor and scan publicly accessible network and information systems toidentify malicious activity, vulnerabilities and configuration errors; and

(b)
(3)

take the action it considers necessary to resolve the vulnerabilities,
configuration errors, or cyber threats arising from them.
The JCSC must take reasonable steps to understand current global cyber threats
and how these may affect Jersey, and take any action it considers necessary in
response to those threats.

(4)

The JCSC must take reasonable steps to –◊(a)raise awareness in Jersey of cyber threats, the risks arising from them,
responses and mitigations;(b)enable and promote the sharing of cyber security information in Jersey;

(c)
(d)

enable, provide and co-ordinate the delivery of cyber security services;increase the level of cyber resilience in Jersey to reduce the risk, and impact,of incidents.

Page 13

Draft Cyber Security (Jersey) Law 202-

18

19

(5)

The JCSC must represent Jersey’s cyber security interests within Jersey andinternationally, including by participating in international co-operation networks
including the CSIRTs network.

(6)

The JCSC may advise any person affected or potentially affected by a cyber attack
or threat of a cyber attack.

(7)

In undertaking its function under paragraph (2), the JCSC may –(a)(b)

analyse information received by it relating to incidents affecting Jersey;
take any action it considers necessary to mitigate, or assist in the mitigationof, the effect of those incidents; and(c)advise any person affected or potentially affected by an incident.

Functions of Commissioner: general(1)

The Commissioner has the functions conferred on the Commissioner under thisLaw or transferred to the Commissioner under another enactment.

(2)

The Commissioner may advise the Minister on matters relating to cyber security,
whether on request or otherwise.

(3)

The Minister may by Order amend this Article to make additional or supplemental
provision in relation to the functions of the Commissioner.

Discharge of Commissioner’s functions by another person
(1)

(2)

The Commissioner may fully or partly discharge a function by entering into anagreement with another person, on terms that the Commissioner thinks fit, underwhich that other person fully or partly discharges the function.
But the Commissioner may not enter into an agreement under paragraph (1) unlessthe Commissioner is satisfied that –
(a)
(b)

(3)

(4)

it is appropriate to do so; andthe other person has the expertise and resources necessary to discharge thefunction.

If the Commissioner enters into an agreement under paragraph (1) –
(a)
(b)

20

Article 18

that does not prevent the discharge of the function by the Commissioner; andthe Commissioner remains responsible for ensuring that the function is fullydischarged.

The Commissioner is not required to discharge a function under this Law if anotherperson is required by any enactment to discharge a function that has the same or
substantially the same effect.

Power to issue guidance in relation to cyber security(1)

The Commissioner may issue guidance in relation to cyber security, including in
relation to the exercise of their functions under this Part, and may revise and reissue that guidance.

(2)

Guidance issued or reissued under paragraph (1) must be published in any mannerthat the Commissioner considers likely to bring it to the attention of the persons towhom it is addressed.

◊

Page 14

Draft Cyber Security (Jersey) Law 202-(3)

Before issuing or reissuing guidance under paragraph (1), the Commissioner may –
(a)
(b)

21

seek advice from a TAC; orconsult the regulators or other people that the Commissioner considers
appropriate.

Power to set or adopt cyber security standards(1)

The Commissioner may set or adopt standards in relation to cyber security (“cybersecurity standards”).

(2)

The Commissioner may revise cyber security standards set under paragraph (1).

(3)

Before setting or revising cyber security standards the Commissioner may –

(4)
(5)
(6)

22

Article 21(a)seek advice from a TAC; and(b)consult –(i)the Minister,(ii)

the regulators that the Commissioner considers appropriate, and(iii) any other person the Commissioner considers appropriate.
The Commissioner must publish cyber security standards set or revised under this
Article.
If the Commissioner adopts cyber security standards it must publish that fact.
When publishing cyber security standards or their adoption, the Commissioner
must –(a) specify the persons, or class of persons, to whom the Commissioner
considers the cyber security standards should apply; and(b) publish them in any manner that the Commissioner considers likely to bringthem to the attention of those persons or that class of person.

Power to assist in investigations(1)

The Commissioner may assist in an investigation into or relating to cyber security
being carried out by a person mentioned in paragraph (3) at the request of that
person.

(2)

The Commissioner may only assist if they are satisfied that the assistance isconsistent with the Commissioner’s objectives and functions.

(3)

The persons mentioned in this paragraph are –◊(a)the Information Commissioner, appointed under Article 5(1) of the Data
Protection Authority (Jersey) Law 2018;(b)

the Jersey Financial Services Commission, established under Article 2 of the
Financial Services Commission (Jersey) Law 1998;(c)

the States of Jersey Police Force;(d)the Jersey Competition Regulatory Authority, established under Article 2 of
the Competition Regulatory Authority (Jersey) Law 2001;(e)

any other person the Commissioner considers appropriate.

Page 15

Draft Cyber Security (Jersey) Law 202-23

Article 23

Power to amend this Part by Regulations
The States may by Regulations amend any provision of this Part (other than this Article)
to make alternative or supplementary provision about the functions of the Commissioner
that the States considers appropriate.

PART 4OPERATORS OF ESSENTIAL SERVICES
24

Identification of OES(1)

A person is an operator of an essential service (an “OES”) for a sector or subsector
specified in Schedule 3 if –(a)they are –
(i)
(ii)

(b)
(2)

taken to be designated as an OES under paragraph (2) for that sector
or subsector, ordesignated as an OES under paragraph (5) for that sector or subsector;
andthat designation has not been revoked under Article 27 or 28.

A person is taken to be designated as an OES for a sector or subsector if –(a) they provide a service in Jersey of a kind specified in Schedule 3
corresponding to that sector or subsector;
(b)
(c)

(3)
(4)

the provision of that service relies on network and information systems; andthey satisfy any threshold or condition specified in Schedule 3 in relation tothat sector or subsector.
A person who falls within paragraph (2) must give written notice to the Minister ofthat fact.
A notification required under paragraph (3) must be given –(a) in the case of a person who falls within paragraph (2) on the date on which
this Article comes into force, before the end of the period of 28 days
beginning with that date;
(b)

(5)

in any other case, before the end of the period of 28 days beginning with thedate on which the person first falls within paragraph (2).

Paragraphs (7) and (8) apply if a person is not designated under paragraph (2) but –(a)provides a service in Jersey of a kind specified in Schedule 3 corresponding
to that sector or subsector;

(b)
(c)
(6)

◊

the provision of that service relies on network and information systems; andin the opinion of the Minister, an incident would have or is likely to have asignificant disruptive effect on the provision of that service.
In determining whether paragraph (5)(c) is met in relation to the provision of aservice, the Minister must have regard to the following factors –(a)the number of users relying on the service;(b)

the degree of reliance of the other relevant sectors on the service;

Page 16

Draft Cyber Security (Jersey) Law 202-

(7)

(c)

the likely impact of incidents on the service, in terms of its degree andduration, on economic and societal activities or public safety;(d)the market share of the service;(e)

the geographical area that may be affected if an incident affects the service;(f)

the importance of the provision of the service for maintaining a sufficientlevel of that service, taking into account the availability of alternative meansof provision of that service;(g)the likely consequences for the security of Jersey if an incident affects theservice; and(h)any other factor the Minister considers appropriate.

The Minister may in relation to a person to whom paragraph (5) applies –
(a)
(b)

(8)

(b)

have regard to any representations received under paragraph (7)(b) before
deciding if the person should be designated as an OES; andif the Minister decides to make the designation, give the person written
notice, with reasons, no later than 28 days after making the decision.

Information notices
(1)

(2)

The Minister may by notice in writing served on a person (an “information notice”)
require the person to provide the Minister with any information the Minister
reasonably requires to assist the Minister in determining whether –(a)the person meets a threshold specified in Schedule 3; or(b)

the person falls within Article 24(5).

An information notice must –(a) describe the information that is required by the Minister;
(b)
(c)

(3)

(4)

26

give the person written notice that the Minister intends to designate them as
an OES, with reasons; andgive them 28 days to submit written representations about the proposed
designation.

The Minister must –(a)25

Article 25

give the Minister’s reasons for requesting the information;
specify the time within which, and the form and manner in which, therequested information must be provided.

A person who, without reasonable cause, does not comply with the requirements ofan information notice commits an offence and is liable to a fine of level 3 on thestandard scale.
The Minister may withdraw an information notice by giving written notice to theperson on whom the information notice was served.

OES: nominated person to act in Jersey(1)◊This Article applies if an OES has its head office outside Jersey and –(a) provides an essential service for the energy sector (see Part 1 of Schedule 3)or the digital sector (see Part 6 of Schedule 3); or

Page 17

Draft Cyber Security (Jersey) Law 202-(b)

Article 27

provides an essential service for any other sector mentioned in Schedule 3,and has been notified in writing by the Minister that this Article applies to
them.

(2)

The OES must give written notice to the Minister of a person in Jersey authorisedby the OES to act on their behalf under this Law (the “authorised person”).

(3)

A notification under paragraph (2) –(a) must include the name of the OES, the name, address and contact details(including email address and telephone number) of the authorised person;
and
(b)

(4)

(5)

(6)

27

must be given no later than the end of the period of 28 days beginning withthe date on which the OES became an OES, whether under Article 24(2) or(5).
The OES must notify the Minister in writing of any change to the information
notified under paragraph (3)(a) as soon as practicable and in any event no later thanthe end of the period of 7 days beginning with the date on which the change tookeffect.
The Minister or the Commissioner may contact the authorised person instead of orin addition to the OES, for the purposes of carrying out the Minister’s or theCommissioner’s responsibilities under this Law.
A nomination under paragraph (2) is without prejudice to any legal action which
could be initiated against the OES.

Review and revocation of designation as an OES
(1)
(2)

(3)
(4)

(5)

(6)

The Minister must maintain a list of OES, and must review that list at least once
every 2 years.
If a person has reasonable grounds to believe that they no longer qualify as an OES
under Article 24, they must notify the Minister in writing as soon as practicableproviding evidence supporting that belief.
If the Minister receives a notification under paragraph (2) the Minister must review
the person’s designation as an OES.
The Minister may revoke the designation of a person under Article 24(2), by noticein writing, if the Minister decides that an incident affecting the provision of therelevant essential service by that person is not likely to have significant disruptive
effects on the provision of the essential service.
The Minister may revoke the designation of a person under Article 24(5), by noticein writing, if the conditions mentioned in that Article are no longer met by that
person.
Before revoking a person’s designation under paragraph (4) or (5) the Ministermust –(a)notify the person in writing of the proposed revocation, with reasons;(b)invite the person to submit representations in writing about the proposed
revocation, within the time specified by the Minister; and(c)consider any representations submitted under sub-paragraph (b).

(7)

In order to make the decision mentioned in paragraph (4), the Minister must haveregard to the factors mentioned in Article 24(6).

(8)

The Minister may delegate the day-to-day maintenance of the list to the JCSC.

◊

Page 18

Draft Cyber Security (Jersey) Law 202-28

Article 28

Right of appeal in relation to designation as OES
(1)

(2)

An OES may appeal to the Court against a decision of the Minister –(a)under Article 24(5) to designate them as an OES;(b)

under Article 27 not to revoke their designation as an OES.

An appeal under this Article must be made by sending the Court a notice ofappeal –(a)(3)

in accordance with Rules of Court; and(b) no later than 28 days after the day on which the decision is made.
A notice of appeal must set out –(a)the provision under which the decision appealed against was taken; and(b)

the grounds of appeal, which must be set out in sufficient detail to indicate –(i)to what extent (if any) the appellant contends that the decisionappealed against was based on an error of fact or was wrong in law, or
both, and

(ii)

(4)
(5)

(6)

to what extent (if any) the appellant is appealing against the exercise
of a discretion by the Minister.
The Court must decide an appeal under this Article by reference to the grounds ofappeal set out in the notice of appeal.
When it determines an appeal under this Article, the Court may –(a)confirm the decision appealed against;(b)quash the decision appealed against in whole or in part;(c)

if it quashes the whole or part of the decision –(i)remit the matter back to the Minister with a direction to reconsider andmake a new decision in accordance with the ruling of the Court, or(ii) substitute for the decision any decision the Minister could have made.
The Court may make such orders as it thinks appropriate, including ancillary orders
and orders as to costs.

(7)
(8)

The Minister must comply with a direction under paragraph (5)(c)(i).
The power of the Court to make Rules of Court under Article 13 of the Royal Court(Jersey) Law 1948 includes power to make rules dealing generally with all mattersof procedure and incidental matters arising in relation to appeals under this Article.

(9)

In this Article “Court” means the Royal Court.

PART 5
SECURITY DUTIES ON OPERATORS OF ESSENTIAL SERVICES
29

Duty to take security measures(1)◊

An OES must implement measures that are appropriate and proportionate for the
purposes of –(a) identifying cyber threats to the security of the network and information
systems on which the provision of their essential service relies;

Page 19

Draft Cyber Security (Jersey) Law 202-

(b)
(c)

(2)

30

31

Article 30

reducing the risk of incidents affecting the security of those network andinformation systems occurring;preparing for the occurrence of such incidents, and preventing andminimising their impact; and(d) ensuring the continuity of their essential service.
The measures implemented under paragraph (1) must ensure a level of security of
network and information systems appropriate to the cyber threat and risk posed.

(3)

The Commissioner may issue guidance on the operation of this Article, including
how to assess the appropriate level of security.

(4)

An OES may have regard to any guidance issued under paragraph (3) whencarrying out its duties under this Article.

Duty to take specified security measures(1)

The Minister may by Order provide that an OES must take specified measures, ormeasures of a specified description, that the Minister considers are appropriate andproportionate for a purpose mentioned in Article 29(1).

(2)
(3)

In this Article, “specified” means specified in an Order under paragraph (1).
Nothing in this Article or an Order under paragraph (1) affects the duty imposed
under Article 29.

Duty to notify the Commissioner of incidents(1)

An OES must notify the Commissioner of an incident that it considers to have hada significant impact on the continuity of the essential service which the OES
provides.

(2)

In determining for the purposes of paragraph (1) whether an incident has asignificant impact on the continuity of an essential service, the OES must haveregard (insofar as it is within the OES’s knowledge) to the following matters inparticular –

(3)

(a)

the number of users affected by the disruption of the essential service;(b)

the duration of the incident; and(c)the geographical area affected by the incident.

A notification under paragraph (1) must include any of the following that is within
the knowledge of the OES at the time notification is given –(a)the operator’s name and the essential service it provides;(b)

the time the incident occurred;

(c)
(d)

the current status of the incident;
the duration of the incident;

(e)
(f)

information concerning the nature and impact of the incident;
information concerning any, or any likely, impact of the incident outside
Jersey; andany other information that the OES considers may be helpful to theCommissioner.

(g)◊

Page 20

Draft Cyber Security (Jersey) Law 202-

(4)

The OES must give the notification required under paragraph (1) as soon asreasonably practicable and no later than 48 hours after the OES becomes aware thatthe incident has occurred.

(5)

The Minister may by Order amend paragraph (4) to vary the time within which a
notification must be given.
The States may by Regulations amend this Article to make further or alternative
provision about the notification of incidents.

(6)

32

Article 32

Duty to inform service users or networks users of incidents
(1)

(2)

On determining that an incident described in Article 31 has occurred, the OES mustbring it to the attention of users who may be adversely affected by the incident –(a)as soon as reasonably practicable after becoming aware of the incident;(b)using clear and plain language; and(c)taking reasonable and proportionate measures to do so.

For the purposes of paragraph (1) –“relevant information” is –(a)the nature of the incident;(b)

the technical measures that it may be reasonably practicable for persons who
use the essential service to take for the purposes of –
(i)
(ii)

(c)

preventing the incident adversely affecting those persons,remedying or mitigating the adverse effect that the incident has on
those persons; andthe name and contact details of a person from whom further information may
be obtained about the incident;“users” means –
(a)
(b)

33

persons who use the essential service; andpersons who use the network and information systems on which theprovision of the essential service relies.

Duty to take specified security measures in response to incidents
(1)

(2)

◊

The Minister, having consulted the Commissioner, may by Order require an OES
to take specified measures in response to –(a)a significant incident or a description of a significant incident that occurs in
relation to a network and information system on which the provision of an
essential service, by the OES, relies;(b)adverse effects of that incident on that network and information system.

An Order under paragraph (1) may –(a)specify the description of adverse effects;(b)

specify the measures, or the description of measures, to be taken –(i)in response to an incident, for the purpose of preventing adverse
effects on the provision of the essential service arising from thatincident,

Page 21

Draft Cyber Security (Jersey) Law 202-

Article 34

(ii)

(3)

(4)

34

in response to an adverse effect, for the purpose of remedying or
mitigating that adverse effect.
But a measure, or description of a measure, may only be specified underparagraph (2)(b) if the Minister considers that taking that measure or a measure ofthat description would be appropriate and proportionate for the purpose for which it
is to be taken.
A person who fails to comply with an Order under this Article is liable to a fine oflevel 3 on the standard scale.

Guidance in relation to this Part
(1)

The Commissioner may publish guidance about the measures to be taken by an
OES under this Part.

(2)

The Commissioner may revise and re-publish guidance published under this
Article.

(3)

Before publishing or re-publishing guidance, the Commissioner may –
(a)
(b)

35

seek advice from a TAC; orconsult –(i)the regulators that the Commissioner considers appropriate, and(ii)

the other persons that the Commissioner considers appropriate.

Power to amend this Part by Regulations(1)

The States may by Regulations –(a) make supplemental or alternative provision about the duties imposed on an
OES under this Part; or
(b)

(2)

make provision for the enforcement of the duties imposed on an OES under
this Part.
Regulations may make the provision referred to in paragraph (1) by amending thisPart.

PART 6ADMINISTRATIVE PROVISIONS
36

Offences: false or misleading information(1)

A person commits an offence if they knowingly or recklessly provide a relevant
person with information that is false or misleading in a material particular –
(a)
(b)

(2)

◊

in purported compliance with a requirement under this Law; orin circumstances in which the person providing the information intends, or
could reasonably be expected to know, that the information would be usedby the relevant person for the purpose of carrying out their functions under
this Law.
A person who commits an offence under paragraph (1) is liable to imprisonment
for a term of 5 years and to a fine.
Page 22

Draft Cyber Security (Jersey) Law 202-

(3)

37

Article 37

In this Article, “relevant person” means –(a)the Minister;(b)

the Commissioner;(c)

the JCSC; or(d)any other person entitled to information under this Law.

Information sharing by Commissioner(1)(2)

A person may disclose information to the Commissioner if the disclosure is madefor the purpose of the exercise of a function of the Commissioner.
Information obtained by the Commissioner in connection with the exercise of one
function may be used by the Commissioner in connection with the exercise of any
other function.

(3)

If both Condition A and Condition B are satisfied –(a) the Commissioner may share information with a body listed inparagraph (5); and(b) that body may share information with any other body listed in thatparagraph.

(4)

For the purposes of paragraph (3) –
(a)

(b)

(5)

(6)

(7)

◊

Condition A is that the information sharing is necessary –(i)for the purposes of the Commissioner’s functions under this Law,(ii)

in the interests of the security of Jersey, or(iii)

for purposes related to the prevention or detection of crime, theinvestigation of an offence or the conduct of a prosecution (whether
inside or outside Jersey); andCondition B is that the information sharing is limited to information that –(i)is relevant and proportionate to the purpose for which it is shared,

(ii)
(iii)

is not confidential information, andis not information that may prejudice the security or commercial
interests of an OES.

The bodies are –(a) a relevant law enforcement authority;(b)a public administration;(c)the CSIRT for any other country or territory;(d) any other person that the Commissioner considers appropriate.
Information shared under paragraph (3) may not be further shared by the personwith whom it is shared under that paragraph for any purpose other than –(a)a purpose mentioned in paragraph (4); and(b)with the consent of the Commissioner.

The Minister may by Order amend paragraph (5).

Page 23

Draft Cyber Security (Jersey) Law 202-

Article 38

PART 7
CLOSING PROVISIONS
38

39

40

Power to amend this Law by Regulations(1)

The States may, by Regulations, amend any provision of this Law (other than this
Article) to make alternative or supplementary provision that appears to the States tobe appropriate.

(2)This Article does not limit any other power to amend this Law by Regulations orOrder.

Consequential amendments(1)

Schedule 4 contains consequential amendments.

(2)

The States may by Regulations amend any enactment (other than this Law) to
make any provision they consider necessary or expedient in consequence of thecoming into force of this Law, or of an amendment to this Law.

Citation and commencement
This Law may be cited as the Cyber Security (Jersey) Law 202- and comes into force on a
day to be specified by the Minister by Order.

◊

Page 24

Draft Cyber Security (Jersey) Law 202-

Schedule 1

SCHEDULE 1(Article 2)

CONSTITUTION OF JCSC
1

2

Appointment and tenure of Commissioner(1)

Subject to the provisions of this Schedule, the Commissioner must hold and vacate
office as Commissioner in accordance with the terms and conditions of their
appointment.

(2)

The Minister must appoint as Commissioner a person who has the appropriatequalifications and experience to discharge the functions of the Commissioner
described in Part 3.

(3)
(4)

The appointment of the Commissioner is a permanent appointment.
Article 2 of the States of Jersey (Appointment Procedures) (Jersey) Law 2018
applies to the appointment of the Commissioner.

Revocation of appointment of Commissioner(1)

The Commissioner ceases to hold office –
(a)

(2)

(3)

(4)
(5)

3

if the Commissioner resigns by giving notice in writing to the Minister as
required under the terms and conditions of their appointment; or(b) if the Commissioner’s appointment is revoked under sub-paragraph (3).
If the Commissioner resigns from office under sub-paragraph (1)(a), the Minister
must, as soon as practicable after receiving that notice of resignation, report it to
the States.
The appointment of the Commissioner may be revoked by the Minister if theCommissioner –(a)has been made bankrupt;(b)

is incapacitated physically or mentally from carrying out their duties or isotherwise unable or unfit to discharge their functions;(c)has been absent from the JCSC for more than 3 months without due cause;(d) is disqualified from holding the office of Commissioner under paragraph 3.
The Minister may suspend the Commissioner while the Minister makes enquiries
or considers matters which may be relevant to the Minister’s decision.
Before suspending the Commissioner or revoking the appointment the Ministermust give notice to –(a)the relevant TAC; and(b)

the Commissioner.

Disqualification for appointment, restrictions and exceptions
A person cannot hold the office of Commissioner if the person –◊Page 25

Draft Cyber Security (Jersey) Law 202-

4

(a)does not hold an appropriate level of security clearance, in the opinion of the
Minister;(b)(c)

is not habitually resident in Jersey;
has been convicted of a criminal offence that is sufficiently serious to cast
doubt on the Commissioner’s ability to carry out the post;(d)has been subject to a finding of gross misconduct at work, whether as
Commissioner or in previous employment.

Appointment of acting Commissioner
(1)

(2)

If there is no Commissioner, or the Commissioner is unable to act, the Minister
may appoint a person (the “acting Commissioner”) to discharge theCommissioner’s functions until a new Commissioner is appointed underparagraph 1, or the Commissioner is again able to act.
The Commissioner may appoint an employee of the JCSC as deputy
Commissioner, and that person is to be treated as Commissioner for the purposes ofthis Law when –
(a)

(3)

5

Schedule 1

the Commissioner is unable to act through incapacity or absence; or(b) there is a vacancy in the office of Commissioner.
An acting Commissioner or a deputy Commissioner must have the appropriatequalifications and experience required to act as, or deputise for, the Commissioner.

Remuneration and pension of Commissioner
The States Employment Board must determine the Commissioner’s –◊(a)remuneration and allowance; and(b)entitlement to a pension, or gratuities.

Page 26

Draft Cyber Security (Jersey) Law 202-

Schedule 2

SCHEDULE 2(Article 4)

CONSTITUTION OF TAC
1Application of Schedule 2This Schedule applies to a TAC established under Article 4.

23

Constitution of TAC(1)(2)

The Commissioner must agree with the Minister terms of reference for the TAC.
The Commissioner and the Minister must review the terms of reference at least
once every 4 years.

(3)

The TAC must consist of at least 3 and no more than 5 members.

(4)

A person may be a member of more than one TAC.

Appointment of members(1)

The Minister must, having received advice from the Commissioner, appoint as
members of the TAC persons who –(a) possess the qualifications, skill and experience necessary to perform thefunctions of a member set out in the terms of reference;
(b)
(c)

(2)

demonstrate a high degree of integrity; andmeet requirements as to security clearance determined by the Minister andthe Commissioner.

Before appointing a person –(a) the Minister must take advice from the Commissioner as to the suitability ofthe person for the role; and(b)

the Minister may require the person to provide information or references that
the Minister reasonably requires to determine the person’s suitability for the
role.

(3)

Each member may be appointed for a term of a minimum of one year and amaximum of 3 years, and is eligible for reappointment for a maximum period of
9 years.

(4)

The Commissioner must appoint a Chair from among the members.

(5)

When appointing a Chair the Commissioner must determine the period of theappointment, which must expire before or on the same date as the person’s
appointment as a member expires.
A person appointed as Chair holds and vacates office in accordance with the termsof their appointment, subject to this Law.

(6)
(7)

The Chair must appoint a member as Deputy Chair, and that person is to be treatedas the Chair for the purposes of this Law when –
(a)
(b)

◊

the Chair is unable to act through incapacity or absence; orthere is a vacancy in the office of Chair.
Page 27

Draft Cyber Security (Jersey) Law 202-4

Schedule 2

Disqualification for appointment
A person cannot be a member of the TAC if the person does not pass or maintainappropriate security vetting, as determined by the Commissioner.

5

6

Code of conduct(1)

Members of the TAC must adhere to the principles set out in the TAC code of
conduct published under Article 6.

(2)

The Minister may suspend a member who, in the Minister’s opinion, has failed to
uphold the code of conduct, pending an investigation of the matter.

Revocation of appointment(1)

The appointment of a member may be revoked by the Minister if –(a)the member is disqualified for appointment under paragraph 3;

(b)
(c)

the member has been made bankrupt;
the member has been convicted of a criminal offence that is sufficiently
serious to cast doubt on the individual’s suitability to carry out the post;is incapacitated physically or mentally from carrying out their duties or isotherwise unable or unfit to discharge their functions;

(d)
(e)
(f)
(2)

(3)

7

the Minister determines, following an investigation under paragraph 4, thatthe member has failed to uphold the code of conduct; orthe member has been unavailable for contact by the Technical Advisory
Council for more than 3 months without due cause.

Before revoking the appointment of a member, the Minister must –(a) give the Commissioner and the member notice of the Minister’s intention to
revoke the appointment; and(b) give the member an opportunity to make representations to the Minister
regarding the proposed revocation (save for revocation under (1)(a)).
If the Minister revokes the appointment of a member, the Minister must inform theCommissioner and the Technical Advisory Council as soon as is practicable.

Remuneration of members
The Minister must determine the remuneration (if any) of the members.

◊

Page 28

Draft Cyber Security (Jersey) Law 202-

Schedule 3

SCHEDULE 3(Article 24)

ESSENTIAL SERVICES, CONDITIONS AND THRESHOLD REQUIREMENTS
PART 1: ENERGY SECTOR
1Electricity subsector(1)

For the essential service of importing electricity, the threshold requirement is thatthe person imported 150 megawatt hours of electricity into Jersey in the previous
financial year, with a view to its delivery to final customers.

(2)

For the essential service of generating electricity, the threshold requirement is thatthe person generated 150 megawatt hours of electricity in the previous financial
year, with a view to its delivery to final customers.

(3)

For the essential services of transmitting and distributing electricity, the thresholdrequirement is that the person operates a transmission system or a distribution
system that –(a)served at least 10,000 final customers in the previous financial year; or(b)

has the potential to disrupt delivery to at least 10,000 final customers.

(4)

For the essential service of selling electricity, the threshold requirement is that theperson sold electricity to at least 10,000 final customers in the previous financial
year.

(5)

In this paragraph –“distribution system” means a system which consists wholly or mainly of lowvoltage lines and electrical plant used for conveying electricity with a view to itsdelivery to final customers;“final customer” means a person in Jersey purchasing electricity for their own use;
“transmission system” means a system which consists wholly or mainly of highvoltage lines and electrical plant used for conveying electricity with a view to itsdelivery to final customers or distributors.

2

Oil and crude oil based fuel subsector
(1)
(2)

(3)

(4)

◊

For the essential service of importing crude oil based fuel, the threshold is that theperson imported at least 5,000,000 litres into Jersey in the previous financial year.
For the essential service of storing crude oil based fuel, the threshold is that theperson operates a facility or facilities with a total capacity of at least 5,000,000
litres.
For the essential service of supplying crude oil based fuel, the threshold is that theperson delivered at least 5,000,000 litres to final customers, or to retail sites with aview to its delivery to final customers, in the previous financial year.
For the essential service of supplying crude oil based fuel, the threshold is that theperson supplied at least 5,000,000 litres to final customers in the previous financial
year.

Page 29

Draft Cyber Security (Jersey) Law 202-(5)

Schedule 3

In this paragraph –“crude oil” means any liquid hydrocarbon mixture occurring naturally in the earth
whether or not treated to render it suitable for transportation, and includes –(a)crude oils from which distillate fractions have been removed; and(b)crude oils to which distillate fractions have been added;“crude oil based fuel” means fuel wholly or mainly comprising crude oil orsubstances derived from crude oil;“final customer” means a person in Jersey purchasing crude oil based fuel for theirown use.

3

Gas subsector(1)

For the essential service of importing liquid petroleum gas (“LPG”), the thresholdrequirement is that the person imported 900,000 cubic metres of LPG into Jersey inthe previous financial year, with a view to its delivery to final customers.

(2)

For the essential service of storing LPG, the threshold is that the person operates afacility or facilities with a total capacity of at least 3,000 cubic metres.

(3)

For the essential service of distributing mains gas, the threshold requirement is thatthe person delivered gas, by the mains gas network –
(a)

(4)

to at least 2,000 final customers in the previous financial year; or(b) with a potential to disrupt delivery to at least 2,000 final customers.
For the essential service of distributing LPG, the threshold requirement is that theperson delivered LPG to at least 2,000 final customers in the previous financial
year.

(5)

For the essential service of selling mains gas or LPG, the threshold requirement isthat the person sold mains gas or LPG to at least 2,000 final customers in theprevious financial year.

(6)

In this paragraph –“final customer” means a person in Jersey purchasing LPG or mains gas for theirown use;“mains gas” means gas suitable to be delivered by the mains gas network;“mains gas network” means the mains, pipes and other apparatus by which mains
gas may be delivered to final customers.

PART 2: TRANSPORT SECTOR
4

Sea transport subsector
(1)

(2)

◊

For the essential service of carrying out harbour operations, the condition is that theperson is a harbour operator licensed under Part 3 of the Air and Sea Ports(Incorporation) (Jersey) Law 2015 to carry out harbour operations.
For the essential service of providing sea transport, the threshold requirement isthat the person provides commercial passenger travel or freight transport or both,
into and out of Jersey by sea and transported 100,000 tonnes of freight or 120,000
passengers in the previous financial year.

Page 30

Draft Cyber Security (Jersey) Law 202-(3)

5

Schedule 3

In this paragraph “harbour operations” has the meaning given in Article 2(3) of the
Air and Sea Ports (Incorporation) (Jersey) Law 2015.

Freight handling subsector
For the essential service of freight handling, the threshold requirement is that the person
loaded or unloaded a total of at least 100,000 tonnes of freight at Jersey ports in theprevious financial year.

6

Road transport and freight distribution subsector
For the essential service of transporting freight by road to and from ports in Jersey, thethreshold requirement is that the person transported at least 100,000 tonnes of freight in
the previous financial year.

PART 3: BANKING AND FINANCIAL SERVICES SECTOR
7

Banking subsector
For the essential service of providing banking and credit services, the condition is that theperson is registered under Part 2 of the Banking Business (Jersey) Law 1991 andregulated by the Jersey Financial Services Commission established under Article 2 of the
Financial Services Commission (Jersey) Law 1998.

8

Financial services
For the essential service of providing financial services, the condition is that the person
carries on a financial service business as defined under Article 2 of the Financial Services(Jersey) Law 1998 and registered under Article 9 of that Law, and regulated by the Jersey
Financial Services Commission.

PART 4: HEALTH SECTOR
9Medical services
Government of Jersey health services provided by health professionals to patients toassess, maintain or restore their state of health, including the prescription, dispensationand provision of medicinal products and medical devices.

PART 5: WATER SECTOR
10Drinking water supply subsector(1)

For the essential service of supplying drinking water, the threshold requirement isthat the person supplied mains water to at least 10,000 final customers in theprevious financial year.

(2)

In this paragraph –◊Page 31

Draft Cyber Security (Jersey) Law 202-

Schedule 3“final customer” means a person in Jersey purchasing mains water for their own
use;“mains water” means drinking water supplied to final customers.

PART 6: DIGITAL SECTOR
11

Public communications subsector(1)

For the essential service of providing public communications, the condition is thatthe person is a public communications provider that holds a Class 2 or Class 3
Licence and provides a service to customers in Jersey.

(2)

In this paragraph –“public communications provider” means –(a)a provider of a public electronic communications network;

(b)
(c)

a provider of a public electronic communications service; ora person who makes available facilities that are associated facilities byreference to a public electronic communications network or a public
electronic communications service;“public electronic communications network” means an electronic communications
network provided wholly or mainly for the purpose of making electronic
communications services available to members of the public;“public electronic communications service” means an electronic communications
service that is provided so as to be available for use by members of the public.

12

Managed security service provider subsector(1)

For the essential service of providing information and communications technology
services, the condition is that the person, by providing assistance or active
administration carried out either on customers’ premises or remotely, provides
services –(a) related to the installation, management, operation or maintenance of
information and communications technology products, networks,
infrastructure, applications or any other network and information systems;
and
(b)

(2)

For the essential service of providing a managed security service provider, thethreshold requirement is that the person –(a) provides a managed service that carries out or assists with activities relating
to cyber security risk management; and
(b)

(3)
(4)
(5)

◊

to another OES in Jersey.

is based in Jersey.

For the essential service of providing cloud computing services, the thresholdrequirement is that the person is based in Jersey.
For the essential service of providing a data centre service, the thresholdrequirement is that the person is based in Jersey.
For the essential service of providing domain names for the internet domain
indicated by the top-level internet domain “.je”, the threshold requirement is that
Page 32

Draft Cyber Security (Jersey) Law 202-

Schedule 3

the person is a top-level internet domain name registrar that provides domainnames.
(6)

In this paragraph –“cloud computing service” means a digital service that enables on-demandadministration and broad remote access to a scalable and elastic pool of shareable
computing resources, including situations in which those resources are distributed
across more than one location;“digital service” means a service that is provided –(a)for remuneration;(b)

at a distance;(c)by electronic means; and(d)at the request of the recipient of the service.

PART 7: POSTAL AND COURIER SERVICES SECTOR
13

Postal service
A postal service (as defined in Article 1(1) of the Postal Services (Jersey) Law 2004)
provided by Jersey Post International Limited or a subsidiary of that company.

14

Courier services
(1)

(2)

15

For the essential service of providing courier services, the threshold requirement isthat the person delivered at least 10,000 items of mail in the previous financialyear.
In this paragraph “mail” has the meaning given in Article 1(1) of the Postal
Services (Jersey) Law 2004.

Couriers of necessary supplies(1)

For the essential service of courier of necessary supplies, the threshold requirement
is that the person delivered necessary supplies to or within Jersey in the previous
financial year.

(2)“Necessary supplies” are –(a)medical supplies (as defined in Article 8A of the Emergency Powers andPlanning (Jersey) Law 1990);(b)

any other supply prescribed by the Minister by Order.

PART 8: FOOD SECTOR
16

Food production subsector
Jersey Dairy Limited.

◊

Page 33

Draft Cyber Security (Jersey) Law 202-17

Schedule 3

Food retail subsector(1)

For the essential service of food retail, the threshold requirement is that theperson –(a)places food on the market; and(b)

operates a shop –(i)that has a retail sales area of 700 square metres or more, and
(ii)

(2)

in which at least 50% of the retail sales area is given over to the saleof food.

In this paragraph –“food” means any substance or product, whether processed, partially processed or
unprocessed that is intended to be, or reasonably expected to be, ingested byhumans; and includes –(a) drink, chewing gum and any substance, including water, intentionallyincorporated into the food during its manufacture, preparation or treatment;and(b)water that –(i)in the case of water supplied from a distribution network, is after the
point within premises at which it emerges from the taps that arenormally used for human consumption,(ii) in the case of water supplied from a tanker, is after the point at which
it emerges from the tanker,(iii) in the case of water put into bottles or containers intended for placing
on the market, is after the point at which the water is put into thebottles or containers, or(iv) in the case of water used in a food-production undertaking, is after the
point where the water is used in the undertaking;But “food” does not include –(a) any substance or product, including additives, whether processed, partiallyprocessed or unprocessed, intended to be used for oral feeding to animals;(b)live animals, unless they are prepared for placing on the market for humanconsumption;(c)plants prior to harvesting;(d)medicinal products within the meaning of Article 2 of the Medicines (Jersey)
Law 1995;(e)cosmetic products, being a substance or mixture intended to be placed incontact with the external parts of the human body or with the teeth and the
mucous membranes of the oral cavity with a view exclusively or mainly tocleaning them, perfuming them, changing their appearance, protecting them,keeping them in good condition or correcting body odours;
tobacco and tobacco products within the meaning of Article A1 of the
Restriction on Smoking (Jersey) Law 1973;
narcotic substances within the meaning of the United Nations Single
Convention on Narcotic Drugs signed at New York on 30th March 1961, or
psychotropic substances within the meaning of the United Nations
Convention on Psychotropic Substances, 1971;

(f)
(g)

◊

Page 34

Draft Cyber Security (Jersey) Law 202-(h)residues or contaminants in or on food;“places on the market” in relation to food means –(a) the holding of food for the purpose of sale, including offering for sale or any
other form of transfer, whether on payment of money or not; or(b)the sale, distribution or other form of transfer of food;“retail sales area” has the meaning given in Article 2 of the Shops (Regulation ofOpening) (Jersey) Regulations 2011.

18

Food distribution
For the essential service of food distribution, the threshold requirement is that the person
supplied food to at least one person described in paragraph 17 in the previous financial
year.

PART 9: PUBLIC ADMINISTRATION SECTOR
19

20

Government services(1)

A parish of Jersey.

(2)

An administration of the States (including a department of the States).

Emergency services(1)

States of Jersey Police Force.

(2)
(3)

Emergency Ambulance Service.
States of Jersey Fire and Rescue Service continued under Article 3 of the Fire andRescue Service (Jersey) Law 2011.
Airport Rescue and Firefighting Service, as defined in Article 1 of the Fire andRescue Service (Jersey) Law 2011.

(4)◊

Page 35