Cyber Security Law

Department	Department for the Economy
Start date	04/03/2024
End date	23/04/2024
Type of consultation	White paper
Deadline for comments	23/04/2024

About the consultation

The Operator of an Essential Service (OES) is defined as any service which is essential for the infrastructure of Jersey or the maintenance of critical societal or economic activities in Jersey.

This consultation asks for your views on the proposed sectors and sub-sectors which will be defined as OESs, and the requirements which will be placed upon them, under the draft Cyber Security (Jersey) Law 202-.

Consultation: Draft Cyber Security (Jersey) Law 202-

Background

The Jersey Cyber Security Centre (JCSC) is responsible for promoting and improving the cyber resilience across the Island’s critical national infrastructure, business communities and citizens to reduce the risk and impact of major cyber incidents in Jersey.

Since 2021, it has operated within the Department for the Economy, and has been funded as part of the Government Plan. The intention is for the JCSC to operate as a grant funded body at arm’s length from regulators, law enforcement officers and government.

In order to establish it as an arm’s length corporation sole, legislation needs to be put in place outlining the scope of the work expected of the JCSC and the associated governance, which includes defining OES and the legal requirements placed upon them.

OES will be defined in the law, but the proposed list includes:

Energy
Transport, sea transport, freight handling, road transport and freight distribution
Banking and financial services
Health including Government of Jersey services
Water providers
Digital Infrastructure
Postal and Courier services
Food
Public Administration

The consultation process

A consultation on proposed cyber defence legislation, which an from December 2022 to January 2023 provided feedback that directly fed into the drafting instructions and law drafting process.

This consultation focuses on obtaining feedback from Operators of Essential Services.

A third consultation, planned for Q3 2024, will focus on how OESs implement what will be required of them when Part 4, Part 5, and Schedule 3 are implemented.

Public meeting dates

Public briefings are being held by the Jersey Cyber Security Centre on:

Thursday 7 March from 5pm to 6.30pm
Friday 7 March from 12pm to 1.30pm

You can register on Eventbrite to attend online, or in person at the JCSC office in Seaton Place.

Sector-specific briefings

If you work in a specific sector, you can attend briefings for:

operators of critical national infrastructure (Wednesday 6 March at 12pm)
operators of essential services (Friday 8 March at 8am)
cyber security professionals (Thursday 14 March at 1pm)

Additional briefings can be arranged with JCSC for specific sectors. Feedback at the briefing events will be anonymised and added to the JCSC's consultation response.

How to submit comments to the consultation

The questions in the consultation paper, and online (below) refer to specific sections of the draft Cyber Security Law:

Part 4 (page 11) - Operators of Essential Services
Part 5 (page 12-13) - Security Duties on Operators of Essential Services
Schedule 3 (page 17) - Essential Services and Threshold Requirements (you are asked to describe which sector and/or sub-sector you represent before answering these questions)

You are also able to submit any other comments you have on the law.

Complete the Jersey Cyber Security Law consultation

You can also submit your response:

by email to Economy@gov.je with the subject heading Cyber Law Consultation
by post to: FAO Elisabeth Blampied, Department for the Economy, 19-21 Broad Street, St Helier, JE2 3RR
by providing feedback at one of the briefing events, which will be anonymised and added to the JCSC's consultation response.

Data Protection

The information you provide will be processed in compliance with the Data Protection (Jersey) Law 2018.

Find more information in the Department for the Economy Privacy Notice.
The Government of Jersey may quote or publish responses to this consultation but will not publish the name and addresses of individuals without consent.

Types of publishing may include:

sending to other interested parties on request
sending to the Scrutiny Office
quoting in a published report
reporting in the media
publishing on the Government website
listing on a consultation summary

Confidential responses will still be included in any summary of statistical information received and views expressed.
Under the Freedom of Information (Jersey) Law 2011, information submitted to this consultation may be released if a Freedom of Information request requires it, but no personal data may be released.