VPNs with servers in Jersey

An operator holding or able to obtain communications data must disclose it on a notice from a designated person (art. 26), and keep the notice secret on pain of five years’ imprisonment and a fine (art. 27A). The Law contains no duty to retain communications data for a set period. “Telecommunications service” means providing access to a telecommunication system (art. 1); whether a VPN operator falls within it is not established.

Article 51 of the Telecommunications (Jersey) Law 2002 makes it an offence to send by telecommunication system a message or other matter that is grossly offensive or of an indecent, obscene or menacing character, or to cause one to be sent, and also penalises persistent use of the system intended to cause annoyance, inconvenience or needless anxiety. The penalty is up to two years’ imprisonment and a fine.

Commentary in the Jersey and Guernsey Law Review expects Jersey courts to treat the House of Lords judgment in DPP v Collins on the equivalent section 127 of the Communications Act 2003 as highly persuasive.

To identify a sender, a designated person can issue an art. 26 notice for communications data, which must be necessary and proportionate to what is sought; Schedule 1 lists the public authorities and designated persons.

The Investigatory Powers Commissioner is appointed by the Bailiff from the ordinary judges of the Court of Appeal (art. 43), may require documents and information from office-holders (art. 44(1)), and reports annually to the Bailiff, who may exclude matters from the report laid before the States on grounds that include national security (art. 44(7)). A three-member Tribunal can order a warrant or authorisation quashed (arts. 46, 48).

The Commissioner’s report on 2024, presented to the States on 17 March 2026, recorded 12 interception warrants and 127 communications data authorisations and found the powers used lawfully and proportionately. Jersey has its own legislature, and its laws pass through the UK Ministry of Justice for Royal Assent. The order of the rows is the security score, and a server’s location is not a recommendation.