Second reprimand issued by Guernsey's Data Protection Authority

The Office of the Data Protection Authority (the Authority) in Guernsey has issued a public reprimand to the States Policy & Resources Committee (P&R) for breach of The Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law) here. This is the second instance of enforcement action being taken under the Law as a matter of public record, the first also being a reprimand issued to P&R in August 2019.

The reprimand has been issued in response to four individual complaints lodged with the Authority under section 67 of the Law, for P&R's failure to provide adequate disclosure to data subjects in accordance with section 12 of the Law (Right to information for personal data collected from data subject).

Specifically P&R did not provide to the data subjects, either before or at the time their personal data was collected, certain information required by schedule 3 of the Law such as who controls the data, the purposes of processing the data, who receives the data, and the data subject's rights.

The Authority specified in their statement that in such instances where any obligation under the Law to provide data subjects with specific information is breached, relevant sanctions will be applied.

On the balance of early admission of the failure, against P&R's reluctance to answer certain questions causing delays in the investigation, the Authority determined that a formal reprimand was the appropriate sanction in this instance.