Following a complaint made to Guernsey’s Data Protection Authority (ODPA), it was found that Deputy Gentle, in his capacity as an elected States of Alderney public representative, covertly recorded a conversation with the complainant with whom he had met.
The complainant had arranged the meeting to raise concerns regarding a particular ongoing building project and the management of that project.
The recording of that conversation was later shared by Deputy Gentle with a third party who then further disclosed it to an industry governing body, who then used the data to instigate an investigation into the actions of the complainant. (That investigation resulted in a finding of no breach of industry guidelines). The complainant however, considered Deputy Gentle’s actions to have breached his rights and brought his name into disrepute within the business industry.
The ODPA does not dispute the assertion by Deputy Gentle that his actions stemmed from a desire to act in the best interests of the public position he holds. However, the ODPA considers that the same result could have been obtained by recording contemporaneous notes at the meeting or by being open with the complainant and seeking prior agreement to carry out an audio recording.
As a result of the investigation, the ODPA determined that Deputy Gentle breached the Law in relation to the unauthorised collection and disclosure of personal data.
The ODPA has issued Deputy Gentle with a reprimand. This reflects the nature and circumstances of the breach. The finding also reflects the positive and constructive engagement by Deputy Gentle throughout the investigation and his willingness to learn lessons from this experience.
The ODPA acknowledges that appropriate States of Alderney policies were in place which prohibited such data collection practices but were not complied with in this instance.
The ODPA is however, concerned that this matter highlights a general lack of understanding of the Law by elected public representatives and the importance of looking after data, which can often be highly sensitive and confidential. Individuals have a right to expect the highest standards of conduct from those elected to represent them.
The ODPA hopes that by highlighting this case, lessons can be learnt, and future compliance breaches reduced, emphasising the importance that appropriate policies and procedures are not only in place but are also complied with.
Deputy Gentle had the right to appeal this judgement but chose not to do so”.
The Bailiwick’s Data Protection Commissioner, Emma Martins, commented: “Individuals who act in important positions in an official public capacity will inevitably be subject to greater scrutiny of their actions. It is therefore the case that their conduct must at all times reflect the significant responsibilities of the role and the importance of engendering a trust and confidence in them across the community they serve.
“The Deputy recognises that he fell short on this occasion and we are grateful for the open and honest manner in which he engaged with us. This case highlights how important it is not only to ensure policies and procedures around data handling are fit for purpose, but that they are also communicated effectively and complied with”.
Legal Framework
The ODPA may conduct an investigation (under section 68 of the Law) following a complaint, into whether a controller or processor has breached or is likely to breach an operative provision of the Law.
In this case, the controller is Deputy Kevin Gentle. Section 72 of the Law requires the ODPA to determine whether or not there has been a breach of an operative provision of the Law.
The ODPA determined that sections 6,7,8 and 12 of the Law were breached in the collection and disclosure of personal data in this case.
Section 73 of the Law sets out the sanctions that are available to the ODPA where a breach determination has been made.
Having considered the details of this case, the ODPA has imposed a reprimand under section 73(1)(a) of the Law.
Section 84 of the Law provides for an appeal by the controller to the Court against a determination made by the ODPA . Any such appeal must be made within 28 days. The controller has not made an appeal in this case.
This is from a public statement made by the Data Protection Authority (the Authority) under section 64 of The Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law).
“The Law seeks to ‘…promote the rights of individuals in relation to their personal data and provide for the free movement of personal data…’ and the Authority is the independent regulatory body responsible for overseeing it.
