BWCI Pension Trustees Limited have been reprimanded by the Guernsey Data Protection Authority for not responding to a data subject access request within the required timeframe.
A complaint was made to the Guernsey Data Protection Authority (Authority) in November 2021 and an investigation was conducted. The complaint related to an alleged failure to respond to a data subject access request (the Request) within the designated period, as required by the Law.
The Data Protection Law requires Controllers (in this case, BWCI Pension Trustees Limited), to comply with such a request made by a data subject, which must be complied within one calendar month.
Following the investigation, the Authority determined that the Controller breached the Law by failing to respond appropriately to the Complainant’s Request.
The Controller initially cited concerns about the Request’s legitimacy, whilst acknowledging both a breakdown in its internal processes and a misunderstanding of the Request’s details which resulted in their failure to respond. Additionally, the Authority expresses its disappointment that attempts to resolve this matter informally for the benefit of both parties, proved unsuccessful largely due to the Controller’s lack of engagement over a protracted period of time.
The Authority accepts that the Controller was not ill-intentioned, but nonetheless their process was flawed and their failure to engage was unhelpful.
The Authority issued a Reprimand to BWCI Pension Trustees Limited, reflecting the failures in the way the Complainant’s Request was handled. The Controller had the right to appeal but did not do so.
The Bailiwick’s Data Protection Commissioner, Emma Martins (pictured), commented: “The right of access to data relating to ourselves is one of the pillars of the legislation. All organisations should ensure that they have robust and tested policies and procedures to recognise and
respond to such requests. Engaging with complaints in a positive and timely manner will also reduce the likelihood of further, more formal action being required.
“I am confident that the Controller in this case has reflected on the opportunities to learn from and improve in these respects.”
