Data protection: Preparation, planning and privacy is key

These programmes could involve, for example, applications for permission, like the case in point, or feedback solicited for public inquiries, among others.

Commissioner Jay Fedorak said: “While I commend public authorities for promoting transparency of decision making through presenting information in a manner accessible to the public, they must take appropriate precautions to protect personal data. Even in cases where there is a legal requirement for publication, public authorities should develop policies and procedures to prevent the inadvertent disclosure of personal data and ensure that no more information is published than is necessary for the relevant purpose. This is particularly important with respect to sensitive data or information about children and other vulnerable individuals”.

Public authorities should develop an implementation plan prior to launching a public submission programme, as well as for existing programmes. The plan should evaluate whether it is necessary to post personal data to fulfil the objective of the programme. It should consider notification to individuals to give them the opportunity to remove personal data prior to making submissions, in addition to controls to identify personal data and prevent its disclosure, through severing, masking or de-identification.

Commissioner Fedorak highlights that: “Risks to personal privacy resulting from public disclosures of personal data are greater in small, close-knit jurisdictions like Jersey. Public disclosures of sensitive personal data can have devastating effects on lives, particularly of vulnerable individuals. We need to take extra care and attention to avoid causing unnecessary and sometimes irreparable harm to innocent people”.

Organisations can explore JOIC’s data protection guidance and resources online here.