Guernsey’s Data Protection Office has issued a statement relating to its first ever serious breach.
The Office of Data Protection has taken action against one of the States of Guernsey’s key departments.
The statement reads:
- The Data Protection Authority for the Bailiwick of Guernsey (the Authority) has determined that the Policy and Resources Committee (the controller) has breached section 6(2)(a) of the Law.
- The Authority finds that an employee of the Policy and Resources Committee, in the position of manager, made reference to the health status of a managed member of staff in an email sent to several recipients.
- The disclosure of the complainant’s personal data in this context caused them considerable distress and they have ongoing concerns about the possibility of the disclosure negatively impacting future employment.
- This led to the complainant lodging a formal complaint about the Policy and Resources Committee to the Authority under section 67 of the Law.
- The Authority finds that the Policy and Resources Committee had no legal basis for disclosing this information.
- The Authority is therefore satisfied that the Policy and Resources Committee failed to comply with the lawfulness, fairness and transparency principle [s.6(2)(a)].
- Special category data (including health data) are afforded higher levels of protection in the Law, reflecting the harm and distress that can result from a breach. The Authority is clear that where organisations do not take their legal responsibilities to protect such data seriously, consideration will be given to the appropriate sanction including the issuing of a fine.
- In this case, the Authority has identified the following mitigating factors –
- – Early engagement and cooperation by the Policy and Resources Committee data protection officer
- – Early admission of the breach by the Policy and Resources Committee
- – Updated advice and support provided by the Policy and Resources Committee for employees
handling personal data
- Considering the above factors, the Authority has, by written notice to the Policy and Resources Committee, imposed a reprimand.
