Enforcement Order - Department of Agriculture (2021-07-12)

Summary

This is an Ombudsman enforcement order arising from a complaint that the Department of Agriculture (DoA) was collecting excessive personal data from retail customers buying goods such as plants and trees. The Ombudsman found the DoA breached the first and third data protection principles under the Data Protection Act by processing personal data unfairly (no privacy notice, no legal basis) and by collecting more data than necessary.

• First principle breach: DoA collected customers' names, addresses, district, phone numbers and email at point of sale without informing them of the data controller's identity or the purpose of processing, and without any valid legal basis (a claimed Ministry of Finance mandate was found not to exist).
• Third principle breach: DoA admitted its point-of-sale system could be programmed not to require personal data, confirming the collection was unnecessary and excessive for issuing receipts.
• Non-compliance history: DoA requested and was given 31 days to fix the practices after an initial warning but had not changed its data collection practices by the time of this order.

The Ombudsman ordered the DoA to stop the contravening practices within 30 days and confirmed the DoA may seek judicial review of the order in the Grand Court within 45 days of receipt.

Key obligations

• DoA must cease obtaining unnecessary personal data from retail customers within 30 days.
• DoA must delete all personal data previously collected from data subjects without a valid legal basis within 30 days.
• DoA must provide a privacy notice to data subjects when collecting their personal data, in accordance with the first data protection principle, within 30 days.

Applies to

Department of Agriculture, data controllers (government departments)

Deadlines

• within 30 days: DoA must cease excessive data collection, delete unlawfully collected personal data, and implement a privacy notice.
• within 45 days of receipt: Deadline for DoA to seek judicial review of the Enforcement Order in the Grand Court under section 47 of the Data Protection Act.