Section 16 Guidance

Summary

This ODPA guidance explains how a data controller should handle a data subject access request (DSAR) under section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017, when the requested information also identifies other individuals. It sets out the section 16 test for deciding whether to disclose, withhold or redact third-party information, and stresses documenting each decision.

• Step 1: Determine whether the other individual's information is inextricably linked to the requestor's data or can be separated without affecting context.
• Step 2: Assess whether it is appropriate and reasonable to seek the other individual's explicit consent before approaching them.
• Step 3: If consent cannot or should not be sought, carry out a balancing test weighing factors such as consent, type of data, significant interests of both parties, context, confidentiality, disclosure recipients, storage duration, safeguards, and consequences of disclosure.
• Step 4: If appropriate, seek the other individual's explicit, informed consent in writing (signed statement, electronic form, or email); if consent is given, disclose unless another exemption applies.
• Step 5: If disclosure is not reasonable, refuse to disclose the other individual's information but still respond to the requestor and keep a documented justification.
• Step 6: If disclosure is appropriate (with or without consent), provide the information in the same format as other DSAR responses, consistent with the request's original or requested format.
• Step 7: Where only partial disclosure is possible, redact identifying details properly (never by highlighting or colour change) and keep original records intact, working only on copies.
• Special rule: Job holders in education, health or social assistance roles cannot have their identity withheld under section 16, though the separate exemption in paragraph 16D of Schedule 8 may apply if disclosure could seriously harm the data subject or others.

Throughout the process, controllers must keep a contemporaneous record of the reasoning behind each decision to disclose, withhold or redact, as the Data Protection Authority or the requestor may ask them to justify it.

Key obligations

• Controllers must apply the section 16 balancing test whenever a DSAR or data portability request would require disclosing information that identifies another individual.
• Controllers must document all section 16 decisions (what information is included or excluded) contemporaneously, not retrospectively, and be able to justify them to the data subject or the Authority.
• Before disclosing linked third-party information, controllers must assess whether it is appropriate to seek the other individual's explicit, informed consent, and if consent is refused or not sought, must document the justification for withholding.
• Where explicit consent is given by the other individual, the information must be provided to the requestor unless another exemption applies.
• Where redaction is used, it must be limited in scope, performed on copies (not originals) using proper text replacement (e.g. [REDACTED]) rather than highlighting, and the reasoning documented.
• Controllers cannot rely on section 16 to withhold the identity of job holders in education, health or social assistance fields, except where the paragraph 16D Schedule 8 exemption applies (which for non-health organisations requires prior consultation with a health professional, subject to limited exceptions).

Applies to

data controllers, organisations handling data subject access requests under the Bailiwick of Guernsey Data Protection Law