Committee for Health & Social Care sanctioned for systemic issues handling Data Subject Access Requests (2026-06-26)

Summary

This is a public enforcement notice from the Guernsey Office of the Data Protection Authority (ODPA) describing the outcome of an inquiry into the Committee for Health & Social Care (HSC) over its handling of Data Subject Access Requests (DSARs), particularly within Children and Family Community Services. The Authority found HSC breached sections 15, 27 and 31 of the Data Protection (Bailiwick of Guernsey) Law, 2017 and issued an Enforcement Order.

• Section 15: Failure to give individuals a copy of their personal data (the right of access) within the designated period.
• Section 27: Failure to properly notify requestors of extensions or non-compliance within the designated period.
• Section 31: Failure to take reasonable steps to ensure processing complied with the Law, linked to under-resourcing of DSAR handling.

The notice also records that HSC had stopped using an administrative tool created after a prior Enforcement Order, citing resource constraints, though the Authority concluded this did not amount to a further contravention given other measures HSC had implemented. The document closes with general lessons for controllers about prioritising resourcing for data protection compliance, especially where sensitive health and childhood records are involved.

Enforcement Order requirements

• Contact all requestors with overdue DSARs and provide revised completion dates.
• Resolve all overdue DSARs by the revised completion date given to each requestor.
• Develop a detailed plan of action for addressing the backlog of DSARs.
• Provide the Authority with monthly updates on overdue DSARs.
• Implement changes so future DSARs are dealt with promptly and within the designated statutory period.
• Implement changes to ensure communications about extensions or non-compliance are sent to requestors within the designated period.

Key obligations

• HSC must contact all requestors with overdue DSARs and provide revised completion dates
• HSC must resolve all overdue DSARs by the revised completion date
• HSC must develop a detailed plan of action for addressing its DSAR backlog
• HSC must provide the Authority with monthly updates regarding overdue DSARs
• HSC must implement changes ensuring future DSARs are handled promptly and within the statutory designated period
• HSC must implement changes ensuring communications about extensions or non-compliance are provided to requestors within the designated period

Applies to

Committee for Health & Social Care, public authorities, government bodies, data controllers

Deadlines

• monthly: HSC must provide the Authority with monthly updates regarding overdue DSARs
• revised completion dates (case by case): HSC must resolve each overdue DSAR by the revised completion date communicated to the requestor