Data Protection Authority opens Inquiry into data breach at the Director of the Revenue Service (2024-04-29)

Summary

This is a public statement issued by the Guernsey Data Protection Authority (ODPA) announcing that it has opened a formal inquiry under section 69 of The Data Protection (Bailiwick of Guernsey) Law, 2017 into a data breach affecting the Director of the Revenue Service. The inquiry follows a breach notification submitted by the Revenue Service to the Authority and will examine whether the Revenue Service has breached an operative provision of the Law.

• Nature of statement: Issued under section 64 of the Law as a public statement; it is informational and does not itself create new legal duties.
• Trigger: A breach notification from the Director of the Revenue Service, alleging a significant volume of personal information was affected.
• Purpose of inquiry: To determine whether the Director of the Revenue Service breached an operative provision of the Data Protection (Bailiwick of Guernsey) Law, 2017.
• Process note: The Authority states not all breach notifications lead to an inquiry; they are assessed case by case on facts and risk.
• Outcome: No conclusion is stated; the Authority says the outcome should not be speculated on and no further comment will be made at this time.

Applies to

Controllers (data controllers under the Data Protection (Bailiwick of Guernsey) Law, 2017), The Director of the Revenue Service (as controller)