Determination - Committee for Health & Social Care sanctioned for systemic issues handling Data Subject Access Requests (2026-06-26)

Summary

This is a formal Determination and Sanction issued by Guernsey's Office of the Data Protection Authority (ODPA) against the Committee for Health and Social Care (HSC) following an inquiry into HSC's handling of Data Subject Access Requests (DSARs). The Authority found breaches of sections 15, 27 and 31 of the Data Protection (Bailiwick of Guernsey) Law, 2017, relating to the right of access, the duty to comply with data subject requests within the designated period, and the duty to have adequate technical and organisational measures in place.

• Findings: HSC repeatedly failed to respond to DSARs within the statutory period, provided inconsistent and unreliable DSAR tracking data (two conflicting spreadsheets), and showed a rising trend of non compliant DSARs from 2023 to 2025 (roughly one third to one half of DSARs handled outside the designated period each year).
• Case examples: Four individual complaints (CAS-15246, CAS-15277, CAS-15278, CAS-15352) illustrated late or incomplete disclosures, unclear communications about extensions and non compliance, and in one case a DSAR from November 2023 remaining unresolved with a projected conclusion date of 31 March 2026.
• Enforcement order: Under section 73(1)(c) of the Law, the Authority has ordered HSC to take a series of remedial actions with staged deadlines, covering contacting overdue requestors, producing a backlog action plan, resolving overdue DSARs, reporting monthly to the Authority, and implementing systemic improvements to DSAR handling and communications.

The document is a case specific enforcement notice rather than a rule of general application, but it signals ODPA's expectations for public authority controllers on DSAR timeliness, record keeping integrity and resourcing, and sets a compliance timetable that HSC must meet and report against.

Key obligations

• Within 1 month of issuance of the notice, HSC must contact all requestors with overdue DSARs to address the delay and confirm whether their personal data is being processed.
• Where personal data is being processed, HSC must give overdue requestors a revised completion date: Phase 1 (DSARs overdue more than 6 months) within 2 months of issuance; Phase 2 (overdue 3 to 6 months) within 4 months of issuance; Phase 3 (overdue less than 3 months) within 6 months of issuance.
• Within 3 months of issuance, HSC must develop and disclose to the Authority a detailed plan of action for addressing its DSAR backlog, including resourcing details and a summary of all overdue DSARs (reference numbers, receipt dates, information requested, and status).
• HSC must resolve all overdue DSARs by the revised completion dates set out in term 1, or earlier if possible.
• Following the date of the notice, HSC must provide monthly written updates to the Authority on the status of all overdue DSARs, consistent, clear and accurate, until resolved.
• Within 6 months of issuance, HSC must implement changes to ensure future DSARs are dealt with promptly and effectively within the designated period, covering training, governance, systems, record keeping accuracy and adequate staffing and resources.
• Within 6 months of issuance, HSC must implement changes to ensure communications to requestors about extensions or non compliance are provided within the designated period, including governance on default extension periods, amendments, prioritisation and escalation.
• Within 6 months of issuance, HSC must provide the Authority with a detailed summary of the changes made in response to terms 5 and 6.

Applies to

Committee for Health and Social Care (public authority controller), data controllers, public authorities

Deadlines

• within 1 month of issuance of this notice: HSC must contact all requestors with overdue DSARs to address the delay and confirm processing status.
• 2 months from issuance of this notice: Phase 1 revised completion date for the initial third of pending overdue DSARs (prioritising those overdue more than 6 months).
• 4 months from issuance of this notice: Phase 2 revised completion date for the next third of pending overdue DSARs (prioritising those overdue 3 to 6 months).
• 6 months from issuance of this notice: Phase 3 revised completion date for the final third of pending overdue DSARs (prioritising those overdue less than 3 months).
• within 3 months of issuance of this notice: HSC must disclose to the Authority a detailed plan of action addressing its DSAR backlog and resourcing.
• monthly, following the date of this notice until resolved: HSC must provide written updates to the Authority on the status of all overdue DSARs.
• within 6 months of issuance of this notice: HSC must implement systemic changes to ensure future DSARs are handled promptly and within the designated period.
• within 6 months of issuance of this notice: HSC must implement changes to ensure timely communications to requestors regarding extensions or non compliance, and provide the Authority a summary of changes made under terms 5 and 6.