Determination - ODPA partially upholds complaint against States of Alderney by former Chief Executive (2025-11-26)

Summary

This is a public abridged enforcement determination by the Guernsey Office of the Data Protection Authority (ODPA) following an investigation into a data subject access request (DSAR) complaint against the States of Alderney by its former Chief Executive. The Authority partially upheld the complaint, finding that unreasonable redactions were applied to a dismissal letter, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017.

• Finding: The States of Alderney failed to comply with section 15 of the Law by applying unreasonable and inconsistent redactions to a letter outlining the reasons for the Complainant's dismissal, meaning he did not receive all personal data to which he was entitled.
• Partial vindication of redactions: The Authority accepted that some redactions relating solely to another individual's personal data were properly applied under section 16 of the Law and should remain.
• Enforcement order: Under section 73 of the Law, the Authority ordered the States of Alderney to provide the Complainant with an appropriately redacted copy of the Letter and to confirm compliance to the Authority in writing within one month of the order's issuance.

The determination serves as a public record of the outcome and enforcement action taken; it directly binds the States of Alderney as the controller in this case but also signals the Authority's expectations for handling redactions and third party information in DSARs more generally.

Key obligations

• The States of Alderney must provide the Complainant with an appropriately redacted copy of the Letter
• The States of Alderney must comply with the order within 1 month of the date of issuance and advise the Authority in writing when it has done so

Applies to

States of Alderney (data controller), public sector bodies acting as data controllers in Guernsey/Alderney

Deadlines

• 1 month of the date of issuance of the order: States of Alderney must provide the redacted Letter to the Complainant and confirm compliance in writing to the Authority