Enforcement Order issued to Guernsey Union D'Escrime LBG over failures in processing of personal data (2023-12-08)

Summary

This is a public statement from Guernsey's Office of the Data Protection Authority (ODPA) reporting on an enforcement order issued to Guernsey Union D'Escrime LBG (GUE), a fencing association, following an investigation into a data subject access request. The Authority found GUE breached section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017 by failing to provide all relevant personal data within the deadline required by section 27.

• Background: A family requested information held about their minor child following safeguarding concerns; GUE did not provide all relevant personal data until 237 days after the request, and only after the Authority intervened.
• Breach found: GUE breached section 15 (right of access) of the Law by not meeting the response deadline set out in section 27.
• Sanction: Under section 73 of the Law, the Authority issued an enforcement order requiring GUE to take specified action to address shortcomings in its data processing and demonstrate improvement within three months.
• Appeal: GUE had a right of appeal against the determination and enforcement order but did not exercise it, though it disputed the fairness of the sanction while committing to comply.

The case is presented as a lesson for organisations, particularly smaller or third-sector bodies, on the importance of robust processes for handling data subject access requests, cooperating with the Authority, and acting on its advice, regardless of organisational size or resources.

Key obligations

• Guernsey Union D'Escrime LBG must, within three months of the enforcement order, demonstrate that it has improved its processes for handling data subject access requests to address the identified shortcomings.
• Controllers generally must respond to data subject access requests and provide all relevant personal data within the deadline required by section 27 of the Data Protection (Bailiwick of Guernsey) Law, 2017.

Applies to

controller, data controllers, third sector organisations/charities, Guernsey Union D'Escrime LBG

Deadlines

• within three months: GUE must demonstrate it has improved its data subject access request processes as required by the enforcement order
• 237 days after the request: Time it took GUE to provide the additional personal data to the family after the Authority intervened, cited as the basis for the breach finding