Enforcement Order issued to The Committee for Health and Social Care over data protection training and governance (2023-02-23)

Summary

This is a public enforcement notice from Guernsey's Data Protection Authority against the Committee for Health and Social Care (HSC), following two investigations into staff training failures and poor device/leaver governance that led to breaches of the Data Protection (Bailiwick of Guernsey) Law, 2017. It sets out the findings, the legal breaches identified, and the corrective action HSC must take.

• Breach 1: Section 6 (duty to comply with data protection principles), specifically the integrity and confidentiality principle, due to insufficient security measures.
• Breach 2: Section 32 (data protection measures by design and default), for failing to implement suitable and proportionate governance around staff training and device handling on staff departure.
• Breach 3: Section 41 (duty to take reasonable steps to ensure security), for failing to ensure confidentiality, integrity, availability and resilience of processing systems, particularly device controls.
• Sanction: An enforcement order was issued under Section 73 of the Law requiring HSC to demonstrate improved processes by 31 March 2023.

HSC had a right of appeal under Section 84 (within 28 days) but did not exercise it. The notice serves mainly as a public record of the enforcement action and lessons on proactive governance for controllers handling sensitive personal data, rather than creating ongoing obligations for other entities.

Key obligations

• HSC must demonstrate by 31 March 2023 that it has improved its data processing practices, specifically staff training governance and device/leaver handling processes, per the enforcement order issued under Section 73 of the Law.

Applies to

The Committee for Health and Social Care (public authority controller), controllers processing sensitive personal data in the Bailiwick of Guernsey

Deadlines

• 31 March 2023: HSC must demonstrate that it has improved its data processing practices (staff training and device/leaver governance) as required by the enforcement order.
• 28 days: Statutory window under Section 84 of the Law within which HSC could have appealed the Authority's determination to the Court (not exercised).