HSC ordered to improve its access request response (2024-11-22)

Summary

This is a public statement issued by the Guernsey Data Protection Authority (ODPA) under the Data Protection (Bailiwick of Guernsey) Law, 2017, concerning a specific enforcement case against the Committee for Health and Social Care (HSC). It describes findings that HSC failed to properly search for and disclose personal data in response to a subject access request, and separately failed to comply with a legally binding Information Notice within the required timeframe.

• Breach findings: HSC breached section 15 (right of access) by not providing all personal data the complainant was entitled to, and breached section 25 (reasonable steps to facilitate data subject rights) by failing to search all relevant filing systems and electronic databases and by keeping inadequate search records.
• Information Notice breach: HSC breached section 37 by failing to comply with an Information Notice within its compliance period, though it later provided the information late.
• Order imposed: The Authority ordered HSC to carry out further searches and provide the complainant with all personal data they are entitled to, implement measures to identify all relevant filing systems and databases for future searches, and within three months implement improved processes and confirm this to the Authority.
• Reprimand imposed: A separate Reprimand was issued against HSC for its failure to comply with the Information Notice within the required timeframe.
• Repeat issue: This is the second public statement and second Order against HSC concerning missed information in subject access requests, following a similar 2022 investigation.

The statement also sets out the general expectation that any organisation subject to a data subject access request must take reasonable steps to comply, including identifying all relevant filing systems and databases and being able to demonstrate why its search parameters and any excluded systems were reasonable. A controller may appeal a determination or sanction to the Court within 28 days of issuance under section 84.

Key obligations

• HSC must carry out further searches for the complainant's personal data and provide them with a copy of everything they are entitled to receive.
• HSC must implement measures to identify all relevant filing systems and electronic databases to be considered when conducting searches for personal data in response to subject access requests.
• HSC must, within three months, implement improved processes to ensure compliance with future data subject access requests and confirm to the Authority that this has been done.
• Controllers generally must take reasonable steps to comply with subject access requests, including identifying all relevant filing systems and databases and using appropriate search parameters, and must be able to demonstrate the reasonableness of searches conducted and explain any systems not searched.
• Controllers must comply with Information Notices issued by the Authority within the required compliance period.

Applies to

Committee for Health and Social Care (HSC), data controllers

Deadlines

• within three months: HSC must implement improved processes to ensure compliance with future data subject access requests and confirm this to the Authority.
• within 28 days of the issuance of the determination: Deadline for a controller to appeal a determination or sanction to the Court under section 84 of the Law.