Investigation Report issued to family after ODPA serves Enforcement Order (2023-12-15)

Summary

This is a public statement issued by the Guernsey Office of the Data Protection Authority (ODPA) under section 64 of the Data Protection (Bailiwick of Guernsey) Law, 2017, describing an investigation and Enforcement Order served on the Committee for Health and Social Care (HSC). It concerns HSC's mishandling of a data subject access request made by the guardian of a vulnerable adult, seeking a safeguarding investigation report.

• Breach findings: The Authority determined HSC breached section 15 (Right of Access) and section 25 (duty to facilitate data subject requests) of the Law by applying unreasonable redactions and withholding appendices from the disclosed report.
• Sanction imposed: The Authority issued an Enforcement Order under section 73 compelling HSC to release the full report, which HSC did five months after the initial request, with only minimal redactions.
• Appeal route: Under section 84, a controller may appeal a determination to the Court within 28 days; HSC did not appeal and complied with the order.
• Broader message: The Authority reiterates that organisations responsible for care of vulnerable individuals must respond to subject access requests promptly, disclose information fully unless a valid exemption applies, and that Enforcement Orders will be used where information is unreasonably withheld.

The document is informational and case-specific: it records completed enforcement action against HSC and serves as guidance to other organisations on handling subject access requests involving vulnerable individuals, rather than imposing new ongoing obligations on the wider public.

Key obligations

• Organisations must respond to data subject access requests within the timeframe set out in the Law (usually one calendar month, extendable on request)
• Organisations must provide all information requested unless a valid statutory exemption applies, and may not withhold information merely to protect their own interests
• HSC was required to disclose the full investigation report (including appendices) to the family as compelled by the Enforcement Order
• A controller wishing to challenge an Authority determination must appeal to the Court within 28 days

Applies to

The Committee for Health and Social Care (HSC), data controllers, data processors

Deadlines

• within 28 days: Statutory period under section 84 for a controller to appeal an Authority determination to the Court
• one calendar month (extendable): Usual timeframe under the Law for a controller to respond to a data subject access request