Medical Specialist Group issued with an Enforcement Order for failings identified in processing agreement (2024-10-31)

Summary

This is a public statement issued by the Guernsey Data Protection Authority under section 64 of the Data Protection (Bailiwick of Guernsey) Law, 2017, detailing an Enforcement Order issued against the Medical Specialist Group LLP (MSG) following a patient complaint investigation.

• Background: A complaint about incomplete medical records led the Authority to investigate MSG's joint data processing agreement with other controllers who shared patient data.
• Finding: The Authority determined MSG breached section 33 of the Law by failing to have a sufficiently detailed joint controller agreement, causing confusion over responsibility for handling patient data requests.
• Sanction: Under section 73 of the Law, the Authority issued an Enforcement Order compelling MSG to improve the agreement between itself and its joint controllers.
• Outcome: MSG cooperated with the investigation and did not appeal the determination or sanction; it must demonstrate compliance with the Order by February 2025.

The statement serves as a reminder that controllers sharing the same personal data with other organisations must have a clear written agreement addressing legal responsibilities, in line with the Law's accountability principle.

Key obligations

• MSG must take specific corrective actions set out in the Enforcement Order to bring its practices into compliance with section 33 of the Law
• MSG must demonstrate compliance with the Enforcement Order's requirements by February 2025
• Joint controllers processing the same personal data must agree on their respective responsibilities for compliance and document this in a written agreement (section 33 of the Law)

Applies to

controllers, joint controllers, medical/healthcare data controllers

Deadlines

• February 2025: Deadline for MSG to demonstrate compliance with the Enforcement Order's requirements
• 28 days of the issuance of the determination and/or sanction: Statutory window under section 84 of the Law for a controller to appeal a determination or sanction to the Court (not exercised by MSG in this case)