ODPA launch inquiry into States IT outages (2023-10-06)

Summary

This is a public statement issued by the Office of the Data Protection Authority (ODPA) under section 64 of the Data Protection (Bailiwick of Guernsey) Law, 2017, announcing that it has opened a formal inquiry under section 69 of the Law into data room service outages that affected the States of Guernsey's IT systems between November 2022 and January 2023. The controller under investigation is the States of Guernsey's Policy & Resources Committee.

• Trigger: The inquiry follows the Authority's review of the full PwC 'Major Incident Review' report, obtained using the Authority's information-gathering powers, after a public summary of that report was issued on 19 June 2023.
• Scope: The Inquiry will assess the manner and extent to which the Controller complied with the Law, including requirements relating to data availability and resilience.
• Authority's power: Section 69 allows the ODPA to launch an inquiry at its own discretion where there are compliance concerns, without needing a prior complaint.
• No further comment: The ODPA states its outcome should not be speculated on or pre-judged, and no further comment will be made at this time.
• Call for evidence: Anyone with evidence of the specific impact of the outages is invited to contact the ODPA Investigation Team by email at casework@odpa.gg.

This is an informational public statement about the launch of a regulatory inquiry rather than a document imposing new general rules; it does not itself create compliance obligations for entities beyond the specific controller under investigation.

Applies to

controllers, processors, States of Guernsey's Policy & Resources Committee