ODPA partially upholds complaint against States of Alderney by former Chief Executive (2025-11-26)

Summary

This is a public statement issued by the Guernsey Office of the Data Protection Authority (ODPA) reporting the outcome of a complaint brought by the former Chief Executive/Chief Clerk of the States of Alderney against that body as data controller. The complaint concerned the States of Alderney's response to a Data Subject Access Request (DSAR) made after his employment was terminated in December 2024.

• Finding: The Authority found the States of Alderney breached section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017, which governs a data subject's right of access to personal data.
• Basis: Redactions applied to a letter provided in response to the DSAR were inconsistent and excessive; while some redaction was justified where information related solely to a third party, other information should have been disclosed unredacted.
• Impact: The volume and application of redactions was found to have prevented a fair and transparent process and impaired the complainant's ability to understand the grounds for decisions made about him.
• Outcome: The Authority issued an Enforcement Order requiring the States of Alderney to provide the complainant with an appropriately redacted version of the document consistent with the investigation's findings; that process is reported as underway.

The statement is framed as a case study on applying a fair and balanced test to redaction decisions in subject access requests, and notes the States of Alderney's cooperation with the Enforcement Order.

Key obligations

• The States of Alderney must provide the complainant with an appropriately redacted version of the document in accordance with the Authority's investigation findings, as required by the Enforcement Order.

Applies to

States of Alderney (public authority controller), data controllers responding to data subject access requests