Policy & Resources ordered to release employment reference (2024-04-12)

Summary

This is a public statement issued by the Guernsey Data Protection Authority under section 64 of the Data Protection (Bailiwick of Guernsey) Law, 2017, describing an enforcement action against the Policy and Resources Committee (P&R). A jobseeker requested a copy of an employment reference under their right of access, and P&R refused, citing the interests of the reference's author. The Authority investigated, found a breach of the right of access, and issued an Enforcement Order compelling disclosure with agreed redactions, which P&R complied with without appeal.

• Breach found: P&R breached section 15 (Right of Access) by refusing to disclose an employment reference to the data subject who requested it.
• Legal basis for refusal: P&R relied on section 16 (exception where disclosure would involve another individual's personal data), but the Authority found P&R had not adequately weighed the jobseeker's significant interests in a proper balancing test.
• Remedy imposed: An Enforcement Order under section 73 required P&R to provide the reference with redactions agreed by the Authority.
• Outcome: P&R did not appeal (appeals under section 84 must be made within 28 days) and has provided the reference as ordered.
• Guidance point: Where personal data relates to more than one person and cannot be redacted without losing context, controllers must conduct a balancing test before refusing an access request; the Authority has published guidance on this on its website.

Key obligations

• Controllers who receive a data subject access request that includes information about another identifiable individual must conduct a balancing test weighing the significant interests of the requestor against those of the other individual before refusing disclosure under section 16.
• A controller subject to an Enforcement Order under section 73 must comply with the Order (here, disclosing the reference with agreed redactions) or appeal to the Court within 28 days under section 84.

Applies to

controllers, data controllers subject to the Data Protection (Bailiwick of Guernsey) Law, 2017

Deadlines

• 28 days: Any appeal by a controller against an Authority determination or sanction must be made to the Court within 28 days under section 84 of the Law.