Public Statement - CSS Limited (2020-01-28)

Summary

This is a public statement issued by the Jersey Data Protection Authority under Article 14 of the Data Protection Authority (Jersey) Law 2018, detailing the outcome of an investigation into CSS Limited, a data controller that suffered three data security incidents (a 2018 ransomware attack, unauthorised third-party access in November 2018, and a loss of system integrity in early 2019). The Authority found CSS Limited failed to have adequate security measures, failed to respond appropriately to a personal data breach, and failed to notify the Authority and affected data subjects.

• Contravention found: CSS Limited breached Article 8(1)(f) of the Data Protection (Jersey) Law 2018 by failing to implement adequate technical and organisational security measures, including inadequate firewalls, insufficient staff training, and poor oversight of its IT provider.
• Failure to respond and notify: CSS Limited did not recognise the incident as a personal data breach, did not assess its impact on data subjects, and failed to notify the Authority or affected individuals as required.
• Orders imposed: By final written notice dated 8 January 2020, the Authority ordered CSS Limited to update its IT systems, provide staff education/training, and notify certain affected data subjects, pursuant to Article 25(3) of the Authority Law.
• Ongoing supervision: CSS Limited remains under supervision by the Information Commissioner until the end of May 2020, with a final review by the Authority's external information security expert at that time.

The statement also notes procedural steps taken, including CSS Limited's opportunity to make representations on the draft determination and its right of appeal to the Royal Court of Jersey within 28 days of the Final Determination.

Key obligations

• CSS Limited must update its IT systems as ordered by the Authority
• CSS Limited must provide data protection education/training to its staff
• CSS Limited must notify certain affected data subjects of the breach as ordered
• CSS Limited must remain under the Information Commissioner's supervision until the end of May 2020 and undergo a final review by the Authority's external security expert
• Any appeal against the Final Determination must be lodged with the Royal Court of Jersey within 28 days of the notice

Applies to

data controllers

Deadlines

• end of May 2020: CSS Limited remains under supervision by the Information Commissioner until this date, followed by a final review
• 28 days from 8 January 2020 Final Determination: Deadline for CSS Limited (or an affected party) to lodge an appeal to the Royal Court of Jersey under Art.32 of the Authority Law