Public Statement - Department for Children, Young People, Education and Skills (CYPES) (2025-09-25)

Summary

This is a public statement issued by the Jersey Office of the Information Commissioner (JOIC) under Article 14 of the Data Protection Authority (Jersey) Law 2018, following an investigation into the Department for Children, Young People, Education and Skills (CYPES). The Authority found that CYPES contravened the integrity/confidentiality principle (Art.8(1)(f)) and the lawful processing requirement for special category data (Art.9) of the Data Protection (Jersey) Law 2018, after a child's mother's special category data was disclosed to another family member without consent or lawful basis during a referral meeting.

• Formal reprimand: CYPES was issued a formal reprimand under Art.25(3) of the DPAJL 2018 for the two findings of contravention.
• Order 1 (process review): CYPES was ordered to review its referral process so that information used and shared is clearly captured and understood by professionals, and to provide the Authority with revised documentation.
• Order 2 (training): CYPES was ordered to ensure staff and third-party organisations involved in referrals are appropriately trained to manage special category data, and to confirm to the Authority that training had been completed.
• Outcome: The Authority confirms both orders were completed to an appropriate standard within the required timeframe, and continues to provide ongoing supervision and guidance to CYPES.

The statement also sets out broader lessons for any organisation handling special category data: staff processing such data must be properly trained and skilled, and records management processes must be robust enough to ensure the data is captured and protected correctly at every stage. The Authority notes that future negligent handling of special category data could attract stronger sanctions, including fines.

Key obligations

• CYPES was required to review its referral process and provide the Authority with revised documentation by 10 April 2025.
• CYPES was required to train staff and third-party organisations on managing special category data by 7 April 2025.
• CYPES was required to advise the Authority by 10 April 2025 of the training provided and confirm staff understanding.
• Organisations generally must ensure staff handling special category data have appropriate skills, experience and training.
• Organisations generally must maintain robust, fit-for-purpose records management processes for special category data.

Applies to

Department for Children, Young People, Education and Skills (CYPES), data controllers (public bodies)

Deadlines

• 10 April 2025: Deadline for CYPES to provide the Authority with revised referral process documentation (Order 1).
• 7 April 2025: Deadline for CYPES to provide training on managing special category data to staff and third parties (Order 2).
• 10 April 2025: Deadline for CYPES to advise the Authority of training provided and confirm staff competence (Order 2).