Public Statement - Government of Jersey Customer & Local Services (2023-10-14)

Summary

This is a public statement issued by the Jersey Office of the Information Commissioner (Data Protection Authority) against the Government of Jersey's Customer & Local Services (CLS) department, following an investigation into its handling of two subject access requests (DSARs) from a member of the public.

• Contraventions found: CLS breached Art.8(1)(a) (lawful, fair, transparent processing), Art.14(1)(a) and (b) (technical and organisational measures and ability to demonstrate them), Art.27(1) (timely DSAR response) and Art.28(3)(a) (providing copies of personal data) of the Data Protection (Jersey) Law 2018.
• Underlying failings: Poor records management, DSAR searches conducted by untrained junior staff, unlawful reliance on exemptions, inconsistent redactions, and dismissive handling of the complainant's concerns.
• Sanctions imposed: A formal reprimand and orders under Art.25(3) of the Data Protection Authority (Jersey) Law 2018 requiring CLS to update its DSAR processes and improve staff training and technical/organisational measures; no administrative fine could be imposed because fines cannot be levied against public authorities.
• Compliance status: CLS has already carried out the ordered improvement measures and confirmed this to the Authority within the stipulated timeframe.

The statement is intended as a general reminder to all data controllers of the need for appropriate systems, policies and trained staff to respond properly to subject access requests, and notes that any affected party has a right of appeal to the Royal Court of Jersey within 28 days.

Key obligations

• CLS was ordered to update its processes relating to DSAR responses, including the information provided to the public about how such requests are handled
• CLS was ordered to provide staff education and improve technical and organisational measures so that DSAR responses are completed fully and in a timely manner by adequately trained personnel
• CLS was required to carry out these improvement measures within a stipulated timeframe and confirm completion to the Authority

Applies to

Government of Jersey departments, public authorities, data controllers

Deadlines

• 19/06/2020: Deadline by which CLS ought to have provided a full response to the First DSAR (actual response was not provided until 09/06/2021)
• 20/07/2020: Deadline by which CLS ought to have provided a full response to the Second DSAR (actual response was not provided until 09/06/2021)
• 28 days: Time limit under Art.32 of the Authority Law for an affected party to appeal to the Royal Court of Jersey