Public Statement - Parish of Grouville (2025-10-14)

Summary

This is a Public Statement issued by the Jersey Office of the Information Commissioner (JOIC) against the Parish of Grouville (POG) following an investigation into how it identified and pursued a member of the public for outstanding parish rates. The Authority found three contraventions of the Data Protection (Jersey) Law 2018 relating to lawfulness/transparency, purpose limitation, and data security/governance, after POG misidentified an individual, used driving licence data (LICAR) for an unrelated purpose, and passed unverified details to a debt collector.

• Finding 1: Breach of Art.8(1)(a) (lawfulness, fairness and transparency) for using LICAR driving licence data to trace rates debtors without transparency or lawful basis, and without sufficient identity checks.
• Finding 2: Breach of Art.8(1)(b) (purpose limitation) because POG's Privacy Policy did not disclose that LICAR data could be used to identify rates debtors.
• Finding 3: Breach of Art.8(1)(f) (integrity and confidentiality) due to lack of a written outstanding rates process and sending unverified information to a debt collector.
• Sanctions: POG received a formal reprimand and was issued three Orders to improve compliance; the Authority states these Orders were subsequently completed.

The Authority uses the case to draw lessons for other public authorities: maintain documented, proportionate processes for identifying individuals, ensure staff training, keep privacy notices accurate and transparent, and periodically review data governance controls, including data sharing arrangements.

Key obligations

• POG was required to review and document its Outstanding Rates process, including checks to identify individuals responsible for payments, and provide the updated process to the Authority by 28 February 2025.
• POG was required to train all relevant staff on the Outstanding Rates process by 6 February 2025 and provide evidence of training to the Authority by 28 February 2025.
• POG was required to review and update its Privacy Policy to accurately reflect its processing activities and provide the updated policy to the Authority by 28 February 2025.

Applies to

public authorities (parishes), data controllers

Deadlines

• 28 February 2025: Deadline for POG to provide the Authority with the updated Outstanding Rates process document, training evidence, and updated Privacy Policy.
• 6 February 2025: Deadline for staff training on the Outstanding Rates process to be completed.