Public Statement - Planning & Building Control (2020-10-19)

Summary

This is a public statement issued by the Data Protection Authority (Jersey) under Article 14 of the Authority Law, following an investigation into the Planning and Building Control Department, Government of Jersey. The Authority found the Department contravened the integrity and confidentiality principle in Article 8(1)(f) of the Data Protection (Jersey) Law 2018, resulting in the public disclosure of sensitive health information about a vulnerable minor.

• Breach 1: Insufficient redaction of information uploaded to the Department's online planning applications registry allowed identification of a vulnerable minor and hinted at sensitive health information.
• Breach 2: Extremely sensitive special category (health) data about a vulnerable minor was published in error on the registry.
• Sanction: Because the Controller is a public authority, the Authority could not impose an administrative fine; instead it issued a formal reprimand and orders under Article 25(3) of the Authority Law.
• Orders imposed: The Department must update its systems and policies, provide staff education/training, and notify the affected data subject.

The Authority noted mitigating factors (cooperation, early admissions, prompt removal of material, system updates) alongside aggravating factors (repeated re-upload of inadequately redacted material and minimisation of the harm). The statement also explains the general legal framework for complaints, investigations and determinations under the Authority Law, and confirms a right of appeal to the Royal Court of Jersey within 28 days.

Key obligations

• The Planning and Building Control Department must notify the affected data subject of the breaches of system integrity.
• The Department must update its relevant systems and policies to prevent recurrence.
• The Department must provide updated education/advice and support for staff handling personal data.
• Any party affected by the determination who wishes to appeal must do so to the Royal Court of Jersey within 28 days.

Applies to

public authorities, data controllers, government departments

Deadlines

• 28 days: Time limit for an affected party to appeal the Authority's determination to the Royal Court of Jersey under Article 32 of the Authority Law.