Government Breaks Data Law For Third Time

Customer and Local Services have broken Data Protection Law, making it the third time a government department has breached the regulation in as many years.

Under the Data Protection Law, anyone has the right to ask an organisation what information about them is being held.

An islander asked CLS for the data it held about them but, following an investigation, the Jersey Office of the Information Commissioner found that the department was dismissive to the person asking for information.

CLS couldn't find all of the person's information because it didn't have the right systems in place for the type of request. The staff member responsible was also a junior member who hadn't had the correct training.

Once the information had been handed over to the islander who requested it, the JOIC found that the department had illegally withheld some data.

The JOIC has issued four public statements in the past four years, and 3/4 of them have been against the government.

"This particular department has a “touch point” in every islander’s life and holds personal information, including sensitive information, about all islander’s lives - from a health perspective, education, business, tax and so on.

It may be interesting to note that if this had been an investigation against a private entity the Authority would have considered the imposition of a significant fine."

The Data Protection Law doesn't allow the authority to issue fines to public bodies like the States of Jersey.

However, a 'formal reprimand' has been handed to CLS which lays out orders which will mean it has to improve its data protection compliance within a time frame.

"The statement draws attention to the importance of data protection training.

It also highlights that this should act as a reminder that anyone holding personal information require appropriate systems, policies and appropriately trained staff to properly respond to requests that are made to them by islanders."

CLS Chief Officer, Ian Burns says the department takes its data protection responsibilities seriously.

"It is very disappointing that we have not handled this customer’s subject access requests correctly. I have apologised to the customer personally.

We have cooperated fully with the Jersey Office of the Information Commissioner regarding this complaint and have taken immediate action to improve our service for subject access requests in accordance with their recommendations.”