Contact

Rachel Guthrie

Rachel Guthrie

Counsel | Guernsey

Hana Plsek

Hana Plsek

Senior Associate | Guernsey

Update

Third reprimand issued by Guernsey's Data Protection Authority

30 March 2020

The Channel Islands Financial Ombudsman (CIFO) has been given a formal reprimand by the Office of Data Protection Authority. This is the third public reprimand that the Authority has issued to date.

In a public statement issued by the Authority on 11 March 2020, CIFO has been issued with a reprimand for contravening section 6(2)(f) of the Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law).

This decision is the result of a complaint made to the Authority by an individual under section 67 of the Law. Section 67 allows an individual to make a formal written complaint to the Authority if they believe that a data controller or data processor has breached (or is likely to breach) the Law and that breach involves or affects that individual's personal data or any of their data subject rights under the Law.

Under the Law, a data controller is required to ensure that all processing of data is in accordance with the data protection principles and is responsible for, and must be able to demonstrate, compliance with those principles.

In this instance, the Authority determined that CIFO had breached the data protection principle under section 6(2)(f) of the Law; Integrity and Confidentiality, which requires that personal data is processed in a manner that ensures its security appropriately and is protected against, amongst other things, accidental loss or unlawful processing. This particular principle is wide and could capture either accidental or intentional mishandling of data where personal data is not appropriately secured by the data controller.

The breach by CIFO occurred when an email containing personal data of the complainant (which included special category data) was mistakenly sent to an incorrect email address.

The Authority reiterated that, as previously specified, where organisations breach their obligations under the Law, including failing to ensure the security of personal data, consideration will be given to an appropriate sanction which could result in the issuance of a fine.

As CIFO made an early admission of its error, which it took immediate action to rectify, and in the absence of any aggravating factors, a formal reprimand was imposed.

 

Contact

Rachel Guthrie

Rachel Guthrie

Counsel | Guernsey

Hana Plsek

Hana Plsek

Senior Associate | Guernsey

About Mourant

Mourant is a law firm-led, professional services business with over 60 years' experience in the financial services sector. We advise on the laws of the British Virgin Islands, the Cayman Islands, Guernsey, Jersey and Luxembourg and provide specialist entity management, governance, regulatory and consulting services.

Scroll To Top